ApproveLink - Terms - Privacy - Imprint
Last updated: 5 August 2026
This policy explains what data ApproveLink processes, why, and your rights. The controller for account data is the operator identified on the Imprint page.
Creators (account holders): email address, name, workspace/brand name, password (stored as a one-way hash), plan and billing status. Payments are processed by Stripe; we never see or store card numbers.
Content: the captions, files and notes you upload, your clients’ names and contact emails you enter, and the requests’ review history.
Approvers (your clients): approval pages work without an account. We record the decision, its time, an optional name and email if the approver chooses to provide them, a TRUNCATED IP address (last octet zeroed for IPv4, last 80 bits for IPv6 - never the full address) and the browser family, for the audit log the Creator relies on. This line is disclosed on every approval page.
For approver data inside a Creator’s workspace, the Creator is the data controller and ApproveLink the processor. A data processing agreement is available on request via the contact on the Imprint page.
Operating the service (contract), sending transactional email - approval links, reminders, decision notifications, results asks (contract / legitimate interest), securing the service and preventing abuse (legitimate interest), billing and tax records (legal obligation). No advertising, no tracking cookies, no sale of data. The only cookie is the strictly necessary session cookie.
Deleting your account erases every model holding personal data or content: requests, rounds, files, approver records, decisions, audit events and results. Deletion is a soft delete followed by a hard purge within 30 days, including uploaded files. Independently, audit IP and browser data older than 12 months is redacted, and free-plan file storage follows the retention window of the plan.
Hosting (EU-region infrastructure), Cloudflare (CDN/DNS/DDoS), Cloudflare R2 (file storage), Stripe (payments), our transactional email provider. Each processes data under its own data processing terms.
Access, rectification, erasure, restriction, portability and objection - for account data, contact us via the Imprint page; approvers should contact the Creator who sent the link (we assist the Creator as processor). You may also complain to your supervisory authority.