Privacy Policy

Effective Date: December 17, 2025 Last Updated: January 14, 2026

1. Introduction

Welcome to vitelnk ("we", "our", or "us"). We are committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our video sharing platform at vitelnk.com (the "Service").

This policy complies with:

General Data Protection Regulation (GDPR) - EU Regulation 2016/679
Portuguese Data Protection Law - Lei n.º 58/2019
ePrivacy Directive - Directive 2002/58/EC

By using vitelnk, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

Legal Disclaimer: This Privacy Policy is provided for informational purposes and does not constitute legal advice. For specific legal questions, consult a qualified Portuguese attorney.

2. Data Controller

The data controller responsible for your personal data is:

Edmilson Jorge Delgado Gomes Individual Freelancer (Trabalhador Independente) NIF (Tax Identification Number): 251423832 Location: Portugal Email: [email protected]

As a small business operated by an individual freelancer, we are not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. However, you can contact us at the email addresses above for any data protection questions.

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Account Information

When you register for an account, we collect:

Name - Your full name for identification
Email Address - Used for authentication, account recovery, and communications
Password - Securely hashed using bcrypt encryption (we never store plain-text passwords)
Google ID - If you register via Google OAuth (optional)
Avatar/Profile Picture - If you upload one or connect via Google OAuth
Email Verification Status - Whether your email has been verified
Account Creation Date - Timestamp of when you registered

3.2 Subscription & Billing Information

We collect subscription-related data to manage your account:

Subscription Plan - Starter, Professional, or Trial
Subscription Status - Active, trialing, canceled, expired
Trial Start/End Dates - To track your 7-day free trial period
Storage Usage - Total bytes of video storage used (to enforce plan limits)
Polar Customer ID - Reference ID from our payment processor (Polar.sh)
Subscription History - Plan changes, upgrades, cancellations

We do NOT store credit card information. All payment processing is handled securely by Polar.sh (see Section 5).

3.3 Video Content & Metadata

When you upload and manage videos, we collect:

Video Files - The actual video files you upload
Video Metadata - Title, description, duration, resolution, file size
Thumbnails & GIFs - Auto-generated or custom-uploaded preview images
Folder Assignments - How you organize your videos
Share Link Settings - Password protection, expiry dates, download settings
Call-to-Action (CTA) Data - Buttons, links, and text you configure
Lead Capture Forms - Custom form fields you create for collecting viewer information
Processing Status - Video encoding progress and completion status

3.4 Video Analytics & Viewer Data

When someone views a video you share, we collect anonymous analytics data:

Session ID - A randomly generated unique identifier (UUID) stored in the viewer's browser to track individual viewing sessions
IP Address (Hashed) - We hash IP addresses using SHA256 encryption with our application key for privacy protection. We never store plain IP addresses.
Device Type - Desktop, mobile, or tablet (parsed from user agent)
Browser - Chrome, Safari, Firefox, Edge, etc. (parsed from user agent)
User Agent String - Full browser/device information
Referrer URL - The website URL the viewer came from (if any)
Geographic Location - Country and city (derived from IP address)
Viewing Events - Link opened, video played, watch progress (25%, 50%, 75%, 100%), CTA clicks, downloads
Timestamp - When each event occurred

Important: Video viewers are NOT required to create accounts. All analytics tracking is session-based and anonymous.

3.4a Personal Link Access Control

When a video owner shares a video with you by name (a personal link sent to your email address), we record which devices have been authorised to open that link. This prevents the link from working if it is forwarded to someone else.

For each authorised device we store:

Device Identifier (Hashed) - A random value generated by us, stored in your browser as a cookie and kept in hashed form on our side. It is not derived from your device and cannot be used to recognise you on any other website or video.
IP Address (Hashed) - Hashed with SHA256, as described above. We never store plain IP addresses.
Browser/Device Description - The user agent string, used to help the video owner recognise unexpected access attempts.
Timestamps - When the device was authorised and when it was last used.

Purpose and legal basis: This is an access control and abuse prevention measure, processed under our legitimate interests (Article 6(1)(f)) in protecting video owners against unauthorised redistribution of their content. It is not used for advertising, profiling, or cross-site tracking.

Verification emails: If a personal link is opened on a device we do not recognise, we send a one-time code to the email address the link was issued to. The code is stored only in hashed form and expires after 15 minutes.

Retention: Device authorisation records are deleted when the share link is deleted or deactivated, or after 90 days of not being used, whichever comes first.

