Legal # Privacy Policy Last updated October 18, 2026 This Privacy Policy explains what personal data Link in Seconds collects, why, who we share it with, how long we keep it, and the choices and rights you have. Every statement here describes how the product actually works today. If something is unclear, write to [support@linkinseconds.com](mailto:support@linkinseconds.com). This document is also the notice required under Section 5 of the Digital Personal Data Protection Act, 2023 (India). Together with our [Terms](https://linkinseconds.com/terms), [Acceptable Use Policy](https://linkinseconds.com/acceptable-use) and [Cookie Policy](https://linkinseconds.com/cookies), it forms the privacy policy published under Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. ## Who runs Link in Seconds Link in Seconds (linkinseconds.com, and lisview.com where shared links open) is operated by Radadiya Sunny Keshavbhai (Sole Proprietorship), GSTIN 24CADPR8542K2ZA, principal place of business 33, Bhaktinandan, Sector 4, S G Road, Mota Varachha, Surat, Gujarat 394101, India. For data-protection purposes Radadiya Sunny Keshavbhai is the data fiduciary (DPDP Act) and the data controller (GDPR and UK GDPR). We are established in India and process the data of visitors in the EEA and UK under Article 3(2) of the GDPR / UK GDPR. Contact: [support@linkinseconds.com](mailto:support@linkinseconds.com) · [+91 99090 97776](tel:+919909097776). Our full legal identity, Grievance Officer and the single point of contact for authorities are listed on the [Legal Notice](https://linkinseconds.com/legal-notice) page. ## What we collect: account holders If you sign in and create links, we hold the following about you. - From Google sign-in: your email address, display name and avatar URL. We use the email to create and authenticate your account and to send account email. We never see your Google password. - On your profile: the country you signed up from (derived from your connection at our edge network, not from GPS), first-touch marketing attribution (the utm parameters, Google click id, referrer and landing page of your first visit), your email opt-out flag, any ban flag and reason, your branding settings and tags. If you did not allow advertising cookies, we keep only the referring site's domain, the campaign tags (utm source, medium and campaign) and the landing page of the visit in which you created your account, with no cookies, click ids or other identifiers. - For abuse prevention: a keyed hash of the IP address in use at the time of a moderation decision on your content. We do not store the raw address. - Your files and links: the files you upload and the links, albums and sites you create from them, with their titles, slugs, settings (password, expiry, view limit, email gate, custom domain and so on), view counts and version history. - API keys: if you create one, its name, a short prefix and a one-way hash of the key (never the key itself), when it was created and when it was last used. Files published with a key are handled like any other upload. - Connected apps: if you connect an app (for example ChatGPT or another AI assistant) by signing in and pressing Allow, we keep the app's name, the address it sends you back to, when you connected it, when it last made a request, and how many requests and uploads it made. We store only one-way hashes of the access tokens we give the app. - Billing: your subscription or purchase status as reported to us by Dodo Payments, our merchant of record. Dodo holds the card details, invoices and tax records; we never see or store a full card number. - Things you type into the product: email addresses you enter when you share a link by email (used only to send that email), and the name, email, company and phone number you give us on the contact-sales form. ## Connected apps You can let an app such as ChatGPT use your account. You start this in the app, sign in here and press Allow on a screen that names the app and shows the address it sends you back to. A connected app can upload files and create links on your account, and read your links and their view statistics. It cannot see your email address or password, delete links, or change your plan or billing, and your plan's limits apply to everything it does. What you ask the app to do, and the files or text you give it, are also handled by that app's provider under its own privacy policy. Disconnect an app at any time on the [API keys](https://linkinseconds.com/dashboard/api-keys) page of your dashboard: it loses access immediately. Deleting your account removes every connection. ## What we collect: visitors of public pages When anyone opens a public file page (lisview.com/…, or an older linkinseconds.com/p/… link), album (lisview.com/b/…) or hosted site, we record a view. A view consists of a keyed (HMAC) hash of the visitor's IP address, the country and city derived from it, the browser user agent, the referrer, and a per-link view-session cookie so view limits and repeat views work. The raw IP is never stored. The link owner sees these as aggregates per viewer (for example “3 views from Berlin, Chrome”), never your address. - Engagement on the page. While a public page is open we also record how long the file stayed open and visible, which pages of a document