Privacy Policy

Preme links (for example preme-links.com/r/example) forward you instantly to their destination page. When you click one, we record:

• The date and time of the click
• The country, and the approximate city or region, your click came from
• Your device type, browser, and operating system
• The page that referred you, where your browser provides it

We do not store your IP address, and we record no location more precise than the city Cloudflare reports for the request — never a street, address, or GPS position.

To count unique visitors, we store a one-way hashed identifier derived from your IP address and browser. This hash cannot be reversed to reveal your IP address or identify you, and it is not shared with or matched against any other service.

No cookies are set when you click a tracked link. The redirect places nothing on your device. (The Preme dashboard itself, at our own website, does store a sign-in session in your browser once you log in — that is strictly necessary to keep you signed in, and it is never used for tracking or advertising.)

If the link you clicked is password protected, the password you type is checked against a hashed value and is not stored. Nothing extra about you is recorded.

Automated visits, such as bots, crawlers, and the link previews generated by messaging apps and social platforms, are excluded from click statistics.

Why we process this: click statistics tell the business that created the link how its links are performing. We rely on legitimate interest as the legal basis for this processing. The data is minimised by design: no IP addresses are kept, no advertising or tracking pixels are used, and no data is sold or shared with third parties for marketing.

If you create an account, we store:

• Your email address and password (passwords are stored in hashed form by our authentication provider, never as plain text). If you sign in with Google, we receive your email address and name from Google instead of a password.
• Your display name
• The businesses, links, and settings you create
• Any images you upload for link previews

Why we process this: to provide the service you signed up for. The legal basis is the performance of a contract with you.

We send you account emails, such as sign-in confirmation, password resets and email change confirmations. We also send the notifications you switch on yourself: the Monday weekly summary of your links (on by default, with a one-click opt-out on each business), click milestone alerts you create, and alerts when a link or a webhook you set up starts failing. Preme does not send marketing email.

To keep the service usable and to stop abuse, we also record when your account was created, whether your email is confirmed, and how many links or imports you have created recently, so that new accounts can be held to a daily limit. The legal basis is our legitimate interest in preventing spam and malicious links.

A business owner can invite other people to help manage a business. To do this we store the email address the owner typed in, the role they chose (editor or viewer), whether the invitation is still pending or has been accepted, and who sent it.

An invited email address is visible to the owner and to the other members of that same business. If you are invited, the owner will know you accepted, and the other members of that business will see your email address in the members list.

Members only ever get access to the single business they were invited to. They can see that business's links, bio pages, and click statistics, which are aggregated visitor counts rather than information about identifiable people. They cannot see any other business, and they cannot see anything about the owner's account beyond the business they share. Editors can create and change links, bio pages, and click data for that business. Viewers can only look. Only the owner can invite or remove people, change roles, or delete the business.

An invitation can be withdrawn by the owner at any time, and removing a member ends their access immediately. If you were invited and want the invitation record removed, ask the business owner to remove you, or email hello@preme-links.com.

Why we process this: to provide the sharing feature the business owner asked for. The legal basis is the performance of a contract with the account holder, and legitimate interest in letting a business delegate work on its own links.

Before a link is created, edited or imported, the destination address is checked against Google Safe Browsing so that Preme cannot be used to spread malware, phishing or scam pages. The destination URL is sent to Google for that check. No information about you, and nothing about anyone who later clicks the link, is included.

Why we process this: legitimate interest in keeping the service, and the people who click Preme links, safe.

A business owner can add a webhook, which sends a signed message to a web address of their choosing when something happens on their links — for example a click milestone being reached, or a link going down. Preme never sends raw click records this way: the message contains the link, the business, the event and aggregate counts.

When you switch a webhook on, you are choosing to send that information to a system you control, and you become responsible for it once it arrives there. We keep a delivery history, including the payload we sent and the response we received, so that you can debug failures. Preme does not otherwise sell or share data with third parties for marketing.

A business owner can create a shareable report link. Anyone holding that link can view the report without signing in. Shared reports contain aggregated click statistics — totals, dates, countries and cities, devices — and never a list of identifiable people. The owner can revoke a shared link at any time, which stops it working immediately.

Our report form asks for the link, a reason, and an optional note. We do not ask for your name or email address, so reports are anonymous unless you choose to put contact details in the note. We keep the report, and the reported link's address and destination, so that we can review it and switch the link off if it breaks our rules.

Why we process this: legitimate interest in investigating abuse of the service.

Preme is free during the current testing period. When paid plans begin, card payments are handled by Stripe, which acts as an independent controller for payment data. Your card details are entered on Stripe's own checkout and never reach Preme's servers. We store only what we need to know which plan you are on: a Stripe customer and subscription reference, your plan, and its renewal or expiry date.

Why we process this: performance of a contract with you, and our legal obligation to keep billing records.

Preme runs on cloud infrastructure provided by our hosting platform. Your account data, links, click statistics, and uploaded images are stored in a managed PostgreSQL database and object storage operated by Supabase on our behalf as a processor, provisioned through Lovable Cloud. The app itself, including the link redirect, is served from Cloudflare's edge network, which is also where the country and approximate city of a click are derived from, without us storing an IP address.

We also rely on these providers:

• Our hosting platform's managed email service, to deliver account emails and the notifications you switch on.
• Google Safe Browsing, to screen link destinations for malware and phishing.
• Stripe, to take payments when paid plans begin.
• Google, if you choose to sign in with a Google account.

Some of these providers operate outside the European Economic Area. Where that is the case, transfers are covered by the European Commission's standard contractual clauses or another safeguard permitted by the GDPR.

Uploaded preview images are stored so they can be displayed publicly when a link is shared.

Click statistics are kept until the account holder that owns the link deletes the link's data or their account. Account data is kept for as long as the account exists. When an account is deleted, its businesses, links, click data, and uploaded images are deleted with it.

You can download a copy of your account data, or delete your account and everything in it, from your account settings at any time.

Under the GDPR you have the right to access, correct, delete, or restrict the processing of your personal data, the right to data portability, and the right to object to processing based on legitimate interest. To exercise any of these rights, email hello@preme-links.com.

You also have the right to lodge a complaint with the Data Protection Commission (dataprotection.ie), Ireland's supervisory authority.

Because clicks are recorded without storing your IP address, we may not be able to identify which click records relate to you. Where that is the case, the GDPR's rules on data that does not require identification apply, and we will tell you if we cannot match your request to any data we hold.

If we change how Preme handles personal data, we will update this page and change the date below.