1. Who is responsible?
MainSent GmbH, Obere Wende 5, 33739 Bielefeld, Germany, is responsible for the processing described here. Email: info@mainsent.com; telephone: +49 (0)151 46368236. Send privacy questions or rights requests to datenschutz@mainsent.com or the postal address above.
This notice covers standalone FoxLink accounts, teams, public Link Trees and Short Link redirects. A team that publishes personal data is responsible for ensuring that its own publication is lawful. External destination operators are responsible for their own websites; this notice does not replace their notices.
2. Accounts, teams and service emails
We process your name, email address, password hash, language, verification and approval status, sessions, team memberships, roles and invitations to provide and secure the service. Passwords are stored as hashes, not readable passwords. Verification, password reset and invitation emails contain private, time-limited links. Support correspondence and restriction notices are processed to handle your request or explain an action.
The legal basis is Article 6(1)(b) GDPR for the requested service and pre-contractual steps; Article 6(1)(f) for account security, access control and preventing abuse; and Article 6(1)(c) where a legal obligation applies. Providing an email address and password is necessary to create an account; without the required information we cannot provide account access. Account holders must be 18 or older. Registration is not consent to marketing emails.
3. Links, public content and images
We store destinations, identifiers, titles, descriptions, publication settings, uploaded images and associated team and activity records. Team members see information according to their permissions. Publishing makes the selected content available to visitors without a FoxLink account. Images and destination URLs may themselves contain personal data; do not publish information you are not entitled to disclose.
We process this information to provide the requested hosting, publication and redirect functions (Article 6(1)(b) GDPR), and for secure delivery and abuse prevention (Article 6(1)(f)). Destination monitoring fetches configured URLs to check availability. Following a link sends your browser to the external operator, which receives the connection data needed to serve its website.
4. Connection data and security
Serving a page, image or redirect necessarily processes connection information such as IP address, requested URL, time and browser/protocol information at the hosting or network provider. Security and operational logs may contain this information. We also keep aggregate service health and response-time counters. This is distinct from the limited click-event data described below.
Public authentication and reporting endpoints use rate limits. Database rate-limit buckets contain keyed hashes and counters with short expiry windows, rather than raw IP addresses. Their purpose is to prevent automated abuse. The legal basis for necessary delivery is Article 6(1)(b), where applicable, and for security, service reliability and proportionate abuse prevention Article 6(1)(f) GDPR.
4a. Form protection with Cloudflare Turnstile
We use Cloudflare Turnstile, provided by Cloudflare, Inc. (USA), to protect signup, verification and password-reset email requests, contact and reporting forms, and sign-in after repeated failed attempts against automated abuse. The script loads only when you submit a protected form. It checks the browser in the background and may display a checkbox. Public Link Tree viewing and Short Link redirects do not trigger this check.
Your browser connects to challenges.cloudflare.com. Cloudflare processes signals including IP address, TLS fingerprint, User-Agent, sitekey and associated origin. Cloudflare states that Turnstile does not collect form entries or communication contents. FoxLink sends only the short-lived verification token and secret site key for server validation, not your email address, password or message. Tokens are single-use, expire after five minutes, and are not persistently stored or logged by us. We do not enable pre-clearance cookies or use Turnstile for advertising or click statistics.
Our legal basis is Article 6(1)(f) GDPR: securing accounts, preventing spam and abuse, and reliable operation. The protected action cannot complete without a successful check; after a technical failure your entries are retained for a retry. Limited failed-sign-in counters use short-lived identifiers hashed with a secret key, not plain IP addresses or email addresses.
Cloudflare acts as a processor when protecting our website and, according to its notice, as an independent controller when improving its own bot detection. Processing may occur outside the EEA, including in the USA; EU-only processing is not promised. The sections on recipients, international transfers and your rights also apply. Cloudflare’s Turnstile Privacy Addendum explains its processing, responsibilities and contact options.
5. Click statistics without visitor profiles
For successful GET redirects, the analytics event contains a random event ID for deduplication, the link identifier, a timestamp, a country code and an estimated bot flag. The browser user agent is used transiently for the bot estimate. We do not include IP addresses, cookies, persistent visitor IDs, full user agents, referrers, destination URLs or query strings in that event payload. We do not build cross-site visitor profiles from it.