or how much of a video or audio file was viewed, how far you scrolled, how many times you clicked or zoomed, whether you went fullscreen, downloaded the file, copied or shared the link, your screen size, browser and operating system, and the address of the page that linked here (without its query string). These are grouped under a random per-page-load id that lives only in the page's memory and is not stored in a cookie. They are kept for 24 months together with the view log. The link owner sees them both as totals and as one row per open (for example “Berlin, Chrome on Windows, 2 minutes, reached page 4”) and can export those rows as a CSV file. They never include your name, email or IP address. - Email gate. Some links ask for your email address before they open. That address is stored and shown to the link owner, who can export it as a CSV file. The owner decides how to use it and is responsible for that use under their own privacy obligations (see our [Terms](https://linkinseconds.com/terms)). We do not use gate emails for our own marketing. - Comments. If you comment on a link we store the name you give, the comment text and a keyed hash of your IP (abuse prevention). - Reports. If you use the Report button we store the reason, any details you add, a hashed IP and your user agent. See [Report Abuse](https://linkinseconds.com/abuse). - Password and bot checks. Password-protected links set a short-lived unlock cookie once you enter the right password. The password form and the report form may show a Cloudflare Turnstile check to stop bots. ## What we collect: recipients If a user shares a link with you by email, we receive your address from that user and use it once, to send that email. If you later open the link you become a visitor (above). We do not add recipients to any mailing list. ## Why we process data, and the legal bases Under the DPDP Act our basis is your consent for a stated purpose (Section 6) or a legitimate use (Section 7). Under the GDPR / UK GDPR the bases are in Article 6. In practice: - Running the service you asked for (account, storing and serving your files, billing status, view counts, sharing by email, notifications you turn on): performance of a contract. - Safety, fraud and abuse prevention (content scanning, hashed IPs, reports, bans, the bot check): our legitimate interest in running a safe and lawful service, and compliance with the IT Rules, 2021. - Non-essential cookies and tracking (analytics, session replay, advertising measurement): your consent where consent is required. - Product email (onboarding, tips, digests, offers): our legitimate interest in telling existing users about the product, with an unsubscribe link in every message. - Tax records, legal requests and reports to authorities: compliance with a legal obligation. Consent given for one purpose is not reused for another. You can withdraw consent at any time, and withdrawing it is as easy as giving it. ## Automated content safety (please read) To keep the service lawful, uploads are scanned at upload time and may be scanned again later by scheduled jobs: a backlog scan runs every few minutes, and live HTML and PDF content is periodically re-checked. This means the content of an upload can be sent to our content-safety providers after you uploaded it, not only at the moment of upload. The providers are: - OpenAI (moderation API): extracted text and images. - Google Cloud Vision: image bytes and sampled video frames, for SafeSearch scoring and OCR (reading text and links out of a picture). - Google Web Risk: only the URLs found in an upload (in documents, HTML, QR codes or OCR text), checked against malware and phishing lists. - TypeSafe “Jev” via OpenRouter: when enabled, up to 8,000 characters of text extracted from an upload, for a phishing and scam text classification. - abuse.ch (MalwareBazaar and URLhaus): only the SHA-256 hash of the file, never the file itself, to check for known malware, and the host names of links found in an upload, to check for malware sites. VirusTotal receives the hash instead only if abuse.ch is unavailable. - Our malware scanner (ClamAV): the file itself is scanned for malware on our own server, hosted by Railway; it is not kept after the scan. - urlscan.io: the public address of a newly published HTML page, which it visits once as an unlisted scan for a phishing check. Unlisted scans can be seen by urlscan.io's paying security customers. Enforce mode is on: an upload our systems flag is held for human review or blocked and is not served until a person has looked at it. Scanning is best effort, not a warranty that all content is lawful, and we do not pre-approve or exercise editorial control over uploads. We never train AI on your files. We do not use uploads to train, fine-tune or improve any model. OpenAI and Google are contractually barred from using API inputs to train their models. To our knowledge the same applies to OpenRouter and TypeSafe for the Jev classifier. ## Who we share data with (sub-processors) We do not sell personal data. We share it only with the providers below, each for the role shown. Most are in the United States; see International transfers. | Provider | Role | What it receives | | Supabase | Database and authentication (US or EU region) | Account, profile, link