Privacy Policy

Linkcups is a service for hotels, restaurants, venues and creators to make meaningful links, QR codes and hosted pages, and to see guest clicks through to bookings. This Privacy Policy explains how we collect, use, share and protect personal data when you use linkcups.com and the related link domains (such as yourstay.today and dinein.today), the pages hosted on those links, our QR codes, tracking tools, integrations and related services (together, the “Service”).

It is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“Thai PDPA”), Singapore’s Personal Data Protection Act 2012 (“Singapore PDPA”) and, for people in the EU/EEA and the UK, the General Data Protection Regulation and the UK GDPR (together, “GDPR”).

The Service is built and operated by Aedios Pte. Ltd., a private company limited by shares incorporated in Singapore (“Aedios”, “Linkcups”, “we”, “us”). Aedios is the data controller for the processing described in this policy, except where section 3 says we act as a processor. SO IDEA Co., Ltd., Bangkok, is our development and support partner and our representative in Thailand under the Thai PDPA.

Our DPO acts as the Data Protection Officer under the Thai PDPA and the Singapore PDPA. Use the details above for any privacy question, access or correction request, consent withdrawal or complaint.

We process personal data about four groups of people:

• Account Users: people who sign up to Linkcups for a hotel, restaurant, venue or brand (a “Property”), their team members, and creators (KOLs, influencers and partners) who receive affiliate links.
• Guests: people who tap or scan a Linkcups link or QR code, open a page hosted on a Linkcups link, submit a form on such a page, or interact with a Property through an automation we run (for example an Instagram comment reply).
• Website visitors: people who browse linkcups.com without an account.
• Business contacts: people at Properties, partners, suppliers and job applicants who correspond with us.

• Controller: for Account Users (hotel and restaurant staff, creators), visitors to our own website linkcups.com, and business contacts. We are the “data controller” under the Thai PDPA and the “organisation” under the Singapore PDPA.
• Processor: for data about Guests who tap a Property’s link, scan its QR code or open its page. We process it only on the Property’s documented instructions; the Property is the controller. We are a “data processor” under the Thai PDPA and a “data intermediary” under the Singapore PDPA. Our data processing terms with Properties are in Annex A of the Terms.

If you are a Guest and want to know how a Property uses your data or want to exercise your rights, please contact that Property; its privacy notice applies once you reach its own website or booking engine, and we help the Property answer you. Linkcups acts as a controller for Guest data only to the limited extent needed to secure the Service, prevent abuse, measure system performance and comply with law.

4.1 Account data (Property staff, creators)

• Email, name, profile photo (when you sign in with Google), Firebase user ID, language, phone number (if you give it), your role at each Property, and the email addresses of people you invite to your team.
• Consent record: the version of the Terms you accepted, when, and your marketing-email choice.
• Passwords are handled by Google’s Firebase Authentication. We never see or store your password.

4.2 Business data you enter

• Property name, type (hotel, restaurant, or creator/solopreneur), city, country, address, website, logo and brand colours, settings, links and their destinations, slugs, QR designs, page text, images, prices, offers and voucher terms.
• Uploaded files (for example PDF, JPG and PNG, and PPTX or DOCX for Drop pages) and the text and images we extract from them to build your page. Files are stored in DigitalOcean Spaces in Singapore.
• Review replies you draft or approve, and automation keywords and messages you set up.

