Privacy policy

1. Who we are

Jinty is operated by ECom24 Ltd, a company registered in Scotland, United Kingdom under number SC276560, with its registered office at Jinty.store, Hamilton House, ML10 6SY, UK. We are registered with the Information Commissioner's Office under ZC089157.

For the personal data described in section 3, we are the data controller. For the personal data described in section 5, which is a creator's own audience, the creator is the controller and we act for them. That distinction matters, and section 5 explains it.

If you have a question about any of this, write to hello@jinty.store.

2. Who this policy is about

Three different people appear in this policy, and different parts apply to each.

• Creators are people who sign up for a Jinty account and publish a link-in-bio page. Sections 3, 4, 6, 7 and 11 are mostly about you.
• Visitors and buyers are people who visit a creator's link-in-bio page, leave their email address for something, or buy a product. Sections 4, 5 and 8 are mostly about you, and the creator whose page you were on is the one who holds your details.
• Everyone else covers people who visit jinty.store itself. Sections 4 and 9 apply.

3. What we collect about creators

3.1 Your account. Your name, your email address and a password, which is stored hashed and never in a form we can read. If you change your email address we hold the pending address until you confirm it.

3.2 What you put on your link-in-bio page. Your display name, your username, your bio, your profile photo, your links, your theme choice, and the products you create, with their titles, descriptions, prices, cover images and the files you upload for delivery. This is all published material once your link-in-bio page is live, so treat it as public.

3.3 How you use Jinty. Which surfaces you open, what you publish, your usage against the free plan's limits, and the actions you take in the app.

3.4 Marketing consent, where you give it. See section 7.

3.5 Technical data. IP address, browser and device type, and timestamps, in server and security logs. We use these to run and defend the service.

3.6 What we do not collect. We do not ask for a phone number. We never see or hold your card details or your buyers' card details. See section 8.

4. Cookies, and how we count visits

4.1 The cookies we set. Only the ones the service needs: a session cookie that keeps you logged in, the security token that protects forms against cross-site request forgery, and small preferences such as whether you have dismissed the cookie notice. There are no advertising cookies and no third-party tracking cookies on Jinty.

4.2 Our audience statistics are cookieless. When someone views a creator's link-in-bio page or clicks one of its links, we record that it happened, along with which page, which link and which day, so the creator can see what is working. We set no cookie to do it and we do not store the visitor's IP address. To count each person once a day rather than every refresh, we use the session cookie your browser already holds from us if it has one, and otherwise a short-lived keyed hash of your connection that cannot be turned back into an address; neither is kept beyond that day. The counts are aggregate; they are not a profile of anybody, and they cannot be used to follow a person from one creator's page to another's.

4.3 The cookie notice on our public pages says the same thing in one line, and links here.

4.4 Cloudflare Turnstile. Our sign-up and sign-in forms use Cloudflare Turnstile to tell people from bots. It works without cookies where it can, and Cloudflare processes technical signals from your browser to make that judgement.

4.5 Counting visits to our own pages. On our landing and site pages we use Cloudflare Web Analytics to count visits. It sets no cookie and stores no personal information. It does not run on creators' link-in-bio pages or product pages.

4.6 Getting help. The help button in the app and on our landing is provided by Help Scout. What you write there goes to Help Scout so we can reply, and the button keeps a small identifier in your browser so the conversation is still there after a reload.

4.7 How the app is used. Inside the creator app we use PostHog, hosted in the EU, to see which steps people complete and where they get stuck. It sets no cookie, records no session replays, and knows you only by your account number. It does not run on creators' link-in-bio pages or on our landing pages.

5. A creator's audience, and whose data it is

This section is the one that most needs to be clear.

5.1 When you leave your email on a creator's page, or buy something from them, you are giving your details to that creator. They decide what to do with them. In data-protection language, the creator is the controller of their contacts.