metadata, view logs, sessions | | Cloudflare R2 | File storage (private bucket) | The bytes of your uploads | | Vercel | Hosting, edge network, country lookup, custom domains | All request traffic, including IP for the country lookup | | Google | OAuth sign-in; Cloud Vision; Web Risk; Google Analytics 4; Google Ads measurement | Sign-in identity; images and video frames; URLs; analytics and conversion events (after consent where required) | | OpenAI | Content moderation API | Extracted text and images from uploads | | OpenRouter / TypeSafe (Jev) | Phishing text classifier (when enabled) | Up to 8,000 characters of extracted text | | abuse.ch (MalwareBazaar, URLhaus), Switzerland | Known-malware and malware-site lookups | SHA-256 hash of the file; host names of links in an upload | | VirusTotal | Known-malware lookup (fallback only) | SHA-256 hash of the file only | | Railway | Hosts our ClamAV malware scanner (Singapore) | The bytes of an upload, only for the scan | | urlscan.io, Germany | Phishing check of new HTML pages | The public address of the page, visited once (unlisted scan) | | Microsoft Clarity | Session replay and heatmaps | Page interactions, only after you allow analytics cookies, never on public viewer pages | | PostHog (US cloud) | Product analytics (no session replay) | Product events; cookieless until you consent | | Cloudflare Turnstile | Bot check on password gates and the report form | Browser signals and IP for the challenge | | Resend | Email delivery | Recipient address and email content | | Dodo Payments | Merchant of record for all payments | Billing identity, card data, tax, invoices, refunds | | Telegram / internal webhook | Operator alerts | Abuse-report summaries (link slug, reason, reporter text) and contact-sales form fields | We may also disclose data where required by law, a court order, or a lawful request from an authorised government agency (see Legal requests). ## Cookies and similar storage The full inventory, with lifetimes and purposes, is on our [Cookie Policy](https://linkinseconds.com/cookies) page. In summary: | Name | Type | Lifetime | Purpose | | sb-* | Essential | Session | Keeps you signed in (Supabase auth) | | lis_country | Essential | 7 days | Your region, for pricing and the consent rules that apply to you | | lis_claim | Essential (httpOnly) | Session | Claims links you made before signing in | | Per-link unlock cookie | Essential | 6 hours | Remembers that you entered a link's password | | Per-link view-session cookie | Essential | Session | View limits and repeat-view counting | | lis_signup | Analytics | 24 hours | Bridges the sign-up event to analytics once | | lis_aid, lis_ses | Analytics | Persistent / session | First-party analytics id (only with analytics consent in consent-required regions) | | lis_ft, lis_first_touch | Marketing | 180 days / local storage | First-touch attribution (only with advertising consent in consent-required regions) | | _ga, _ga_* | Analytics | Up to 2 years | Google Analytics 4 (after consent in consent-required regions) | | _clck, _clsk | Analytics | 1 year / session | Microsoft Clarity (after consent) | | ph_* | Analytics | 1 year | PostHog (after consent) | | lis_consent | Essential (local storage) | Persistent | Your cookie choice | ## Consent and how to change it We use Google Consent Mode v2. In the EEA, UK and Switzerland every non-essential cookie and script stays off until you accept. Elsewhere analytics runs by default and you can turn it off. Session replay (Microsoft Clarity) needs an explicit opt-in everywhere and never runs on public viewer pages. You can change your choice at any time through “Cookie settings” linked in the footer or on the [Cookie Policy](https://linkinseconds.com/cookies) page. We honour the Global Privacy Control browser signal as a “no advertising” choice. ## Emails we send - Always: receipts, and account or security notices (for example a moderation decision on your link, a sign-in problem, or a change to these policies). - Product email: onboarding, tips, usage digests (“your links got X views”), re-engagement and offers. Every one carries an unsubscribe link, and you can turn them off at [/dashboard/account](https://linkinseconds.com/dashboard/account). - Notifications you configured: new views or comments on a link, if you switched them on. - The founder may occasionally email an individual user about their account. The same unsubscribe applies to anything that is not a receipt or security notice. Email is delivered through Resend. We keep a log of what we sent for 24 months. ## How long we keep data (retention) - Files and links: until you delete them or delete your account. Deleting a link removes the file from storage. Free links (up to 50 live at a time) and Pro links do not expire on a timer. - View logs, abuse reports and email logs: 24 months. - First-party analytics events: 90 days. - Moderation evidence for blocked content: retained as required by law, and removed content plus the uploader's registration information for 180 days under Rule 3(1)(g) of the IT Rules, 2021. - Account deletion: self-serve at [/dashboard/account](https://linkinseconds.com/dashboard/account) and completes immediately. We keep a minimal tombstone (a hashed form of your email and the deletion date) for 180 days so