4.3 When a Guest taps a link or scans a QR code (processed for the Property)

• Time, link, source (inferred from the referrer or the app that opened the link), device type, country, phone language, table number (QR) and referring creator ID. The country is looked up from the IP address in a copy of the DB-IP country database kept on our own server; the IP address is used for that lookup only and is not stored.
• For Guests in the EU/EEA, the UK or Switzerland, or whose country cannot be determined, we record less: see section 6.
• Pseudonymous visitor hash: a keyed HMAC-SHA-256 of (the Property’s ID + the IP address, or for IPv6 its network part + user agent), cut to 32 characters, used only to count unique visitors over a period. The key is derived from a secret that only we hold, so the hash cannot be turned back into an IP address without it, and because the Property ID is part of it, the same Guest cannot be linked across different Properties. The hash itself is erased after 90 days. Raw IP addresses are not stored in click records.
• A click ID (lc_click_id) and UTM parameters appended to the destination URL so the Property can match bookings to links.
• When a Guest reaches a Linkcups page through a creator’s link, we add lc_kol=1 to the page address so the page can show the “Paid partnership” label. It says only that a creator referred the visit, never which creator or who the Guest is, and it is added for every visitor, wherever they are.
• We set no cookies on Guests for links and pages.
• If a Property adds the optional Linkcups tag to its own website, the tag keeps the click ID in sessionStorage for the visit (no cookie) and adds it to links to the Property’s booking engine. It sends nothing to Linkcups. The click ID is already left out for visitors from the regions in section 6; a Property that wants more can load the tag only after its own consent banner, and is responsible for obtaining any consent its website needs.
• If a Property’s hosted page includes a form (for example to request a voucher or ask a question), we store what the Guest enters, on the Property’s behalf.

4.4 Booking data

• Value, currency, nights, room type, external booking reference and click ID sent by the Property’s booking engine or Google Analytics 4. We do not accept Guest names, emails or phone numbers. We never collect payment card details from Guests; payment happens on the Property’s own booking or payment site.

4.5 Google data when a Property connects (OAuth)

• openid, email: the email of the connected Google account.
• analytics.readonly: the list of Google Analytics 4 properties and read-only reports of bookings and revenue by campaign.
• business.manage: Google Business Profile accounts and locations, reviews (reviewer name, text, rating), and posting replies only after a person at the Property approves them.
• Access tokens are encrypted in our database and deleted when you disconnect.

4.6 Meta data when a Property connects

• Facebook Page, Instagram professional account and Pixel IDs; the Conversions API (CAPI) token is encrypted.
• Events sent to Meta: event name, time, click ID, URL and value/currency. Today we send no Guest IP address or other Guest identifier. If we later send IP address and user agent for event matching, we will do so only when the Property turns it on, with a legal basis and with consent where the law requires it, and we will update this policy first.
• When Instagram auto-reply is enabled: commenter username and comment text, blanked after 90 days (counts stay).

4.7 Communications and technical data

• System emails we send (invites, alerts, digests), your messages to support, feedback, and any abuse or intellectual-property reports (with the reporter’s contact details).
• Our hosting providers’ request logs (Vercel, DigitalOcean), which may include IP address, user agent, time and path, kept under those providers’ policies. We keep no separate access logs of our own.
• Our security logs (an audit trail of events such as sign-ins, Terms acceptance and account changes), and IP addresses held briefly in memory for rate limiting.
• Error reports when something breaks on linkcups.com or our API (what failed, page path, browser and device type, approximate country, site version, and your account and Property ID if signed in), with personal details removed and no IP address stored; deleted after 30 days.

4.8 Payment and payout details (future paid features)

• If paid plans or creator payouts are offered, we will collect billing name, address, tax identifiers and the last four digits of a payment method. Full card or bank details are collected directly by our payment provider and are never stored by Linkcups.

4.9 Sensitive data

We do not collect sensitive data (such as health, religion, political opinions or biometric data). Please do not put it in links, pages or files.

Under Thai PDPA sections 19 and 24 and GDPR Article 6:

Where the Singapore PDPA applies, we rely on your consent given at sign-up or at the point of collection, on deemed consent (including where the processing is necessary for a contract with you), or on the legitimate interests and business improvement exceptions, as that law allows. We honour the Singapore Do Not Call Registry and Thai requirements for marketing messages.

Linkcups treats Guests differently depending on where they are. We work out the country from the connection, not from anything the Guest types: on our guest pages from the country our web host (Vercel) attaches to the request, and on our short links from the DB-IP country database described in 4.3. We keep only the result, never the IP address.

