Privacy Policy

Effective date: September 27, 2026

1. Who We Are and Scope of This Policy

LeonAI Links (the "Service") is a URL shortening and link management platform operated by LeonAI LTD ("LeonAI," "we," "us," or "our"), registered at Avraham Pachornik 17, Ness Ziona, Israel, company registration number 516916954. The Service includes short link redirection, click analytics, QR codes, custom domains, webhooks, link-in-bio pages, team collaboration, and a developer API. It is delivered through our marketing site (leonai.io), our customer dashboard (links.leonai.io), our REST API (api.short.leonai.io), and our shared short-link domain (short.leonai.io), on which short links and QR codes resolve unless a customer uses their own custom domain.

This Policy describes how we process personal data relating to three distinct populations:

1. Site visitors — people who browse leonai.io without an account.
2. Account holders ("Customers") — people and organizations that register for the Service on the Free, Pro, Business, or Enterprise tier.
3. End users ("Link Visitors") — people who click a short link, scan a QR code, or visit a link-in-bio page created by a Customer. If you are a Link Visitor, the Customer who created the link determines why your click data is collected; Section 5 explains our role in that processing.

Questions about this Policy may be sent to care@leonai.io.

2. Personal Data We Collect

3. Purposes of Processing

We process personal data to: (a) provide, operate, and maintain the Service, including resolving short codes and performing redirects; (b) create and administer accounts, teams, and subscriptions; (c) process payments and manage billing through our payment provider, Sumit; (d) generate and display click analytics to the Customer who owns each link; (e) detect, prevent, and investigate fraud, spam, malware, phishing, and other abuse of short links; (f) monitor performance and errors and improve the Service; (g) send transactional messages (receipts, security alerts, quota notices) via Resend; (h) send marketing communications where permitted, with an unsubscribe option in every message; (i) comply with legal obligations, including tax, accounting, and lawful requests from authorities; and (j) establish, exercise, or defend legal claims.

4. Lawful Bases (GDPR)

Where the EU or UK General Data Protection Regulation applies, we rely on:

• Contract (Art. 6(1)(b)) — account creation, service delivery, billing, and support.
• Legitimate interests (Art. 6(1)(f)) — securing the Service and preventing abuse of short links (including scanning destination URLs for malware and phishing); enforcing tier quotas; improving reliability and performance; defending legal claims; and limited first-party marketing to existing Customers. Balancing note: these interests are weighed against your rights and reasonable expectations; we minimize data used (e.g., IP addresses are truncated/pseudonymized after coarse geolocation), and you may object at any time as described in Section 11.
• Consent (Art. 6(1)(a)) — non-essential cookies, and marketing communications where consent is required. Consent may be withdrawn at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records, consent logs, and responses to binding legal process.

5. Our Roles: Controller and Processor

Controller. LeonAI is the controller for personal data of site visitors and account holders, and for the limited processing of Link Visitor data needed for platform security, abuse prevention, rate limiting, and service operation.

Processor. For click and analytics data collected when a Link Visitor interacts with a Customer's short link, QR code, or link-in-bio page, LeonAI acts as a processor on behalf of the Customer, who is the controller. We process this data solely per the Customer's instructions as documented in our Data Processing Agreement (DPA), available at leonai.io/legal/dpa. We do not build cross-site advertising profiles from Link Visitor click data; click data is provided to the link's owner as aggregate and per-click analytics only. Link Visitors with questions about a specific link should contact the Customer who created it; we will assist Customers in responding to data subject requests as required by the DPA.

6. Cookies

We use cookies and similar technologies as described in our Cookie Policy (links.leonai.io/legal/cookies). In brief: the dashboard uses strictly necessary cookies for authentication; non-essential cookies are set only with consent; and redirect endpoints on the shared short-link domain set no non-essential cookies — click tracking on redirects is performed server-side without cookies.

7. Disclosures and Recipients

We disclose personal data only to: (a) subprocessors engaged to operate the Service (hosting, payments, email, geolocation, error monitoring) — see our current Subprocessors List at leonai.io/legal/subprocessors; (b) Customers, who receive analytics about their own links; (c) professional advisers (lawyers, accountants, auditors) under confidentiality obligations; (d) authorities, where required by law, subpoena, or other legal compulsion, after reviewing each request for validity and narrowing it where possible; and (e) a successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to apply. We do not sell personal data.

