Privacy Policy · Skemly

1. Who is responsible

Onfollow Group LLC, 1621 Central Ave, Cheyenne, WY 82001, USA is the controller of personal data processed through Skemly. Privacy requests: legal@skemly.link.

2. Data about our customers

Account: email, name (optional), password (stored only in encrypted form), language, two-step login settings.
What you create: links, destinations, QR designs, tags, Bio Links, domains, team members, API keys (stored only in hashed form).
Billing: plan, billing period, currency and payment status. When you start a payment we create a customer record at Stripe with your email. Card details are handled by Stripe, not by us.
Sign-in security: when you log in, our authentication provider records the IP address and browser of the session, to protect your account. This is the only place we keep an IP address, and only for signed-in customers, never for people who click links.
How you found us: the source of your visit when you signed up (for example a search engine, a social network or an ad campaign) and the country of your first sign-in (from our hosting provider, not from your IP address). We use it only for our own statistics.
Team invitations: when you invite someone, we store their email and send them an invitation email; an account is created for them only to accept it. If they never accept, it is deleted when you remove them or delete your account.

3. Data about website visitors

When you open a page of skemly.link we count the visit without cookies and without storing your IP address: the page, its language, approximate country, device type, the website you came from (domain only), any campaign tag in the address (utm) and a daily pseudonymous code that changes every day. If you accept advertising cookies, the Meta Pixel also runs (see the Cookie Policy).

4. Data about people who click a link

When someone opens a Skemly link we record: time, approximate country and city, device type, operating system, browser, language, the website they came from (domain only) and a pseudonymous visitor code that changes every day (made from the IP address and browser with a daily secret, so we can count unique visitors). We never store the IP address itself and we don’t use the code to identify anyone. We use this only to show statistics to the owner of the link.

5. Support chat

If you write to us in the chat we keep your name, your email (optional for website visitors), your messages, the page you were on and your language, so we can answer you. To limit abuse we also keep a daily code made from your IP address (not the address itself).
First answers come from an AI assistant run by Anthropic (USA): it receives the last messages of the conversation (up to 20) and your name, only to write the reply. A person from our team can take over at any time.
Legal basis: our legitimate interest in answering questions, and the contract when you are a customer.

6. Reports

If you report a link we keep the link, the reason, your description and, only if you give it, your email, to handle the report. We don’t store your IP address.

7. Why we use data (legal basis)

To provide the service you signed up for (contract).
To keep Skemly safe: checking destinations, preventing abuse and fraud, protecting accounts (legitimate interest).
To show pseudonymous click statistics to link owners (legitimate interest).
To understand how people find Skemly and improve it, with pseudonymous visit counts and the sign-up source (legitimate interest).
To measure our ads on Facebook and Instagram with the Meta Pixel, only if you accept (consent, which you can withdraw at any time from «Cookie Settings»).
To send team invitations that a customer asks for (legitimate interest of the customer and of the invited person).
To meet legal duties such as tax records and requests from authorities (legal obligation).

8. Service providers

Supabase, database and sign-in, hosted in Frankfurt (Germany).
Vercel, hosting of the website and the app.
Cloudflare, network, security and delivery of the short links, plus the bot check (Turnstile) on sign-up and sign-in.
Resend (USA), sending our emails (sign-up, password, invitations, notices).
Anthropic (USA), the AI assistant of the support chat.
Meta Platforms Ireland Ltd (with Meta Platforms Inc., USA), only if you accept advertising cookies: measurement of our ads with the Meta Pixel. For this collection Meta and we are joint controllers.
Stripe, payments. Stripe is the seller of record and an independent controller for payment data (see its own privacy policy).
Security lists (such as Google Web Risk and other abuse databases, plus Cloudflare security DNS), they receive the destination addresses of links (the full address, which can include its parameters) to check them for phishing and malware, at creation and daily.

They may only use the data to provide their service to us. Where data leaves the EU, it is protected by the European Commission’s standard contractual clauses or an equivalent safeguard.

9. How long we keep data

Account and links: until you delete them or your account.
Click details: up to 13 months (less if your plan’s history is shorter). After that only daily totals by country, device and source are kept, for as long as your plan’s history allows (up to 5 years).
Support chats: as long as needed to help you and answer follow-up questions; you can ask us to delete them at any time.
Website visit counts: up to 13 months.
Reports: as long as needed to handle them, and up to 2 years.
Billing records: as long as tax law requires.

10. Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its use, and you can delete your account from Settings at any time. Email legal@skemly.link, we reply within one month. You can also complain to your local data protection authority (in Greece: the Hellenic Data Protection Authority, dpa.gr).

11. Transparency in how data is used

Skemly doesn’t show ads, doesn’t sell or rent personal data and doesn’t build advertising profiles of users.
The only exception: if you accept advertising cookies, the Meta Pixel on our website measures our own ads (see the Cookie Policy).

12. Age requirements

You must be at least 18 years old to create an account and use Skemly.

13. Cookies

See our Cookie Policy (skemly.link/cookies).

14. Changes

We’ll update this page and tell customers about important changes by email or in the app.