6.1 Guests in the EU/EEA, the UK or Switzerland (or an unknown country)

• Links and QR codes: a redirect cannot show a consent banner, so we record only the minimum: that the link was opened, when, the country, and what the link itself says (QR or link, table number, referring creator, and the kind of site it came from, judged from the referrer). We create no visitor hash, record nothing derived from the IP address or the browser (no device type, language or app), add no click ID to the Property’s address (campaign tags such as utm_campaign stay), and never send an event about the click to Meta, Google or anyone else.
• Guest pages (/p/…): a banner asks first, with “Accept” and “Decline” shown equally and nothing pre-selected. Until the Guest accepts, no analytics or advertising tool (such as the Meta pixel, Google Analytics or Google Tag Manager) is loaded and no identifier is set. The answer is stored on the Guest’s device for that Property only (lc-guest-consent, see section 14) and asked again after 6 months. The Guest can change it any time with “Privacy choices” at the bottom of the page; withdrawing consent after tools have started reloads the page so they stop. Declining never stops the page or its links from working.

6.2 Guests elsewhere

• Guest pages show a one-line notice linking to this policy, which the Guest can dismiss. Clicks are counted as described in 4.3.

6.3 What runs today

• Today no analytics or advertising tool is loaded on Linkcups guest pages for any Guest, and the redirect sends no events about clicks to Meta or Google. “Accept” therefore changes nothing that is collected today; it only records your answer.
• Once a Guest reaches the Property’s own website or booking engine, the Property’s privacy policy applies.

Country data: IP Geolocation by DB-IP (“IP to Country Lite”, licensed under CC BY 4.0).

Linkcups’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google data (Google Analytics 4 and Business Profile) only to provide user-facing features the user chooses: bookings next to clicks, the reviews inbox, reply drafts, and posting replies the user approves.
• We do not transfer this data to others except as necessary to provide or improve those features (for example sending review text to the AI provider in section 9 to draft a reply), to comply with law, or as part of a merger or acquisition with notice.
• We do not use this data for advertising, do not sell it, and do not let humans read it unless you consent, it is necessary for security or legal reasons, or it is aggregated and anonymised for internal operations. Authorised staff of Aedios and of SO IDEA Co., Ltd., our development and support partner in Thailand, may view reviews only for support and security.
• We do not use Google user data to develop, improve or train generalised AI/ML models, and we do not allow our AI provider to do so.
• You can disconnect at any time in Linkcups Integrations (we delete the stored tokens), revoke access in your Google Account settings, and ask us to delete the Google data we hold at support@linkcups.com.

• AI suggests link names, drafts review replies and summarises insights. These are suggestions only: nothing is posted to Google until a person at the Property approves it (this setting cannot be turned off).
• We send our AI provider only the data needed for the feature, under terms that prohibit training on your data.
• We make no solely automated decisions with legal or similarly significant effects on anyone (GDPR Article 22). Inferring source and device from clicks produces aggregate statistics, not individual profiles.

We do not sell personal data. We use the following providers under contracts that require confidentiality, security and use only on our instructions.

We may update this list as the Service changes; a current list is always available from the DPO. We also share personal data with:

• Properties and creators: Guest interaction data is shown to the Property that owns the link or page and, for affiliate links, to the creator in aggregated form (clicks, bookings, commissions). Each Property’s data is visible only to its team members according to their roles, and to authorised Aedios and SO IDEA staff for support and security.
• Third-party platforms you connect: Google, Meta and, where offered, LINE, booking engines and channel managers receive data from us only to perform the actions you authorise. Their own privacy policies apply to what they do with it.
• Legal and safety: regulators (including the Personal Data Protection Committee of Thailand and the Personal Data Protection Commission of Singapore), law enforcement, courts and professional advisers where disclosure is required by law, to enforce our Terms, or to protect the rights, safety or property of Guests, users, the public or Linkcups.
• Corporate transactions: a buyer or successor in a merger, acquisition, financing or transfer of the business, who must use personal data only as described in this policy. We will notify Account Users before this happens.

We are based in Singapore. Our main data stores are in Singapore (DigitalOcean, Vercel); some data goes to the United States, the EU or other countries through the providers in section 9, and to the countries where Properties and creators are located.