a banned account cannot simply return. - Financial and tax records: held by Dodo Payments for as long as tax law requires. These periods are enforced by a scheduled clean-up job. Under Section 8(7) of the DPDP Act we erase personal data once its purpose is served unless the law requires us to keep it. ## Your rights, by region Everyone: you can export your data as JSON and delete your account yourself at [/dashboard/account](https://linkinseconds.com/dashboard/account), or email [support@linkinseconds.com](mailto:support@linkinseconds.com) from the address on your account. We answer rights requests within 30 days and may ask you to confirm your identity first. - EEA and UK (GDPR / UK GDPR): access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent, plus the right to complain to your supervisory authority (your national DPA, or the UK ICO). - India (DPDP Act, 2023): access to a summary of your data (Section 11), correction and erasure (Section 12), grievance redressal (Section 13) and the right to nominate someone to act for you (Section 14). You may complain to the Data Protection Board of India after raising the matter with our [Grievance Officer](https://linkinseconds.com/grievance). - California (CCPA / CPRA): the right to know, delete and correct, and to opt out of the “sale” or “sharing” of personal information. We do not sell personal information. Advertising measurement cookies can count as “sharing”; you can opt out via Cookie settings or by sending the Global Privacy Control signal, which we honour. We do not discriminate against you for exercising these rights. ## Children You must be at least 18 years old to create an account or upload content. The service is not directed to anyone under 18, and, consistent with COPPA in the United States, not to children under 13. We do not knowingly collect a child's personal data, and under India's DPDP Act we do not knowingly process it. If you tell us we hold data about a child, we will delete it. ## Security, and what encryption we actually use - Everything moves over TLS. Files are encrypted at rest by our storage providers. - Files live in a private bucket and are served only through our own proxy or short-lived signed URLs. There are no public raw storage URLs. - Visitor IPs are stored only as keyed hashes. Stored files are not end-to-end encrypted. We, and the content-safety providers above, can technically read file content. Public links are public: anyone with the URL can open one. Do not upload sensitive information to a public link. To report a vulnerability, see our [security page](https://linkinseconds.com/security) or email [support@linkinseconds.com](mailto:support@linkinseconds.com?subject=Security) with the subject “Security”. ## Data breach notification If a personal-data breach occurs we will notify the affected users and the relevant authorities within the legal deadlines: the supervisory authority within 72 hours under the GDPR / UK GDPR, CERT-In within 6 hours for reportable cyber incidents under its 2022 directions, and the Data Protection Board of India and affected Data Principals as the DPDP Act and its rules require. If you think your data may have been affected, contact [support@linkinseconds.com](mailto:support@linkinseconds.com). ## International transfers Your data is processed in the United States and the European Union by the providers named above, and for content-safety checks also in Switzerland (abuse.ch) and Singapore (our ClamAV scanner on Railway). Where the GDPR / UK GDPR applies, transfers rest on the European Commission's Standard Contractual Clauses (and the UK Addendum) in each provider's data-processing terms, or on the provider's EU-US Data Privacy Framework certification where it holds one. Under Section 16 of the DPDP Act, personal data may be transferred outside India except to countries the Central Government restricts; none has been notified as of this policy's date. ## Legal requests On a lawful order we provide information to an authorised government agency within 72 hours under Rule 3(1)(j) of the IT Rules, 2021, and remove content within the timelines on our [Grievance Redressal](https://linkinseconds.com/grievance) page. Copyright complaints go through our [copyright channel](https://linkinseconds.com/dmca), and child-safety matters through our [Child Safety Policy](https://linkinseconds.com/child-safety). We preserve evidence of apparent child sexual abuse material and report it to the authorities, and to NCMEC where we are able. ## Changes to this policy When we change this policy we update the date at the top. For significant changes we email account holders before the change takes effect. ## Grievance Officer and contact Grievance Officer: Radadiya Sunny Keshavbhai · [support@linkinseconds.com](mailto:support@linkinseconds.com) · [+91 99090 97776](tel:+919909097776) · 33, Bhaktinandan, Sector 4, S G Road, Mota Varachha, Surat, Gujarat 394101, India. We acknowledge complaints within 24 hours and resolve them within 15 days (7 days where the 2026 amendment to the IT Rules applies). The full procedure is on our [Grievance Redressal](https://linkinseconds.com/grievance) page; our complete legal identity is on the [Legal Notice](https://linkinseconds.com/legal-notice) page. Source: https://linkinseconds.com/privacy