5.2 Our role is to hold and handle those details for the creator: to store them, show them to the creator in their account, let the creator export them, and send the delivery email. We do that on the creator's instruction and for no purpose of our own. In data-protection language we are their processor.

5.3 What that means if you are a buyer or a subscriber. If you want your details corrected, or removed from a creator's list, ask the creator first. They are the ones who hold them, and the checkout and the delivery email both tell you how to reach them. If you cannot get anywhere, write to us at hello@jinty.store and we will help where we can.

5.4 What we collect for a creator. The email address given, a name where the form asked for one, which card or product it came from, when, what was claimed or purchased, and the marketing consent record described in section 7.

5.5 We do not market to a creator's contacts. Their list is not our list. We do not email a creator's audience about Jinty, and we do not add them to anything of ours.

5.6 Contacts a creator adds themselves. A creator can add a contact by typing in a name and email address. The creator is responsible for having that person's permission to do so. Any marketing consent recorded that way is the creator's own record of what the person told them, and we store it with the date and time.

5.7 If a creator connects an email tool. Where a creator connects Email Octopus, Kit, MailerLite or beehiiv to their account, contacts who gave marketing consent are sent to it: their email address, a first name where we have one, where they came from, and the date and wording of their consent. That provider is a service the creator has chosen and instructed, not ours, and it holds that data under its own terms with the creator.

6. What we use creator data for

• Running the service: your account, your published pages, your products and your files.
• Delivering what your buyers bought: sending the download link or the redirect on your behalf.
• Talking to you about your account: verification, password resets, security notices, and changes to these documents. These are not marketing and you cannot opt out of them while you hold an account.
• Keeping the service working and safe: error reports, abuse and fraud prevention, moderation of reported content, and enforcing our terms.
• Improving Jinty: understanding, in aggregate, which parts get used.
• Marketing, only where you have said yes: see section 7.
• Meeting our legal obligations.

7. Marketing email, and how consent is recorded

7.1 It is a separate, unticked box. The invitation to hear from us is never bundled into accepting the terms, and it is never ticked for you. Not ticking it costs you nothing.

7.2 We record the evidence, not just a yes. When you tick it we store the exact wording you agreed to, the surface you agreed on and the time you did it. If we ever email you, that record is what we are relying on.

7.3 Delivery email is different. When someone claims a file or buys a product, the email carrying it is transactional: it is the thing they asked for, and it is sent whether or not they ticked any marketing box. The form says so at the point of asking.

7.4 We use Mailgun for transactional email and Email Octopus for our own marketing list, which only contains creators who opted in. Where consent applies, the consent wording and its date travel with the record so the list carries the permission it is acting on.

7.5 You can withdraw consent at any time. Use the unsubscribe link on any marketing email, or write to hello@jinty.store.

8. Payments

8.1 We are never the merchant of record. Where a creator sells through Jinty, they connect their own Stripe account and their buyer pays on Stripe's own hosted payment page. We never see, handle or store card details, and the money never passes through us.

Stripe processes the payment as the creator's own provider, under Stripe's terms and privacy policy. We receive back from Stripe only what we need to complete the order: that a payment succeeded, and the buyer's name and email address so we can deliver the purchase and put them in the creator's contacts.

8.2 If you subscribe to the Seller plan, you are buying from us, and we are the seller. You pay on Stripe's own hosted payment page and on Stripe's own billing screen, and we never see, handle or store your card details. What we send Stripe is your email address, so your receipts and invoices reach you, and an internal reference for your account. What we keep is a Stripe customer reference, a subscription reference, whether the subscription is running, which of the two billing periods you chose and when the current one ends. We do not keep your card, your billing address or your invoices; those are on Stripe's billing screen, which you reach from the Plans page. Stripe processes this under its own terms and privacy policy.

