Itulinks Privacy Policy
Last updated: 3 November 2026
This policy explains how Pereowei Itu, a sole trader trading as Itulinks ("Itulinks", "we"), handles personal data. It covers:
- artists and managers who use the dashboard;
- fans who visit artist pages and release links on itul.ink;
- anyone who contacts us or joins our newsletter.
We follow the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive (GAID) 2025. Where they apply to you, we also follow the EU and UK GDPR.
1. Who we are and how to reach us
- Controller: Pereowei Itu, trading as Itulinks, Yenagoa, Bayelsa State, Nigeria
- Data Protection Officer: the owner, reachable at privacy@itulinks.com
2. What we collect
Artists, managers and labels (account holders)
| Data | Source |
|---|---|
| Email address and a securely hashed password | You |
| Account type, the date you confirmed you're 18+ and accepted the Terms, and your "Feature me" and email choices with the dates you made them | You |
| Sign-in records: the IP address, browser and time of each login, kept by our sign-in provider for security | Automatic |
| Artist name, link name, bio, photo, social handles, custom links, releases, cover art, theme | You |
| Your settings (time zone, dashboard view, theme) | Your browser |
| Records of verification requests and support conversations | You |
Fans and visitors on artist and release pages
For each page view or button tap we record:
- the page, release or button, and the platform tapped;
- the type of source (for example "instagram", "tiktok" or "direct");
- the device type (mobile, tablet or desktop);
- the country, as estimated by our hosting provider;
- the date and time.
We don't store IP addresses or full browser details for analytics. We don't set cookies on fans and don't build profiles of individual visitors. To stop spam and fake traffic, we briefly count requests using a one-way hashed version of the IP address. The hash can't be turned back into the address and expires within minutes.
People who contact us or join the newsletter
- Name, email, artist or company name, role, roster size and message.
- A hashed IP address, used only to limit spam.
Coming soon (we'll update this policy before launch)
- Email capture and pre-saves for artists.
- Optional tracking pixels that artists add to their own pages.
- Google Analytics on itulinks.com.
- Paid plans.
Each will be described here, and will ask for consent where the law requires, before it goes live.
3. Why we use it, and the lawful basis
| Purpose | Data | Lawful basis (NDPA s.25; GDPR Art. 6) |
|---|---|---|
| Create and run your account and pages | Account data, page content | Contract |
| Send account emails (sign-up confirmation, password resets, security and policy notices) | Email address | Contract |
| Keep accounts secure and spot unauthorised logins | Sign-in records | Legitimate interests (security) |
| Show artists analytics about their pages | Page view and tap records | Legitimate interests (helping artists understand their audience in a privacy-friendly way) |
| Check links for phishing and malware | The link URLs you add | Legitimate interests (keeping fans safe) |
| Stop spam, abuse and fake traffic | Hashed IP, account activity | Legitimate interests |
| Answer messages and quote requests | Contact details, message | Steps before a contract / legitimate interests |
| Send our newsletter and marketing emails (product news, tips and occasional offers) | Email address, name or artist name, and when you opted in or out | Consent: an unticked box at sign-up or in Profile, or the newsletter's confirm-by-email step. Unsubscribe any time. |
| Feature artists in our marketing | Name, photo, pages | Consent (the "Feature me" opt-in) |
| Prevent and investigate fraud and abuse, and answer lawful requests from police or courts, including after an account is deleted | The deleted-account record (see section 6) | Legitimate interests (protecting fans, artists and the Service) / legal obligation |
| Meet legal duties and handle disputes | As needed | Legal obligation / legitimate interests |
We don't sell personal data. We don't use it for profiling that has legal or similarly significant effects. We don't share it with advertisers.
Our data firewall. The owner of Itulinks also runs a record label. Itulinks data about artists, their pages and their fans is never shared with, or used by, that label.
