LenKore account privacy policy.

1. Who is responsible

GO TO AGENCY (GTA), a French simplified joint-stock company (SAS) with a share capital of €1,000, RCS Dijon 944 980 762, 9 rue Jean-Jacques Rousseau, 21000 Dijon, France. For any question about your data: contact@lenkli.com.

2. What we keep

• your name and email address;
• a hash of your password (never the password itself);
• if you use it: your Google, Apple, Microsoft or GitHub account (its identifier, and the photo it provides);
• two-factor authentication: its secret, encrypted, and a hash of your backup codes;
• your sessions and your sign-in log: the date, the method, your browser in short, the tool, and a hash of your IP address (never the address in clear);
• the accounts of your tools linked to your LenKore account;
• if you invite someone to your team: their email address, their role and their tools; and your verified domains;
• your subscriptions: the plan, the dates, the identifiers at Stripe, our payment provider; never your card number, which only Stripe knows;
• what you accept when you sign up and when you buy (terms, ticked boxes), with the version of the text and the date;
• your choice for our news and offers emails;
• the version of our offers you saw when we test two (for example the trial with or without a card);
• a hash of your email address and the tool you tried, for the free trial (section 7).

3. Why, and on what legal basis

• Creating and running your account, signing you in to your tools, linking your tools together, search across your tools, your team and your domains: the contract between us, that is the LenKore account terms (GDPR, article 6.1.b).
• Security (two-factor authentication, sign-in log, limits against password guessing, one free trial per tool): our legitimate interest in protecting your account and our services (article 6.1.f).
• Your subscriptions, your invoices and declined payments: the contract, and our accounting obligations (articles 6.1.b and 6.1.c).
• Testing our offers (for example the trial with or without a card), measured in Datalenk, our own tool, with a pseudonymous identifier and without your address: our legitimate interest in improving our offers. You can object by writing to us.
• Our news and offers by email: only if you ticked the box when signing up (article 6.1.a). You unsubscribe whenever you like, from My account or with the link in each email.
• The move to the LenKore account: we linked to your account the accounts of our tools opened with the same verified address, and kept the hash of your old password so you can sign in as before: our legitimate interest in keeping simple access to your tools for you (same company, same purpose).

4. Links between your tools

When you use several tools with the same account, they link up automatically: for example, your Calenkli bookings and the clicks on your Lenkli links count in your Datalenk sales. This data does not leave your account and only serves you; you can turn off each link in the tool’s settings. For your own customers’ data, the data processing agreement applies.

5. Who receives it

• the LenKore tools you open (published by the same company): your name, email address and account identifier, to sign you in;
• the people you invite to your team: your name and email address;
• our providers, who act on our behalf: Hetzner Online GmbH (hosting, European Union); Amazon Web Services (sending emails); Stripe (subscription payments; Stripe is also responsible for its own fraud checks and legal obligations). The full list: subprocessors;
• Google, Apple, Microsoft or GitHub, only if you sign in with them: they then know you are signing in to LenKore;
• an AI assistant (Anthropic’s Claude, OpenAI’s ChatGPT), only if you connect it yourself: what it reads in your tools is sent to it, and it processes it under its own terms, sometimes outside the European Union;
• authorities, only if the law requires it.

We never sell your data.

6. Outside the European Union

Your data is stored in the European Union. Some providers are companies based in the United States (Stripe, Amazon Web Services, and Cloudflare for the lenkore.com website): transfers are covered by the EU-U.S. adequacy decision of 10 July 2023 for certified companies, otherwise by the European Commission’s standard contractual clauses. A copy of these safeguards on request.

7. How long

• Your account: as long as it exists. An account that is no longer used is deleted after 2 years without a sign-in; we email you a month before.
• After you delete your account: your identity, sessions, sign-in log and account settings are deleted right away. Each tool’s data is managed by the tool (see its policy).
• The sign-in log: 12 months. Sessions: 7 days without activity, 30 days at most.
• Team invitations nobody accepted: deleted 30 days after they expired or were cancelled.
• Old password hashes taken over from Lenkli, Calenkli or Datalenk when moving to the LenKore account: deleted at your first sign-in, and at the latest 30 days after they were taken over.
• Your subscriptions and what you accepted when buying: for the life of the subscription, then the legal limitation period; invoices: 10 years, at Stripe (accounting obligation).
• The version of our offers you saw, and our test measurements: 25 months, then deleted.
• Our payment provider’s technical messages and our billing email queue: 90 days.
• So that the same free trial cannot be taken several times, we keep a hash of your email address (a code computed from it, which does not show it in clear) and the name of the tool you tried, for 3 years after the end of your trial, even if you delete your account. It is used for nothing else, then deleted. Legal basis: our legitimate interest in preventing abuse of the free trial.

8. Account and website cookies

The LenKore account only sets necessary cookies: your sign-in session (7 days without activity, 30 at most), the two-factor challenge (10 minutes), the verification of your address after signing up (24 hours; it contains your email address, signed), the time of a sign-in with Google, Apple, Microsoft or GitHub (a few minutes), and your language (kore-lang, 1 year). They do not need your consent. No analytics or advertising cookies.

The lenkore.com website sets no analytics or advertising cookies; it only remembers your choices (language, currency, country for prices), described in the legal notice. It goes through Cloudflare’s network, which sees your IP address to deliver the pages. The Sendlenk and Affilenk waitlist has its own page.

9. Your rights

You can ask to see your data, correct it, delete it, restrict its use, receive it in a reusable format (portability), and object to its use (at any time for marketing); you can withdraw your consent at any time. You make many of these requests yourself in My account: change your name or address, close your sessions, delete your account.

For the rest, write to contact@lenkli.com: we answer within a month at most.

You can also give us instructions on what happens to your data after your death (keeping, deleting, passing on): write to contact@lenkli.com.

You can also contact the CNIL, the French data protection authority (cnil.fr).

10. Data received from Google

If you sign in with Google, we receive your name, email address, photo and Google account identifier. We only use them to sign you in, in line with the Google API Services User Data Policy, including its Limited Use requirements. We never sell them and never use them for advertising.

11. Changes

We email you before any significant change to this policy.