Redirect requests carrying Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1) are excluded from these click events. HEAD requests are not counted. This does not disable the connection processing needed for delivery and security. Team statistics are aggregates and do not reliably identify individual people or unique visitors.
To the extent these records are personal data, the intended basis is Article 6(1)(f) GDPR: proportionate service measurement and useful team statistics with data minimisation. You can object on grounds relating to your situation. No analytics cookie or other browser identifier is used for this measurement.
7. Abuse reports and administrative actions
Reports contain the reported address, category, free-text explanation and handling status; please include only relevant personal data. We process reports, review decisions, notifications, appeals and audit records to protect users, enforce proportionate service rules and handle unlawful content (Article 6(1)(f) and, where applicable, Article 6(1)(c) GDPR). Authorised MainSent operators can review these records; ordinary team membership does not give that access.
Detailed closed reports are eligible for deletion 30 days after final resolution or dismissal. An active dispute, preservation requirement or legal hold pauses cleanup until released. Minimal administrative action history is currently retained without a fixed expiry to investigate recurring abuse and provide accountability. This is not indefinite retention of full complaint text; the necessity and scope of this audit retention require review before public launch.
8. Service providers and international processing
FoxLink uses Vercel for the application and public Link Tree delivery, Cloudflare for edge redirects and queued click processing, Neon for the database, and Resend for transactional email. MainSent-operated storage/CDN infrastructure serves images in isolated FoxLink namespaces; MainSent-operated servers perform background processing, with independent monitoring on a Strato-hosted server. Sharing infrastructure does not give FoxLink access to MediaFox’s private media library.
Providers receive only the data needed for their role, such as connection data for delivery or a recipient address and email contents for sending. Authorised staff and providers supporting operations may access data as necessary. We may disclose information to authorities or legal advisers where legally required or necessary for legal claims; we do not sell personal data.
Review point before public launch: the exact contracting entities, processor agreements, processing locations, subprocessors and safeguards for transfers outside the EEA must be confirmed. This notice does not assert EU-only processing, an adequacy decision or an executed standard-contractual-clause arrangement without that verification. Contact the privacy address for the confirmed arrangements and applicable safeguards when available.
9. Storage and deletion
Account, team and published content records are kept while needed for the service, then deleted or minimised unless legal obligations, legal claims or a documented preservation need justify further retention. Request account closure or erasure through support or the privacy contact. Deleting a resource does not automatically delete a team shared with other members. Minimal identifiers remain reserved to prevent deleted addresses being assigned to someone else; this does not justify retaining all account details indefinitely.
Verification links expire after 24 hours, password-reset links after one hour, invitations after seven days, and ordinary sessions after seven days. Expiry stops use of a credential; physical cleanup may occur later. Processed click-event records become eligible for cleanup after 30 days; pending events are not purged by that rule. Daily aggregate statistics currently have no fixed expiry. Minute-level application metrics are cleaned up after 24 hours.
Unfinished uploads without a received file become eligible for cleanup after 24 hours; those with a received file after seven days of inactivity, subject to retries and holds. Completed library images are not removed merely because they are unused. Exact infrastructure log and backup deletion periods remain a review point; no immediate erasure of all provider backups is promised by this notice.
10. Your privacy rights
Subject to the statutory conditions, you can request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. If we rely on consent for a future optional activity, you may withdraw it at any time without affecting the lawfulness of earlier processing. We may need proportionate identity verification to protect your information.
Contact datenschutz@mainsent.com. We normally respond within one month; the GDPR permits an extension in certain cases, about which we will inform you. You may complain to a supervisory authority, including the authority at your habitual residence or workplace. MainSent’s local authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
11. Automated checks and decisions
Rate limits, bot estimates, availability checks and a team’s optional broken-link cleanup are automated operational functions. They are not used here to make solely automated decisions with legal or similarly significant effects on individuals under Article 22 GDPR. Content reports are reviewed by people; an affected user can ask support to review a restriction.
12. Updates to this notice
This version describes the current implementation, not planned billing, advertising or MediaFox integrations. We will update the notice when processing changes and communicate material changes appropriately. The version date is not evidence that a user accepted terms or consented to processing.