Privacy Policy

1. About this policy

MyLaura is a digital platform and product operated by Linksta s. r. o.. This policy explains what personal data we process during registration, onboarding, campaign participation, communication with Laura, uploading and approval of content, performance measurement, use of the wallet and payouts.

The policy applies to creators, brand representatives, administrators, visitors to public pages and people whose data appears in content or campaign materials. In a particular campaign, the brand and creator may be separate controllers of data they process for their own purposes.

2. Controller and contact

The operator of the MyLaura platform is Linksta s. r. o., Fraňa Kráľa 21, 811 05 Bratislava – mestská časť Staré Mesto, Slovenská republika, Company ID 56972024, Tax ID 2122530245, VAT ID SK2122530245. You may send questions and requests concerning data protection to [email protected] or by post to the registered office address.

MyLaura has not appointed a data protection officer unless such an obligation arises under applicable law. The privacy contact address therefore does not designate an external data protection officer.

3. What data we process

• Account and identity: name, email, user identifier, language, role, account status and authentication session data.
• Creator onboarding: date of birth, phone number, country or city, age group, markets, collaboration preferences and acceptance of legal documents.
• Public social profile: Instagram username, profile photo, bio, follower and post counts, verified status, public content and available audience or engagement metrics.
• Campaigns: applications, invitations, acceptance or rejection, brief, content plan, deadlines, cooldowns, published URLs and evidence of completion.
• Content and review: photos, videos, Reels, Stories, texts, attachments, technical and content assessments, reasons for rejection, category ratings and recommendations for correction.
• Communication: messages with Laura, a brand or support, system messages, attachments, read status and related campaign context.
• Performance and remuneration: verified views, clicks, conversions, PPV baseline, rates, limits, wallet transactions, budget reservations and payout history.
• Payment data: Stripe or Stripe Connect identifiers, verification and payout-account status, name, address and encrypted IBAN for direct bank payouts, amounts, currency and accounting documents. We do not store full payment-card details.
• Notifications: push token, preferences, scheduled and actual sending time, delivery, opening and click status.
• Technical and security data: IP address or its hash, device, operating system, user agent, request time, error logs, security events and anti-fraud data.
• Optional product analytics: a pseudonymous account identifier, screens and features used in the app, interaction time and duration, campaign or video identifiers, app version, platform and technical diagnostic data. We do not send message content, video content, payment data, phone numbers or email addresses to analytics.

4. Where we obtain data

We obtain data directly from you, from the brand or creator you work with, from system events arising from use of MyLaura and from publicly available social profiles. When verifying an Instagram profile or public Reel, we may use Apify to obtain public profile and performance data.

If you sign in through an external provider, we receive the data permitted by that sign-in flow. Anyone providing us with data about another person must have a legal basis for doing so and inform that person under the applicable rules.

5. Purposes and legal bases

If data is necessary to enter into or perform a contract and you do not provide it, we may be unable to create an account, verify Instagram, enable campaign participation or pay remuneration.

• Performance of a contract: account creation, onboarding, matching, campaign management, content approval, scheduling, communication, remuneration calculation, wallet and payouts.
• Legal obligation: accounting, taxes, handling data subject rights, cooperation with authorities and mandatory retention of documents.
• Legitimate interest: security, prevention of fraud and misuse, defence of legal claims, basic operational analytics and service improvement while respecting user rights.
• Consent: optional marketing, optional analytics technologies or other processing for which the law requires consent. Consent may be withdrawn at any time without affecting previous processing.

6. Laura, AI and profiling

Laura uses account and campaign context to explain invitations, deadlines, content rejection and next steps. She may process structured ratings, the brief, content and collaboration history and produce clear recommendations. For generative features, we may use Google/Gemini models or another contracted provider listed in the current list of processors.

