Privacy Policy

Data controller and contact

Data controller: LentoCircle.

For privacy questions or personal data requests, use the form on the Contact page.

Data we process

• Account and security data: display name, email address, optional account profile photo, email verification status, password hash, session token and expiry, and IP address or browser information that may be received during a session.
• Short links: YouTube destination type and ID or Smart Link destination URL, short URL, creation time, and a hash of the key used to manage the link.
• Click reports: click time, browser information, referring domain, and country code when available. We do not store the full referrer URL.
• Abuse prevention: a keyed hash of the IP address used for rate limiting, request counters, and counter expiry. The rate-limit table does not store raw IP addresses.
• Bio pages: display name, description, link labels and URLs, profile image, visibility, and appearance preferences.
• UTM campaigns: destination and final URLs, source, medium, campaign, term, content, and creation time.
• Revenue Tracker campaigns: campaign name, brand, type, amount in TRY, start and end dates, optional short link, and notes.
• Contact requests: name, email, subject, message, and follow-up correspondence.
• Site analytics: public page paths with query parameters removed, referrer, device type, operating system, browser, and approximate location. Account pages, Bio profiles, and short-link URLs are excluded.

Purposes and legal grounds

We process data to create accounts and sessions, verify email addresses and reset passwords, operate the tools, store your records, show click reports, respond to support requests, understand overall site usage, and prevent abuse.

Processing is based, as applicable, on taking steps to provide the service you request or performing a contract, our legitimate interest in securing and operating the service, legal obligations, and other grounds available under the Turkish Personal Data Protection Law (KVKK). We do not use advertising tracking or advertising cookies.

Public Bio pages and links

If you make a Bio page public, its display name, description, profile image, and links are visible to anyone who knows the page address. Private Bio pages do not show their content to visitors. Your account email and account settings photo are not published on a Bio page; you select a separate Bio image.

OneTap short links are public so they can redirect visitors and produce click reports. Do not include sensitive or directly identifying information in UTM links.

Retention, deletion, and security

You can delete your account from Settings after confirming with your current password. The account’s profile photo, Bio pages, UTM and revenue campaigns, short links, and associated click records are also deleted. Contact us about other records; records required by law may be retained for the applicable period.

Rate-limit counters are used only for a short window, and expired counters are regularly removed.

Short links created without an account are deleted after 30 days without a click, or 30 days after creation if they have never been clicked. Account-linked links are not affected. Detailed click records are retained for 30 days and then deleted. Aggregate YouTube link and click counts shown on the home page are retained.

Passwords are not stored in plain text. Session and management keys are processed to restrict access and protect records from unauthorized use. No internet transmission can be guaranteed to be completely risk-free; reasonable technical and organizational safeguards are applied.

Tools that run on your device

Phone numbers, prepared messages, and contact details entered in the WhatsApp Link and QR Code modules are used in your browser to create a link, QR code, or vCard. These field values are not sent to LentoCircle’s servers.

Service providers and transfers

To operate the service, data may be shared with Turso for database infrastructure; Resend for verification, password reset, and contact emails; Vercel Web Analytics for site statistics; and providers that host and secure the site. Each provider’s processing is limited to the relevant service.

Server locations and the conditions for international transfers depend on the deployment configuration. Before launch, the data controller should verify the selected providers and transfer mechanism.

Cookies and browser storage

Essential session cookies are used to keep signed-in users authenticated and secure. Site views are measured with Vercel Web Analytics, which states that it operates without cookies and uses anonymized statistics. Query parameters, account pages, Bio profiles, and short links are not sent to this analytics measurement.

Browser storage may remember that an information notice was dismissed and help manage links created while signed out. OneTap click measurement uses service redirect logs, not cookies.

Your rights under KVKK and how to apply

Under Article 11 of KVKK, you may ask whether your personal data is being processed, request information about processing and recipients, seek correction of incomplete or inaccurate data, request deletion or destruction when the legal conditions are met, and exercise other rights provided by law.

Submit your request through the Contact form and include the information needed to understand it and respond securely. Requests are handled within the procedures and time limits set by applicable law.

Updates

This policy may be updated when the service or data-processing practices change. We may also notify users of material changes in the app or by email.