Stripe's privacy policy: stripe.com/privacy

9. Who else touches the data

We do not sell personal data, and we do not share it for anyone else's marketing. These are the services that process data because they run parts of Jinty:

We may also disclose data where the law requires it, to protect our rights or someone's safety, or to a buyer of the business if Jinty is ever sold, in which case we would tell you.

9.1 These providers keep their own rules. Each one is a business in its own right, with its own terms and its own privacy policy. We chose them and we send them the data listed above, but we do not control what they do beyond that. Their own terms and policies govern your relationship with them, not this one. The links above are their privacy policies. If you are a creator and you connect Stripe to take payments, you also accept Stripe's own Connected Account Agreement, which sets out your relationship with Stripe as a payments provider, separately from ours with you: stripe.com/legal/connect-account.

10. Where the data goes

Some of these providers operate outside the United Kingdom. Where personal data is transferred out of the UK, we rely on the appropriate safeguards: an adequacy decision where one exists, or the UK International Data Transfer Agreement or the EU standard contractual clauses.

11. How long we keep things

11.1 While your account is open, we keep your account data, your published content and your contacts for as long as you have the account.

11.2 Visit and click events hold no IP address and no cookie, only what was visited or clicked and on which day. They are kept for as long as your account is open, so your visitor figures keep working, and are purged with the rest of your data after deletion.

11.3 When you delete your account, read this first. Deletion unpublishes your link-in-bio page and every product page immediately: they return "not found" and your session ends.

11.4 The 30-day hold. For 30 days after deletion, we keep your account rather than erasing it. If you deleted by mistake, write to hello@jinty.store within that window and we can reverse it. Your username stays reserved throughout. It is not personal data, and holding it does not keep anything about you.

11.5 After 30 days, your personal data is purged. Your account record, your contacts and your uploaded files are erased. The one exception is purchase records, where they exist: UK tax and limitation rules require us to keep a minimal record of a purchase for six years, cut down to what that record needs. It does not include your account, your files or anything beyond it. Your email address is released as soon as you delete, so you can register again with it straight away.

We are saying all of this plainly because the word "permanent" in the app means you cannot recover the account yourself, not nothing is kept. If you want your data erased sooner than the 30-day hold ends, ask us at hello@jinty.store. See section 13.

11.6 Logs, error reports and financial records are kept for as long as we need them to run and defend the service, or for as long as the law requires.

12. Keeping data safe

Everything travels over HTTPS. Passwords are hashed with a modern algorithm and are never stored in readable form. Uploaded files are held in private storage and delivered through short-lived links, not public URLs. Access to production data is limited to the people who need it. Forms are protected against automated abuse with Cloudflare Turnstile, and against cross-site request forgery.

No system is perfectly secure. If a breach affects you and the law requires it, we will tell you and the ICO.

13. Your rights

Under UK and EU data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• erase it under the right to be forgotten;
• restrict what we do with it;
• give it to you in a portable form, or send it to someone else;
• stop processing it where we rely on our legitimate interests;
• withdraw consent where consent is what we rely on. Withdrawing does not undo anything done before you withdrew.

Creators can export their own contact list from the app at any time without asking us.

To exercise any of these, write to hello@jinty.store. We will answer within one month. If your request is about a creator's contact list, please read section 5 first. The creator holds that data and we will usually need to pass your request to them.

Complaints. If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

14. If you are in California

You have the right to know what personal information we collect and why, to ask us to delete it, to opt out of its sale, and not to be treated worse for exercising any of those rights. We do not sell personal information. Use hello@jinty.store.

15. Children

Jinty is not for children. You must be at least 18 to hold an account, and we do not knowingly collect data from anyone younger. If you think a child has given us their details, tell us at hello@jinty.store and we will remove them.

16. Changes, and how to reach us

We may update this policy. If a change materially affects you, we will tell you by email or by a notice in the app before it takes effect, and the date at the top will change.

ECom24 Ltd, Jinty.store, Hamilton House, ML10 6SY, UK. Privacy enquiries and rights requests: hello@jinty.store.