• Thai PDPA (sections 28–29): we transfer only to countries or recipients with adequate protection, or with appropriate safeguards such as data protection clauses.
• Singapore PDPA (section 26): we ensure recipients provide a standard of protection comparable to the Singapore PDPA, through contractual clauses or other legally enforceable obligations.
• GDPR (Chapter V): for data from the EU/EEA/UK we rely on the European Commission’s Standard Contractual Clauses (2021/914) with the UK Addendum, or an adequacy decision where one exists.

Ask for a copy of the safeguards for a specific transfer at hello@linkcups.com.

We keep personal data only as long as we need it for the purposes in this policy, or as the law requires:

The automatic purge runs daily at 04:00 Bangkok time.

• HTTPS (TLS) everywhere, tokens encrypted at rest, role checks on every API route, HMAC-signed OAuth state, hashed visitor data, rate limits, monitoring, regular dependency updates, backups and least-privilege staff access.
• No system is completely secure, and you are responsible for keeping your sign-in credentials confidential.
• If a personal data breach happens, we notify Thailand’s Personal Data Protection Committee within 72 hours of becoming aware of it (Thai PDPA s.37(4)), Singapore’s Personal Data Protection Commission within 3 calendar days of assessing that a breach is notifiable (Singapore PDPA s.26D), and the competent EU or UK supervisory authority within 72 hours (GDPR Art. 33), unless the breach is unlikely to result in a risk to people’s rights. Where the risk is high, or the law requires it, we tell the people affected without undue delay.
• For data we process for a Property, we notify the Property without undue delay with the information it needs for its own notices.

Depending on where you live, under the Thai PDPA (sections 19 and 30–36), the Singapore PDPA and the GDPR (Articles 15–22) you may have the right to:

• access your data, get a copy, know where it came from and how it has been used or disclosed;
• have it corrected and kept up to date;
• have it erased or anonymised;
• restrict its use;
• object to processing (including direct marketing, at any time);
• receive or port your data (data portability);
• withdraw consent at any time, without affecting what was done before (for example, unsubscribing from marketing email); withdrawing may mean we can no longer provide parts of the Service;
• complain to Thailand’s Personal Data Protection Committee (pdpc.or.th), Singapore’s Personal Data Protection Commission (pdpc.gov.sg) or, if you are in the EU/EEA, the supervisory authority of the country where you live, work or where the issue happened (in the UK: the ICO).

Send requests to our DPO at hello@linkcups.com or to support@linkcups.com, free of charge (unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee where the law allows). We may need to verify your identity and will reply within 30 days (Thai PDPA and Singapore PDPA) or one month (GDPR), and will tell you if we need more time or an exception applies. In this version, account deletion and data export are handled by our team on request. If you are a hotel or restaurant Guest, please contact the Property first (see section 3); if you contact us, we will pass your request to the Property and help it respond.

linkcups.com uses no analytics or advertising cookies. A cookie banner lets you accept or refuse the optional categories (analytics, marketing) before any such tool could load, and “Cookie settings” at the bottom of every page lets you change that choice. The full list, the categories and how your choice is recorded are in our Cookie Notice. We use only storage that is strictly necessary:

Guest links and pages set no Linkcups cookies and no identifiers. Non-essential tools on guest pages follow the consent rules in section 6. You can control storage through your browser settings; blocking strictly necessary storage may stop you from logging in.

Linkcups is a service for businesses. It is not directed at children, hosted pages are not directed at children, and we do not knowingly collect personal data from minors (under 20 in Thailand, or under the age of majority where you live). If you believe we have, please tell us and we will delete it.

We may update this policy as the Service, the law or our practices change. We will post the new version at linkcups.com/privacy with a new version and effective date. When we change it materially, we will notify Account Users by email or in the Service, ask you to accept again at your next login, and give at least one month’s notice before a change that reduces your rights takes effect. Where the law requires fresh consent, we will ask for it.

• Data Protection Officer: Sakda Su · hello@linkcups.com · +66 80-198-9499
• General support: support@linkcups.com
• Post: Aedios Pte. Ltd. (Linkcups), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 · Tel +65 6964 0228