Privacy Policy

1. Who we are

exclusively.me is operated by Exclusively Me Ltd, a company registered in England and Wales (company number 17458606), registered office 167-169 Great Portland Street, London, England, W1W 5PF. We are the data controller for the personal data described in this policy. Full company details are also on our Contact page.

If you have questions about your data, contact us at [email protected].

2. What we collect

We only collect what we need to run the service and make it better. Here's the full picture:

Account data

Data	Why	Lawful basis
Username	Your unique URL and identity on the platform	Contract
Email address	Account access, notifications, service updates	Contract
Password (hashed)	Securing your account — we never store your actual password	Contract
Avatar image	Displayed on your page	Contract
Timezone	Scheduled content timing	Contract

Page content

Data	Why	Lawful basis
Display name, bio	Shown on your public page	Contract
Links (titles, URLs, icons)	The content you choose to share	Contract
Theme preferences, custom CSS	Personalising your page's look	Contract
Scheduled content	Timed updates to your page (Pro)	Contract

Usage and analytics data

Data	Why	Lawful basis
Page views (timestamp, page visited)	Analytics for you and service improvement	Legitimate interest
Link clicks (which links, when)	Analytics for you and service improvement	Legitimate interest
Referrer URLs	Understanding how visitors find your page	Legitimate interest
Country (derived from IP)	Geographic analytics, localised pricing	Legitimate interest
User agent string	Device and browser analytics	Legitimate interest
IP address	Security, rate limiting, geographic lookup — then discarded	Legitimate interest

3. How we use your data

We use your data for these purposes:

• Running the service — displaying your page, processing logins, managing your account. This is what you signed up for.
• Analytics — showing you (and us) how pages perform. Pro users get detailed analytics; we use aggregate data to improve the platform.
• Security — rate limiting, fraud prevention, protecting accounts.
• Service improvement — understanding usage patterns to build better features.
• Aggregated insights — we create anonymised, aggregated statistics from platform usage (e.g. trending link types, popular categories, geographic reach patterns). These insights contain no personal data and cannot identify you. We may share or publish these insights, or make them available to third parties.
• Communications — transactional emails (password resets, verification) are sent as part of the service. We may send occasional product updates — you can opt out at any time.

Free tier and data use

Our free tier is genuinely free — you're not the product. However, we do use aggregated, anonymised platform data (trends, statistics, usage patterns) to improve the service and to share insights with partners. This data is stripped of anything that could identify you personally.

We will never sell your personal data. Full stop. What we may do is share anonymised, aggregated statistics — things like "40% of pages include an Instagram link" or "UK-based pages average 12 links." This helps us grow the platform and keep the free tier free.

4. Lawful bases explained

Under UK GDPR (including amendments from the Data Use and Access Act 2025), we rely on these lawful bases:

• Contract — processing that's necessary to provide the service you signed up for. Without this data, we can't give you your page.
• Legitimate interest — processing that benefits both you and us (analytics, security, service improvement). We've conducted balancing tests for each use and concluded that these activities don't override your rights. You can object to any legitimate interest processing — see Section 9.
• Consent — where we rely on consent (e.g. marketing emails), we'll ask clearly and you can withdraw at any time.

5. Who we share data with

We keep your data close. Here's who might see it:

• Hosting and infrastructure providers — to run the servers your page lives on. They process data on our behalf under strict data processing agreements.
• Payment processor (Stripe) — if you upgrade to Pro, Stripe handles your payment. We never see or store your card details. Stripe acts as an independent controller for payment data.
• Email service provider — to send transactional emails (verification, password resets). They process data on our behalf.
• Google Analytics — only if you accept analytics cookies (Section 8). It tells us how people reach our marketing pages. It is not loaded on your public page.
• Analytics and insight partners — we may share anonymised, aggregated statistics with third parties. This data cannot identify you.

We do not sell personal data to anyone. We do not provide your email to advertisers. We do not let third parties track you on our platform.

6. International transfers

We primarily process data within the UK. Where we use service providers based outside the UK, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or adequacy decisions by the UK Government.

7. How long we keep your data

Data	Retention
Account data	For the life of your account, plus 60 days after deletion request
Page content and links	For the life of your account, plus 60 days after deletion request
Page view and click data	Rolling 24 months, then aggregated and anonymised
IP addresses	Discarded after geographic lookup — not stored long-term
Audit records	Retained indefinitely (contains no personal content — account lifecycle events only)
Hashed email (post-purge)	Retained indefinitely for fraud prevention — cannot be reversed to your email

When you delete your account, we soft-delete it for 60 days (so you can change your mind), then permanently purge your personal data. A minimal audit record is kept for fraud prevention — it contains a one-way hash of your email and basic account metadata, nothing more.

8. Cookies

We keep cookies minimal. These three are essential and need no consent:

• Session cookie — keeps you logged in. Expires when you log out or after a period of inactivity.
• CSRF token — protects your forms from cross-site attacks.
• Cookie choice (em_consent) — remembers the answer you gave the banner below, for six months, so we don't ask again on every page.

One cookie is not essential, and we only set it if you say yes:

• Google Analytics (_ga, _ga_*) — tells us how many people visit our marketing pages and how they found us. Google Ireland Limited processes this on our behalf, and data may be transferred outside the UK under the safeguards described in Section 6. Advertising and personalisation features are switched off, so this is never used to target ads at you or to follow you around other websites.

Until you choose, the analytics cookie is not set and Google receives nothing that identifies you. You can change your mind whenever you like:

Change your cookie choice

Your public page is a cookie-free zone. Analytics cookies and the consent banner appear on our own pages — marketing, sign-in and your dashboard. They are never loaded on exclusively.me/yourname, so nobody visiting your page gets a cookie banner from us. The visitor numbers we show you in your dashboard are counted on our own servers and use no cookies at all.

9. Your rights

Under UK GDPR, you have the right to:

• Access your data — request a copy of everything we hold about you.
• Rectify inaccurate data — you can update most data directly from your dashboard, or ask us.
• Erase your data — delete your account from Settings. We'll purge your personal data after the 60-day cooling-off period.
• Export your data — download a machine-readable copy of your data from your dashboard (JSON format).
• Object to processing based on legitimate interest — we'll stop unless we have compelling grounds that override your rights.
• Restrict processing — ask us to pause processing while we resolve a concern.
• Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting prior processing.

To exercise any right, email [email protected]. We'll respond within 30 days.

10. Children

exclusively.me is not designed for anyone under 13. If you're under 13, please don't create an account. If we learn that we've collected data from a child under 13, we'll delete it promptly. If you're between 13 and 18, we recommend getting a parent or guardian's OK before signing up.

11. Security

We take security seriously. Passwords are hashed using PBKDF2-SHA256 with 600,000 iterations — industry-recommended strength. We enforce HTTPS everywhere, use secure session cookies, and offer two-factor authentication on all accounts. No system is perfectly secure, but we work hard to protect your data.

12. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll notify you by email or via a notice on the platform before the changes take effect. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Complaints

If you're unhappy with how we handle your data, please contact us first at [email protected] — we'd genuinely like to sort it out. If we can't resolve your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

14. Contact

Exclusively Me Ltd
Registered in England and Wales, company number 17458606
Registered office: 167-169 Great Portland Street, London, England, W1W 5PF
Email: [email protected]
ICO registration number: [pending]