3.5 Viewer Registration Data

If you enable access forms on your videos, viewers must register to watch. We collect:

Email Address - Required for viewer identification
Custom Form Data - Any additional fields you configure (name, phone, company, etc.)
Submission Timestamp - When access was granted
IP Address - For security and spam prevention (not shared with video owners)

Purpose: Access forms allow video owners to control who views their content by requiring viewer identification before playback. This is a content access control feature, not a lead generation or marketing service. Video owners use this to:

Know who is viewing their private content
Follow up directly with viewers about the video content
Maintain records of content access for compliance purposes

Data use restrictions: Viewer registration data is collected solely for the purpose of granting video access and enabling direct communication between the video owner and viewer regarding the video content. vitelnk does not aggregate, resell, or use this data for lead generation, marketing databases, or any third-party commercial purposes.

3.6 Communications & Notifications

When you interact with our Service:

Email Notifications - Your preferences for receiving video activity and lead capture notifications
Support Communications - Any emails or messages you send to our support team
System Emails - Records of transactional emails we send (password resets, trial expiry reminders, etc.)
Marketing Communications - Product updates, tips, educational content, and promotional offers (you can manage preferences in Account Settings)

3.7 Usage & Analytics Data (PostHog)

In production environments only, we use PostHog for product analytics:

User ID - Your account identifier
Email Address - To identify user sessions
Events Tracked - User registration, subscription changes, video uploads, share link creation, feature usage
Session Data - Page views, clicks, time spent in application

PostHog is disabled in development/testing environments.

3.8 Technical & Log Data

Our servers automatically collect:

Access Logs - IP addresses, request timestamps, URLs accessed
Error Logs - System errors and debugging information
Webhook Logs - Payment events from Polar.sh (retained for 30 days, then auto-deleted)

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal grounds:

4.1 Contractual Necessity (Article 6(1)(b))

Processing is necessary to provide the Service you requested:

Account creation and authentication
Video upload, storage, and streaming
Subscription management
Customer support

4.2 Legitimate Interests (Article 6(1)(f))

We have legitimate interests in:

Analytics & Product Improvement - Understanding how users interact with vitelnk to improve features
Fraud Prevention - Detecting and preventing abuse, spam, and fraudulent activity
Security - Protecting our systems and your data from unauthorized access
Business Operations - Managing subscriptions, billing, and customer relationships

4.3 Consent (Article 6(1)(a))

We ask for your explicit consent for:

Email Notifications - Sending you video activity and viewer registration digests (you can opt-out anytime)
Analytics Cookies - PostHog analytics cookies (you can decline via cookie banner)
Viewer Registration - When viewers submit an access form to watch a video, they consent to share their information with the video owner for the purpose of content access and related follow-up communication about the video. This is an access control mechanism, not a marketing opt-in.

You can withdraw consent at any time via your account settings or by contacting us.

4.4 Legal Obligations (Article 6(1)(c))

We may process data to comply with:

Tax laws (NIF disclosure, invoice records)
DMCA copyright takedown requests
Court orders or legal proceedings

5. Third-Party Services & Data Sharing

We use trusted third-party services to operate vitelnk. Your data may be shared with:

5.1 Polar.sh (Payment Processing)

Purpose: Subscription billing and payment processing Data Shared: Email, name, subscription plan, billing cycle Location: EU-based service Privacy Policy: https://polar.sh/legal/privacy

Polar.sh handles all credit card processing. We never receive or store your payment card details.

5.2 Cloudflare R2 (Video Storage)

Purpose: Storing video files, thumbnails, and HLS streaming variants Data Shared: Video files, thumbnails, GIFs, file metadata Location: US and EU data centers (distributed globally) Privacy Policy: https://www.cloudflare.com/privacypolicy/

Cloudflare R2 provides S3-compatible object storage with encryption at rest and in transit.

5.3 PostHog (Product Analytics)

Purpose: Understanding product usage and improving features Data Shared: User ID, email, events (video uploads, share creation, etc.) Location: US-based (EU hosting available) Privacy Policy: https://posthog.com/privacy Opt-Out: Cookie banner or contact us

PostHog is only active in production environments. You can opt-out of analytics tracking.

5.4 Google OAuth (Optional Authentication)

Purpose: Allowing users to register/login with Google accounts Data Shared: Google ID, email, profile picture Location: US-based Privacy Policy: https://policies.google.com/privacy

Google OAuth is optional. You can also register with email/password.