4. Who we share it with
We use these service providers (processors). Each has a contract with us that limits how they use the data:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | Ireland (EU) |
| Vercel | Website hosting and delivery | Global edge network; functions in the UK |
| Web fonts; Web Risk link safety checks (if enabled) | Global / US | |
| Resend | Sending account emails; storing our mailing list and sending newsletter and marketing emails | EU sending; contact list in the US |
| Upstash | Short-term spam and rate-limit counters (hashed IPs only) | EU |
| Sentry | Error reports: what broke, the page, browser and device type. No IP addresses, cookies or form contents. | EU (Germany) |
| Unsplash | Photos on our marketing pages, loaded from their servers | Global |
To match releases, we send the song link, title and artist name to music services such as Spotify, Apple and Deezer. We don't send your personal details.
When a fan taps a platform button they leave Itulinks, and that platform's own privacy policy applies.
We may also disclose data:
- if the law or a court requires it;
- to protect people's safety or our rights;
- as part of a merger or sale of the business, in which case this policy continues to apply.
We plan to register Itulinks as a company. When we do, that company will become the controller of your data under this same policy, and we'll tell account holders by email.
5. International transfers
Some providers process data outside Nigeria, in the EU, the UK and the US. We rely on the NDPA's transfer rules (ss.41–43) and on the providers' Standard Contractual Clauses and security measures. You can ask for a copy of the safeguards at privacy@itulinks.com.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account and page content | While your account is open. When you delete your account it goes offline at once and can be restored for 30 days. After that it's erased, and removed from backups within a further 30 days. |
| Deleted-account record: your email, link name, display name, account type, sign-up, last sign-in and deletion dates, and copies of the profile, links and releases you published, plus total view and tap counts (no individual fan records) | 2 years after erasure, or 3 years if the account was suspended or had content blocked for safety. Kept private, used only for fraud and abuse investigations and lawful requests, then deleted. |
| Page view and tap records | 25 months, then deleted |
| Quote requests and messages | 24 months after our last contact |
| Mailing list (newsletter and marketing emails) | Until you unsubscribe or your account is erased. We keep the date you opted in or out as proof of consent. |
| Hashed IP counters | Minutes to 1 hour |
| Sign-in records (IP address, browser, time) | 90 days, then deleted |
| Verification and dispute records | 3 years after the matter closes |
7. Your rights
You can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict how we use it, or object to it;
- send it to you, or to another service, in a portable format;
- stop direct marketing at any time. Every marketing email has an unsubscribe link, and artists can switch off Email me news and tips in Profile.
These rights come from NDPA ss.34–38 and GDPR Arts. 15–22. You can withdraw consent at any time; this doesn't affect anything done before you withdrew.
- Artists can download a copy of their data under Profile → Download my data, and delete their account under Profile → Delete account. We keep the limited deleted-account record described in section 6, because we have a legitimate reason to (fraud and abuse investigations). You can object to this by emailing us, and we'll review your request.
- Everyone else, email privacy@itulinks.com. We reply within 30 days. We may need to confirm your identity first.
If you're unhappy, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng). If you're in the EU or UK, you can complain to your local data protection authority.
8. Children
- The Service is for adults. Teen artists (13–17) may only have a page run by a parent, guardian or manager (see the Terms).
- We don't knowingly collect data from children under 13. If we learn that we have, we delete it.
- Contact us if you think a child has given us data.
9. Security
- Data is encrypted in transit and at rest.
- Passwords are hashed by our sign-in provider. When you choose a password we check it against a list of passwords exposed in data breaches (Have I Been Pwned). Only the first 5 characters of a one-way hash leave our server, never your password.
- Database access is limited with row-level security, so artists can see only their own data.
- Admin accounts use two-factor authentication.
- Links are checked against public lists of phishing and unsafe sites.
- If a breach puts your rights at risk, we will tell the NDPC within 72 hours (NDPA s.40) and tell you without undue delay.
10. Cookies
We use only essential and preference cookies. See the Cookie Policy.
11. Changes
We'll update the date above when this policy changes. For material changes we'll notify account holders by email or in the dashboard at least 14 days in advance, unless the change is required by law.