Privacy policy

1.Who we are

Scintilar (“we”, “us”) runs the website at scintilar.com and the link-page service on it. For the account and page data described below, we are the data controller. For the leads that visitors submit through your forms, you are the controller and we are your processor (see section 4).

You can reach a real person at trionapps@gmail.com for anything in this policy.

2.What we collect

When you have an account

• Sign-in details. You sign in with Google through Firebase Authentication. We receive and store your email address. We do not get your Google password.
• Plan and billing status. Whether you are on a trial, active, past due or cancelled, the dates involved, and the customer and subscription identifiers from our payment provider. Card details go straight to Dodo Payments; we never see them.
• Your page. Everything you add: your handle, title, bio, avatar, links, menus and price lists, hours, forms, social links, theme and settings.
• Support messages. If you email us, we keep the conversation so we can help you.

When someone visits a link page

• Simple counts. We count page views, taps on each block, QR scans, and the website the visit came from (for example, “instagram.com”). These are totals per day. They are not tied to a named person.
• Short-lived technical records. To stop abuse such as form spam, we use a hashed (scrambled, one-way) form of the visitor’s IP address to rate-limit submissions. We do not use it to identify or profile anyone.

When you use the importer or AI helper

• Importer. You give us the address of your current link-in-bio page. We fetch that public page to build a preview. A preview is not published, and nothing is added to your account unless you save it.
• AI draft. If you ask for a drafted page, the text you give the helper is sent to an AI provider (Google) to generate suggestions. Do not put anything private in it.

3.What is public

Your link page is public by design. When it is published, anyone with the address, or who scans your QR code, can see your name, bio, links, prices, hours and anything else you put on it. Search engines may index it. Do not put on a page anything you want to keep private. Unpublish it or ask us to delete it and it stops being served, though copies held by search engines or caches may take a while to disappear.

4.Leads from your forms

Contact forms and email sign-ups on your page collect whatever the visitor types in: for example a name, email address, phone number and message. These entries go into your dashboard inbox.

• Lead data belongs to you. You decide what to do with it, and you are responsible for using it lawfully.
• We store it only to deliver it to you, and we do not read it for any other purpose, market to it or sell it.
• If privacy law applies to you, you are the controller of this data and we are your processor. You should tell your visitors how you will use what they send. Do not use these forms to collect sensitive information such as health details, and do not ask for more than you need.
• You can delete leads at any time. Deleting your account deletes them too.

Shop orders. When a customer orders from a shop on a page, we store what they send so the shop can fulfil it: their name, email or phone, the items and amounts, the delivery choice and address if one is needed, a note, and the order’s payment and status history. The same rules as leads apply: order data belongs to the shop, which is the seller and the controller; we process it for the shop, email the customer their receipt and updates on the shop’s behalf, and never market to it. Customers can ask the shop to correct or delete their details. Card payments are made on Stripe’s own page under the shop’s Stripe account: we never see or store card numbers. Stripe tells us only that a payment for the order succeeded, its amount and its reference.

5.Cookies and analytics

• Signed-in owners get one essential cookie that keeps them signed in. Firebase Authentication may also keep sign-in tokens in your browser’s local storage. Without these you could not use your dashboard.
• Visitors to link pages and to this marketing site are not tracked with advertising or cross-site cookies. Link pages only get the simple first-party counts described in section 2. On this marketing site, the sign-up flow and the owner dashboard we also use Google Analytics in cookieless mode (no analytics or advertising cookies are set) to count visits and which steps people complete.
• Links on a page can lead to other sites, which have their own cookies and policies. Embedded players (such as YouTube or Spotify) load from those services and may set their own cookies once you press play.

6.Why we use it

We use your information to:

• provide the service: host your page, run the editor, deliver your leads and show your counts (to perform our contract with you);
• take payment, manage your trial and subscription, and keep the records tax law requires (contract and legal obligation);
• keep the service safe: prevent spam, phishing and abuse, and investigate reports (our legitimate interest in a trustworthy service);
• answer your emails and fix problems (contract and legitimate interest);
• meet legal requirements and defend legal claims.

We do not sell your data, and we do not use it for advertising.

7.Who we share it with

Only the providers that help us run the service, and only what they need:

• Dodo Payments, our payment provider and merchant of record. It collects your payment details, calculates and collects tax, and sends receipts. It is a controller of the payment data it collects, under its own privacy policy.
• Stripe, only for shops whose owner connected their own Stripe account: the order reference, items and total are sent to that owner’s Stripe so the customer can pay. Stripe is a controller of the payment data it collects.
• Resend, which delivers order emails and receipts for us.
• Google, for Firebase Authentication (sign-in) and, if you use it, the AI draft helper.
• Our hosting and storage providers (we run on Vercel and its storage), which store and serve the data described above on our behalf.
• Authorities and advisers, where the law requires it or to protect our rights, for example if an abusive page is reported.

8.How long we keep it

We keep your account, page and leads while your account exists. If your subscription ends, we keep your page saved so you can come back; it simply stops being public. If you ask us to delete your account, we delete your account record, page, leads and counts within 30 days. Payment records are held by Dodo Payments for as long as tax and accounting law requires. Support emails are kept for as long as they are useful to resolve your issue.

9.Your rights

Depending on where you live (including under the GDPR and UK GDPR), you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; move it to another service; or stop any processing that rests on your consent. We will honour these requests for everyone, wherever you live.

Email trionapps@gmail.com and we will reply within one month. You also have the right to complain to your local data protection authority.

If you are a visitor who sent a message through someone’s page, the page owner decides what happens to it, so contact them first. If you cannot, write to us and we will pass it on.

10.International transfers

Our providers may process data in countries other than your own, including the United States. Where the law requires it, we rely on safeguards such as the standard contractual clauses approved by regulators.

11.Children

Scintilar is for businesses and adults. It is not directed at children under 16, and we do not knowingly collect their information. If you think a child has given us data, email us and we will delete it.

12.Security

Traffic is encrypted in transit, sign-in uses Google’s identity service, and sessions use signed, expiring cookies. We store only what we need. No system is perfectly secure, and if a breach affecting you occurs we will tell you as the law requires.

13.Changes and contact

If we change this policy in a way that matters, we will update the date at the top and, for significant changes, email account holders. Our terms explain the rules for using the service. Questions go to trionapps@gmail.com.