5.5 Resend (Email Delivery)

Purpose: Sending transactional emails, notifications, and marketing communications Data Shared: Email address, name, notification content, email preferences, contact properties for segmentation (plan type, usage metrics) Location: US-based Privacy Policy: https://resend.com/legal/privacy-policy

We use Resend to reliably deliver password resets, trial expiry reminders, video activity notifications, and marketing communications (product updates, educational content, promotional offers).

5.6 Data Sharing Summary

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes. Data is only shared with the services listed above to operate vitelnk.

Viewer Registration Clarification: When viewers register to access a video via an access form, their submitted information is shared only with the video owner for the purpose of content access and direct communication about that content. vitelnk does not operate as a lead generation service, does not aggregate viewer data across accounts, and does not sell or provide viewer lists to third parties.

6. International Data Transfers

vitelnk is operated from Portugal (European Union). However, some of our third-party service providers are based in the United States:

PostHog (US-based, EU hosting available)
Google OAuth (US-based)
Resend (US-based)

When we transfer personal data outside the EU/EEA, we ensure adequate protection through:

Standard Contractual Clauses (SCCs) - EU-approved data transfer agreements
Adequacy Decisions - EU Commission approval for certain countries
Data Processing Agreements - Contractual obligations with service providers

You can request copies of the safeguards we use by contacting [email protected].

7. Data Retention

We retain your personal data for the following periods:

7.1 Active Accounts

Account Information: Retained indefinitely while your account is active
Video Files & Metadata: Retained until you delete the videos or close your account
Subscription History: Retained for 7 years (Portuguese tax law requirement)

7.2 Deleted/Closed Accounts

Grace Period: 30 days after account deletion (allows recovery if you change your mind)
Permanent Deletion: After 30 days, all videos, files, and personal data are permanently deleted from our systems and Cloudflare R2 storage

7.3 Analytics Data

Video Events: Retained for 2 years from the date of collection (GDPR data minimization principle)
Viewer Registration Data: Retained until you delete individual viewer records or close your account
PostHog Analytics: Retained according to PostHog's retention policy (configurable, default 7 years)

7.4 Logs & Technical Data

Access Logs: 90 days
Error Logs: 90 days
Webhook Logs: 30 days (auto-deleted via scheduled cleanup)

7.5 Legal Obligations

We may retain data longer if required by:

Tax laws (7 years in Portugal)
Legal disputes or litigation holds
Fraud investigations

8. Your Rights Under GDPR

As a data subject in the European Union, you have the following rights:

8.1 Right to Access (Article 15)

You can request a copy of all personal data we hold about you. We will provide this in a commonly used electronic format (JSON or CSV).

8.2 Right to Rectification (Article 16)

You can update or correct inaccurate personal data via your account settings or by contacting us.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data. We will comply unless we have a legal obligation to retain it (e.g., tax records).

How to delete your account:

Go to Account Settings → Delete Account
Or email: [email protected] with subject "Account Deletion Request"

8.4 Right to Restrict Processing (Article 18)

You can ask us to temporarily stop processing your data in certain circumstances (e.g., while we verify accuracy).

8.5 Right to Data Portability (Article 20)

You can receive your personal data in a structured, machine-readable format (JSON/CSV) to transfer to another service.

8.6 Right to Object (Article 21)

You can object to processing based on legitimate interests (e.g., analytics). We will stop unless we have compelling legitimate grounds.

8.7 Right to Withdraw Consent

You can withdraw consent for email notifications, analytics cookies, or other consent-based processing at any time via account settings.

8.8 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you can file a complaint with:

Portuguese Data Protection Authority (CNPD) Comissão Nacional de Proteção de Dados Website: https://www.cnpd.pt/ Email: [email protected] Phone: +351 213 928 400

8.9 How to Exercise Your Rights

Email us at: [email protected]

Include:

Your full name and email address
Description of your request
Proof of identity (if requesting data access/deletion)

We will respond within 30 days (may be extended to 60 days for complex requests).

9. Data Security Measures

We implement industry-standard security measures to protect your personal data:

9.1 Encryption

HTTPS/TLS - All data transmitted between your browser and our servers is encrypted
Password Hashing - Passwords are hashed using bcrypt (irreversible encryption)
IP Address Hashing - Viewer IP addresses are hashed using SHA256 with our application key
Cloudflare R2 - Encryption at rest for all stored video files

9.2 Access Controls

Session-Based Authentication - Secure login sessions with CSRF protection
Role-Based Access - Users can only access their own videos and data
Admin Controls - Limited administrative access to systems

9.3 Infrastructure Security

Cloudflare Protection - DDoS protection, web application firewall
Regular Updates - Server software and dependencies kept up-to-date
Monitoring - Error tracking via Sentry (development only)

9.4 Data Breach Notification

In the event of a data breach affecting your personal data, we will:

Notify the Portuguese CNPD within 72 hours (GDPR Article 33)
Notify affected users without undue delay (GDPR Article 34)
Provide details of the breach, impact, and remediation steps

No security measure is 100% foolproof. While we strive to protect your data, we cannot guarantee absolute security.

