Privacy Policy
Last updated October 27, 2026
theHQ.link is operated by Coffee Layer, LLC, a company in the United States, which is the controller of the personal information described here. This policy explains what information theHQ.link collects when you use thehq.link, dashboard.thehq.link, and the pages published with them, why we collect it, who helps us process it, and the choices you have. It applies to account holders and to people who visit or contact a published page.
In short: we collect what we need to run your page and keep it safe, we do not sell personal information, and we do not use advertising trackers on published pages.
1. Information we collect
When you create an account
- Your name, email address, and a salted hash of your password (never the password itself).
- Email verification and sign-in records, including hashed session tokens and failed-login counters used to protect your account.
- How you found us, if you arrived from one of our pages or ads: the page name, the campaign tags in the link (UTM tags, our own campaign and ad keys, and X’s click ID when present), and later milestones such as verifying your email, publishing, sharing your link from the dashboard, and starting or paying for Pro. We use this to learn which campaigns bring people who find the product useful. It is never sent to advertising platforms.
When you build your page
- The content you add: name, title, bio, location, links, contact details you choose to publish, theme settings, and booking availability.
- Images you upload, with their size and type.
When you subscribe
- Your Stripe customer and subscription identifiers, plan status, and renewal date. Card details are collected and stored by Stripe, not by us.
When someone visits a published page
- Page views and taps on links, WhatsApp, and booking, with the website that referred the visit (domain only) and a random key stored in the visitor’s browser tab to avoid counting the same visit twice. We do not set cookies for visitors.
When someone books or sends an enquiry
- The name, email address, message or note, chosen time, and time zone they submit. This is stored for the page owner and emailed to them.
- Short-lived abuse-prevention records derived from the visitor’s IP address and email address. These are stored only as keyed one-way digests and expire within a day.
On our marketing pages
- Daily counts of visits per page, page variant, and campaign source. These are aggregate numbers, not individual profiles.
- When you arrive from a campaign or ad link, or from another website, a record of that visit: its campaign tags, landing page, referring website (domain only), and a random visit identifier. No IP address or cookie is stored with it, and it is linked to an account only if you sign up from that visit.
2. How we use information
- To provide the Service: publish pages, save drafts, show your dashboard, and process subscriptions.
- To send messages the Service needs: email verification, booking confirmations and cancellations, and enquiry notifications.
- To keep the Service secure: preventing spam, bots, fraud, and abuse, and investigating problems.
- To understand and improve the product using aggregate counts, such as which landing pages lead to sign-ups.
- To meet legal obligations.
3. Legal bases
Where data protection laws such as the GDPR apply, we rely on: performing our contract with you (running your account and page); our legitimate interests (security, abuse prevention, and aggregate product measurement), balanced against your rights; your consent where the law requires it; and legal obligations (for example, tax and accounting records kept by our payment provider).
6. How long we keep it
- Account and page: until you delete your account. Free accounts are removed straight away; Pro accounts are removed at the end of the paid period.
- Deleted accounts: a minimal anonymised record so the account cannot be reused, and the former username on its own, with nothing linking it to you, so its old address tells search engines the page is gone. Anyone can claim that username again.
- Sessions: up to 30 days. Verification links: one hour.
- Bookings and enquiries: until the page owner deletes them or deletes their account.
- Abuse-prevention records: up to one day.
- Billing records: kept by Stripe as required by tax and accounting law.
7. Your choices and rights
From your dashboard you can edit or unpublish your page, export your profile data, delete uploaded images and enquiries, cancel bookings, and delete your account.
Depending on where you live, you may also have the right to access, correct, delete, restrict, or object to processing of your personal information, to receive it in a portable format, and to complain to your data protection authority. Email hello@thehq.link to make a request; we may need to verify your identity first.
If you visited or contacted a page published on theHQ.link, the page owner decides how to use the details you sent them. Contact them directly, or email us and we will help.
8. Security
Passwords are stored as salted PBKDF2 hashes, sessions and verification tokens as one-way hashes, and all traffic uses HTTPS. Uploaded images are only served when they belong to you or appear on your published page. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you as the law requires.
9. Children
theHQ.link is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.
10. Changes to this policy
We will post any changes here and update the date above. If a change is significant we will tell account holders by email or in the dashboard.
11. Contact
For privacy questions or requests, email hello@thehq.link. The controller is Coffee Layer, LLC, United States.