Version of 31 October 2026. This English version is a translation; the French version prevails.
This policy covers the Sharlinks platform: the site, the creator area, the publisher area and creators' links. Each app in the catalogue has its own privacy policy.
1. Data controller
JN STUDIO, SAS with a share capital of €10, RCS Paris 994 152 825, 60 rue François Ier, 75008 Paris, France. Contact: contact@sharlinks.com. We have not appointed a data protection officer, as our processing does not require one.
2. Data we process
Creators
- Account: identifier provided by Apple, Google, TikTok or Instagram, username, handle, avatar URL, e-mail address if the service provides it or if you sign in with an e-mail link, language, statement that you are 18 or over, version and date of the terms you accepted.
- Activity: campaigns joined and the version of their terms, links, clicks counted (aggregated), sales and net revenue reported by publishers, percentage applied, shares, rank and awards, Spark codes, links to videos and related decisions, reports and moderation decisions.
- Tax form, at your first withdrawal only: legal name, date of birth, address, country of tax residence, tax identification number and, where applicable, company and VAT numbers.
- Payment: identifier of your Stripe account, country, currency, verification and payout status, transfer history. Stripe may show us your name, your e-mail and the last digits of your bank account. We never receive your identity documents or your full account number.
Publishers: company name, registration, registered office, VAT, name and e-mail of the representative and of account users, campaign listing and visuals, sales reports, invoices, action log (Spark approvals, imports).
Visitors of creators' links: on each click, we count the click per link and per day, with the originating network (autonomous system number) and the referring page, to detect fraud. We set no cookie, do not keep the IP address and do not know who you are. The store only receives the campaign code in the address.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account, your campaigns, your link, calculating and paying your shares, the Spark bonus, our exchanges | Performance of the contract (Art. 6(1)(b)) |
| Managing the publisher account, the listing, invoicing | Performance of the contract (Art. 6(1)(b)) |
| Accounting, tax filings (including the annual return of platform operators, Art. 1649 ter A et seq. of the French General Tax Code), answers to authorities, handling reports of illegal content | Legal obligation (Art. 6(1)(c)) |
| Preventing fraud (abnormal clicks, self-purchases), securing access (Turnstile), checking advertising disclosures, publishing the ranking | Legitimate interest (Art. 6(1)(f)): paying creators fairly, protecting publishers, complying with the French law on commercial influence |
| Counting link clicks | Legitimate interest (Art. 6(1)(f)): calculating the shares due |
No decision producing legal effects concerning you is taken solely by automated means: automated checks flag, a person decides (suspension, refusal, sanction).
Public ranking: your username, your avatar and your rank may appear in the ranking visible to other creators. You can hide your username from your area; you remain ranked.
4. Recipients
- The managers of JN STUDIO who run the platform.
- Publishers of the campaigns you join: your username, your public link, your statistics on their campaign, your Spark codes and the links to your videos. They process them as separate controllers, for their own campaign only.
- Cloudflare, Inc., processor: hosting, database, storage of visuals, Turnstile, receiving and forwarding messages sent to contact@sharlinks.com. To improve bot detection, Cloudflare also processes Turnstile signals as a separate controller.
- Stripe: separate controller for the data you provide to it (identity, supporting documents, bank account), in particular for its identity verification and anti-money-laundering obligations, under its privacy policy; it acts on our instructions to carry out transfers.
- The third-party payer, where applicable: if a third party makes payments on our behalf, it acts as a processor; its identity is added to this policy before the first payment it makes.
- E-mail sending: as of the date of this version, e-mail link sign-in is not active and no e-mail sending provider is used. This policy will be updated before it is activated.
- Apple, Google, TikTok, Meta: only when you sign in with the service you choose, under their own policies.
- Our chartered accountant, and the tax authorities or any authority where the law requires it.
We do not sell your data.
5. Transfers outside the European Union
Cloudflare and Stripe may process data in the United States. These transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Decision (EU) 2023/1795) for certified entities, supplemented by standard contractual clauses. You can ask us for a copy.
6. Retention periods
| Data | Period |
|---|---|
| Creator account without payment | Up to 3 years after your last sign-in, then deletion |
| Creator who received payments: identity, tax form, amounts | 10 years (French Commercial Code, Art. L123-22; tax obligations) |
| Sign-in session | 180 days at most, daily purge of expired sessions |
| E-mail sign-in link | 15 minutes |
| Raw click data (network, referrer) | 30 days, then aggregated figures |
| Action log (admin, publishers) | 3 years |
| Spark codes and licence acceptance | End of the deal + 3 years |
| Reports and moderation decisions | 3 years after the decision |
| Publisher account | Duration of the relationship + 3 years; invoices 10 years |
| Listing visuals | Duration of the listing + 30 days |
If you delete your account, your username stays reserved so that it is never reassigned, and we keep only what the law requires.
7. Cookies and trackers
| Name | Purpose | Duration |
|---|---|---|
| session | Keep you signed in. First-party, not accessible to scripts (HttpOnly), sent over HTTPS only | 180 days at most, or until you sign out |
| lang | Remember the language you chose with the button | 13 months at most |
These trackers are strictly necessary for the service you request or remember a choice you made: they are exempt from consent (Article 82 of the French Data Protection Act). Your choice of light or dark mode is stored in your browser, for the same reason.
No audience measurement or advertising tool. The Apple, Google, TikTok and Instagram sign-in buttons are plain links: no script from these services is loaded before you click. Forms are protected by Cloudflare Turnstile, which analyses technical signals from your browser (including the IP address) to tell a human from a bot.
8. Your rights
You can access your data, rectify it, erase it, object to processing based on legitimate interest (for example the display of your username in the ranking), request its restriction or portability, by writing to contact@sharlinks.com from the address or account used. We reply within one month. For data held by Stripe, you can also contact Stripe. You can lodge a complaint with the CNIL (www.cnil.fr) or with the authority of your country.
Account data is necessary to take part; the tax form is required by law to receive a payment: without it, we cannot pay you.
9. Security
Encrypted connection (HTTPS), protected session cookie, single-use, short-lived sign-in links, administration area protected by Cloudflare Access, rate limiting of repeated attempts, log of administration actions.
10. United Kingdom, Switzerland, Canada
United Kingdom: as of the date of this version, we have not appointed a representative within the meaning of Article 27 of the UK GDPR. UK residents exercise their rights with us at contact@sharlinks.com and may complain to the Information Commissioner's Office (ico.org.uk). Residents of Québec: the person in charge of the protection of personal information is the president of JN STUDIO, reachable at contact@sharlinks.com.
11. Changes
In the event of a significant change, we notify you in your area before it takes effect. Previous versions remain available.