10. Cookies & Tracking Technologies

We use cookies and similar technologies to operate vitelnk and improve your experience. For detailed information, see our Cookie Policy.

10.1 Essential Cookies (No Consent Required)

laravel_session - Maintains your login session (2 hours)
XSRF-TOKEN - Prevents cross-site request forgery attacks (2 hours)
remember_web - "Remember me" functionality (400 days)

10.2 Analytics Cookies (Consent Required)

PostHog cookies (ph_*) - Product analytics and usage tracking (1 year)

You can manage cookie preferences via the cookie banner or your browser settings.

11. Children's Privacy

vitelnk is not intended for children under 16 years old (GDPR age threshold in Portugal).

We do not knowingly collect personal data from children. If we discover that a child under 16 has provided personal data, we will:

Delete the account immediately
Permanently erase all associated data
Notify the parent/guardian (if contact information is available)

If you believe a child has registered, please contact: [email protected]

12. Marketing & Communications

12.1 Transactional Emails (No Opt-Out)

We will send essential service emails:

Account verification
Password reset instructions
Trial expiry reminders
Subscription renewal/cancellation confirmations

These are necessary for the Service and cannot be opted out of.

12.2 Notification Emails (Opt-In)

You can choose to receive:

Video Activity Notifications - Batched hourly digest of views, plays, watch progress
Viewer Registration Notifications - Batched hourly digest of new viewer registrations

Configure via: Account Settings → Notifications (per-video basis)

12.3 Marketing Emails (Opt-In with Granular Control)

We send marketing communications including:

Product Updates - New features, tips, and improvements (default: on)
Trial & Account - Activation tips, trial reminders, milestones (default: on)
Promotions - Special offers, lifetime deals, and discounts (default: off)

Managing Preferences: Account Settings → Email Preferences

Every marketing email includes an unsubscribe link. You can also unsubscribe from all marketing emails while continuing to receive important account notifications.

We will:

Provide clear unsubscribe links in every marketing email
Honor unsubscribe requests immediately
Never share your email with third parties for marketing purposes

13. Do Not Track (DNT)

We respect browser "Do Not Track" (DNT) signals:

If your browser sends DNT=1, we will disable PostHog analytics tracking
Essential cookies (session, CSRF) remain active (required for functionality)

To enable DNT:

Chrome/Edge: Settings → Privacy → Send "Do Not Track" request
Firefox: Settings → Privacy → Send websites a "Do Not Track" signal
Safari: Preferences → Privacy → Prevent cross-site tracking

14. Third-Party Links

vitelnk may contain links to external websites (e.g., CTA buttons you configure). We are not responsible for the privacy practices of third-party sites.

We encourage you to read the privacy policies of any external sites you visit.

15. Business Transfers

If vitelnk is acquired by or merged with another company:

Your personal data may be transferred to the new owner
This Privacy Policy will continue to apply
You will be notified 30 days before any transfer
You may delete your account before the transfer if you disagree

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

Changes in legal requirements
New features or services
Improvements to our privacy practices

16.1 Notification of Changes

We will notify you of material changes via:

Email to your registered address (30 days advance notice)
Prominent notice in the application dashboard
Update to the "Last Updated" date at the top of this policy

16.2 Acceptance

Continued use of vitelnk after changes take effect constitutes acceptance of the new policy. If you do not agree, you may close your account.

17. Contact Us

For privacy-related questions, requests, or concerns:

Email: [email protected] Support: [email protected] Data Subject Requests: [email protected]

Service Provider: Edmilson Jorge Delgado Gomes NIF: 251423832 Portugal

Response Time: We aim to respond to all inquiries within 5 business days and data subject requests within 30 days (as required by GDPR).

18. Governing Law

This Privacy Policy is governed by:

GDPR (EU Regulation 2016/679)
Portuguese Data Protection Law (Lei n.º 58/2019)
Laws of Portugal

Any disputes will be resolved in the courts of Portugal, subject to your mandatory consumer rights under EU law.

Thank you for trusting vitelnk with your data. We are committed to protecting your privacy.

Last reviewed: January 14, 2026