8. International Transfers

The Service is hosted on Cloudflare's global network: requests are handled at the Cloudflare data centre nearest you, and persistent storage is held in our primary region, Cloudflare's Eastern Europe (EEUR). If you are located in the EEA, United Kingdom, or Switzerland, your personal data may be transferred outside your region, including to the United States. We rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two (controller-to-processor) and Module Three (processor-to-processor) as applicable, supplemented by the UK International Data Transfer Addendum/IDTA and Swiss adaptations, together with supplementary technical measures (encryption in transit and at rest). Certain subprocessors also participate in the EU-U.S. Data Privacy Framework; see the Subprocessors List for transfer mechanisms per vendor.

9. Data Retention

When retention periods expire, data is deleted or irreversibly anonymized. Deleted data may persist in encrypted backups for up to 35 days before being purged.

10. Security

We maintain technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, secrets management via encrypted Cloudflare Workers secrets, role-based access controls, hashed API keys and passwords, audit logging of data exports and deletions, and error-report scrubbing in Sentry. Details are set out in our Data Security & Compliance page (links.leonai.io/legal/security). No system is perfectly secure; please report suspected vulnerabilities to care@leonai.io.

11. Your Rights (GDPR and Similar Laws)

If you are in the EEA, UK, or Switzerland (and in other jurisdictions with similar laws), you have the right to: access your personal data; rectify inaccurate data; erase data; restrict processing; data portability; object to processing based on legitimate interests (including direct marketing, which we will always honor); withdraw consent at any time; and lodge a complaint with your supervisory authority.

How to exercise your rights:

• Self-service export: authenticated Customers may download all of their data at GET /api/v1/users/me/export.
• Self-service deletion: account deletion is available in the dashboard under Settings; this performs a soft-delete followed by anonymization.
• Email: care@leonai.io. We respond within one month, extendable by two further months for complex requests (we will tell you if so). We may need to verify your identity before acting.

If you are a Link Visitor, we will forward your request to the relevant Customer (the controller) or assist them in fulfilling it.

12. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Policy.

Categories of personal information (per Cal. Civ. Code § 1798.140) collected in the preceding 12 months:

Your rights: to know what personal information we collect, use, and disclose; to delete; to correct; to opt out of sale or sharing; to limit use of sensitive personal information; and to non-discrimination — we will never deny service, charge different prices, or degrade features because you exercised your rights.

Do Not Sell or Share My Personal Information. LeonAI does not sell personal information for money and takes the position that it does not "share" personal information for cross-context behavioral advertising. Nevertheless, we provide "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links in our site footer, and we honor Global Privacy Control (GPC) signals automatically as a valid opt-out for the browser in which the signal is received.

Sensitive personal information is used only for purposes permitted under § 1798.121(a) (e.g., providing the Service, security, and integrity); we do not use or disclose it to infer characteristics about you.

Verification and authorized agents. We verify requests by matching information you provide against our records (e.g., a confirmation link to your account email); for higher-risk requests we may request additional verification. You may designate an authorized agent by providing signed written permission; we may still verify your identity directly.

Financial incentives. We do not offer financial-incentive programs in exchange for personal information.

Metrics. Statistics on consumer requests received, complied with, and denied in the preceding 12 months are available on request at care@leonai.io.

13. Other US State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. We honor universal opt-out mechanisms (including GPC) where required. To exercise these rights, or to appeal a decision on your request, contact care@leonai.io; appeals are reviewed by personnel not involved in the original decision.

14. Children

The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact care@leonai.io and we will delete it.

15. Automated Decision-Making

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. We use automated anomaly detection on click traffic to identify unusual spikes, bot activity, and potential abuse; flagged activity is reviewed and does not automatically result in account termination without human involvement.

16. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced by email to account holders and by prominent notice on leonai.io at least 14 days before taking effect. The "Effective date" above reflects the latest revision. Continued use of the Service after the effective date constitutes acceptance where permitted by law; where consent is required, we will seek it.

17. Contact and Representatives

• Controller: LeonAI LTD, Avraham Pachornik 17, Ness Ziona, Israel, registration number 516916954
• All privacy inquiries: care@leonai.io
• EU / UK representative (GDPR and UK GDPR Art. 27): none appointed. We rely on the exemption in Article 27(2)(a): our processing of EEA and UK personal data is occasional, does not include special categories of data or criminal-conviction data on a large scale, and is unlikely to result in a risk to the rights and freedoms of individuals. If that ceases to be true we will appoint representatives and name them here.

You have the right to lodge a complaint with a supervisory authority in your EU member state of residence or place of work, with the UK Information Commissioner's Office, or with the Swiss Federal Data Protection and Information Commissioner, as applicable. This Policy is governed by the laws of the State of Israel, without prejudice to mandatory data protection rights under your local law.