MyLaura may create a profile or score for suitability, professionalism, brand safety and reliability to recommend campaigns and prevent risks. Laura’s outputs are auxiliary. Content rejection, account blocking or another significant decision should have a recorded reason and an option for human review; we do not use solely automated decision-making with legal or similarly significant effects without appropriate safeguards.

7. Recipients and suppliers

We provide suppliers only with data necessary for the particular purpose and contractually require them to protect it. A brand may be a separate controller when using creator content and campaign data for its own purposes.

• Brands and creators to the extent necessary to select, carry out, review and settle a campaign.
• Better Auth and our hosting or software suppliers when managing authentication and sessions.
• Neon/PostgreSQL for database hosting and AWS for API operation, logs and content storage.
• Stripe and Stripe Connect for payments, payout-account verification, transfers and mandatory financial compliance.
• Resend for sending sign-in and service emails.
• Apify for obtaining public Instagram profile data and public Reel metrics.
• Google/Gemini for AI assistance if the feature is active and data is sent only to the necessary extent.
• PostHog for optional product analytics, only after consent is granted; we use European hosting, with session replay, geolocation and remote feature flags disabled.
• Legal, accounting and security advisers and public authorities where required by law or the protection of rights.

8. Transfers outside the EEA

Some suppliers or their subcontractors may process data outside the European Economic Area. In that case, we use an adequacy decision, standard contractual clauses or another valid safeguard and assess the adequacy of supplementary measures.

You may request information about the safeguard used or a copy of the relevant clauses at [email protected]; commercial and security secrets may be appropriately redacted.

9. How long we retain data

• Account and onboarding: for the duration of the account and generally 3 years after its closure to protect legal claims.
• Campaigns, approvals, content and communication: during the campaign and generally 3 years after it ends; longer if a dispute remains open.
• Accounting and tax documents: 10 years or longer if required by binding law.
• Security and authentication logs: generally 12 months; in an incident, until its closure and expiry of the relevant limitation period.
• Notification deliveries, openings and clicks: no more than 24 months for operational analytics and proof of delivery.
• Optional product analytics events: no more than 12 months; we retain the consent decision record for the duration of the account and reasonably longer to demonstrate fulfilment of a legal obligation.
• Marketing consent: until withdrawal or no more than 3 years from the last active interaction.
• Backups: rotating backups are generally overwritten within 90 days unless an incident or the law requires longer retention.

10. Security

We use access controls, database sessions, encrypted transmission, separate secrets, restricted upload URLs, audit records and monitoring of suspicious events. We may copy profile photos and campaign content to MyLaura storage to reduce dependence on temporary external URLs.

No system is absolutely secure. In a personal data breach, we follow the GDPR, including notifying the authority and data subjects where the statutory conditions are met.

11. Your rights

Exercise your rights at [email protected]. Before handling a request, we may reasonably verify your identity. We will respond without undue delay, generally within one month; for a complex request, the period may be extended as permitted by law, and we will explain the reason.

• access to data and information about processing;
• rectification of inaccurate or incomplete data;
• erasure of data where no reason for further retention exists;
• restriction of processing;
• portability of data provided on the basis of consent or a contract;
• objection to processing based on legitimate interest and to direct marketing;
• withdrawal of consent;
• request for human review of a significant automated decision;
• complaint to the Office for Personal Data Protection of the Slovak Republic.

12. User age

A creator account is intended for people meeting the minimum age stated in onboarding and the terms of service. If we discover that an account was created by a person without the required age or consent of a legal representative, we will restrict the account and erase or anonymise the data unless we must retain it by law.

13. Policy changes

We will always publish the current version on this page. For a material change in purpose, legal basis or user rights, we will notify users in the app, by email or by another appropriate method before the change takes effect.

14. Contact

Linksta s. r. o., Fraňa Kráľa 21, 811 05 Bratislava – mestská časť Staré Mesto, Slovenská republika, Company ID 56972024, Tax ID 2122530245, VAT ID SK2122530245. Data protection: [email protected]. In your request, identify the relevant account and provide sufficient information for secure verification and handling.