Privacy Policy

• Controller: the party that determines the purposes and means of processing.
• Processor: the party that processes data on behalf of the controller.
• Customer: the entity that subscribes to a Linkato account.
• Subscriber/Contact: a person in the lists uploaded or managed by the Customer.
• GDPR: Regulation (EU) 2016/679.

The data controller is AMAZ ONLINE SRLS, with registered office at Via Raffaello Sanzio 23, 62027 San Severino Marche (MC), Italy, registered with the Registro Imprese delle Marche under registration and Italian tax code 01851090439, VAT 01851090439, REA MC - 187091, certified email amazonlinesrls@pec.it. For any privacy request you can write to privacy@linkato.ai.

• Account data: name, email, password (hashed), organization and role.
• Billing data: company name, address, tax and payment details, handled by our payment provider.
• Usage and diagnostic data: technical logs, IP address, browser type, pages visited, product events.
• Customer list data: contacts and related fields uploaded or synced by the Customer, processed as a processor.
• Deliverability data: opens, clicks, bounces and unsubscribes for sent emails.
• Cookies and similar technologies (see the Cookie Policy).

• Provide and maintain the service — performance of the contract.
• Billing and tax compliance — legal obligation.
• Security, abuse prevention and product improvement — legitimate interest.
• Service communications and, with consent, marketing messages — consent/legitimate interest.

For account and website-visitor data we act as a controller. For the contact data a Customer uploads and sends through Linkato we act as a processor: the Customer is the controller and determines the purposes and legal bases. Processing as a processor is governed by the Data Processing Agreement (DPA).

We do not sell personal data. We rely on selected vendors that process data on our behalf, including (indicative list, subject to updates):

• Amazon Web Services (AWS SES) — email sending and infrastructure.
• Cloudflare — DNS, CDN and asset storage (R2).
• Stripe — payments and billing.
• OpenAI and/or Anthropic — AI-assisted composition features.
• Hosting and queue/cache provider EU-based hosting providers.

Where data is transferred outside the European Economic Area, we apply appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the vendor’s adherence to recognized frameworks (e.g. the EU-U.S. Data Privacy Framework).

We retain account data for the duration of the relationship and, after deletion, for as long as needed to meet legal obligations (typically 12 months). Data processed as a processor is retained per the Customer’s instructions and the DPA.

We apply appropriate technical and organizational measures (encryption in transit, access controls, monitoring) to protect data against unauthorized access, loss or misuse. No system, however, is entirely free of risk.

Under the GDPR you may exercise the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to lodge a complaint with the competent supervisory authority.

To exercise your rights write to privacy@linkato.ai. If the data relates to a list managed by a Customer, please contact that Customer directly, as the controller.

We use cookies and similar technologies as described in the Cookie Policy, where you can manage your preferences.

The service is not intended for children under 16 and we do not knowingly collect their data.

We may update this policy. For material changes we will provide notice through the service or by email and update the date at the top of this document.

For privacy questions or to exercise your rights: privacy@linkato.ai — AMAZ ONLINE SRLS, Via Raffaello Sanzio 23, 62027 San Severino Marche (MC), Italy.