Privacy Policy

This Privacy Policy explains what personal data ZUDOKO ("we," "us") collects through QukLink, why, and how you can control it. It applies to everyone who visits a public QukLink profile or creates an account. It should be read together with our Terms of Service and Cookie Policy.

Account information: email address; a password hash (never the plaintext password); if you sign in with Google, your Google account ID and the email address on that account.

Profile information you provide: display name, username, bio, profession, location, avatar and cover images, social links, custom call-to-action buttons/URLs, and custom domains.

Content you create: activity posts, links, shop product listings, and digital file downloads.

Messages: if you contact a creator through their profile, we store the message content and contact details provided.

Usage & analytics data: when someone views a profile or clicks a link/product, we log: the visitor's IP address, country/city, coarse device type, browser, referring website, and timestamp.

Security & moderation logs: administrative actions and rate-limiting metrics are logged with the admin's ID, action details, and IP address.

Push notification tokens: if you enable browser push notifications, we store the device registration token issued by Firebase Cloud Messaging, so that we can deliver notifications to that browser. You can revoke this at any time by turning notifications off in your dashboard or in your browser settings.

Cookies: see our Cookie Policy for the full list.

• To create and secure your account, and authenticate your sessions.
• To display your public profile, activities, links, and Shop listings to visitors.
• To send transactional emails: account verification, password reset, and admin sign-in links.
• To operate the in-app messaging feature between visitors and creators.
• To generate the analytics dashboard shown to you about your own profile's traffic.
• To detect abuse, enforce rate limits, and investigate security incidents.
• To send notification emails to a creator's subscribers when that creator publishes new content, where those subscribers have opted in by subscribing to the creator.
• To send occasional service announcements, such as notice of material changes to these policies.
• To process Premium subscription billing and Shop checkout via Dodo Payments & Stripe.

We use essential cookies to keep you signed in, plus (only with your consent, via the cookie banner) analytics for aggregate usage insights. Full details, including exactly which cookies exist and how to change your preference at any time, are in our Cookie Policy.

We share data with the following providers strictly to operate the Service. None of them are permitted to use your data for advertising purposes:

• Google Analytics: aggregate traffic and behavior analytics across the Service.
• Microsoft Clarity: session-replay and heatmap analytics to help us improve the product.
• Google OAuth: if you choose "Sign in with Google," Google authenticates you and shares your account ID and email with us.
• ZeptoMail (Zoho): delivers transactional emails (verification, password reset, admin sign-in).
• Bunny.net: stores and serves optimized uploaded images and media via a global CDN.
• Dodo Payments & Stripe: process Premium subscription billing and Shop digital product checkout. We do not receive or store full card details.
• Sentry: monitors application performance and captures application error traces to ensure high uptime and security.
• Upstash (Redis): powers rate-limiting; stores short-lived counters keyed by IP address or account ID.
• MongoDB Atlas: primary database host.
• Calendly: if you connect your Calendly account, we store your Calendly OAuth access and refresh tokens, username, and user/organisation URIs to display your booking widget on your profile.
• Cal.com: if you use a Cal.com booking link on your profile, booking events are received via webhook to track appointment confirmations.
• Payhip: where a creator uses a Payhip checkout link, Payhip processes that purchase and notifies us of completed sales by webhook.
• Firebase Cloud Messaging (Google): delivers browser push notifications, if you enable them. Google receives the device registration token required to route the notification.

We do not sell your personal data. We share it only with the service providers listed above (to operate the Service), with law enforcement or regulators where legally required, or in connection with a merger, acquisition, or asset sale (in which case we will notify affected users). Your public profile content (whatever you choose to publish) is, by design, visible to anyone with your profile link.

We keep your data for as long as your account is active. When an account is deleted, either by you from your dashboard, or by us for a Terms violation, we erase your account and profile together with the content and records attached to them: activities, links, collections, products, portfolio, bookings, messages, notifications, subscriptions, reactions, analytics events for your profile, and any push notification tokens.

Three categories are deliberately kept. Order and payment records are retained because tax and accounting law requires it. Administrative audit logsare retained, without your personal details, so that a deletion remains reviewable afterwards. Unsubscribe records are retained because a suppression list that was erased with the account would cause a deleted user to start receiving email again. Full detail is in our Data Retention & Deletion Policy.

• Access & correction: most of your profile information can be viewed and edited directly in your dashboard at any time.
• Deletion: you can delete your account yourself from your dashboard settings; the request is confirmed by email before it is carried out. You may also email [email protected] if you prefer. What is erased and what is retained is set out in our Data Retention & Deletion Policy.
• Cookie choices: use the "Cookie Settings" link in the footer at any time to change your analytics-cookie consent.
• Email opt-out: every subscriber notification and announcement email carries an unsubscribe link, and unsubscribing takes effect without needing an account. Transactional emails required to operate your account (address verification, password reset and sign-in links) are not covered by that opt-out, because they are necessary to provide the Service and are sent only in response to your own actions.
• Depending on where you live, you may have additional rights (e.g. under GDPR or India's DPDP Act) to request a copy of your data or object to certain processing. Contact us and we will respond within a reasonable time.

The Service is not directed at children, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact [email protected] and we will remove it.

Who counts as a child depends on where you are. India's Digital Personal Data Protection Act, 2023 treats anyone under 18 as a child and requires verifiable consent from a parent or lawful guardian before their data may be processed; it also prohibits tracking, behavioural monitoring and targeted advertising directed at children. In the United States, COPPA applies under 13; in the EU/UK, the threshold is 16 unless national law sets it lower. We therefore require every account holder to be 18 or older, or to have the consent of a parent or lawful guardian.

We do not knowingly direct advertising at children and do not build behavioural profiles of them. Analytics cookies are off until they are accepted (see our Cookie Policy).

Our infrastructure providers (MongoDB Atlas, Bunny.net, Upstash, Stripe, Dodo Payments, Google, Microsoft, Sentry, Calendly, Cal.com) may process and store data outside your home country. By using the Service, you consent to your data being transferred to and processed in those locations.

We use industry-standard measures to protect your data, including password hashing, asymmetrically-signed session tokens, HTTPS/HSTS, a strict Content Security Policy, and rate limiting. No system is perfectly secure; see our Security & Vulnerability Disclosure Policy for detail and how to report a concern.

ZUDOKO is established in India, so India's Digital Personal Data Protection Act, 2023 ("DPDP Act") applies to our processing of your personal data. Under that Act we are the Data Fiduciary and you are the Data Principal. The rights below are in addition to, not instead of, any rights you have under the law of your own country.

• Right to access: you may ask us for a summary of the personal data we hold about you, how we are processing it, and the identities of the other Data Fiduciaries and Processors with whom it has been shared.
• Right to correction, completion, updating and erasure: most profile data can be corrected directly in your dashboard, and your account can be deleted from your dashboard settings. You may also ask us to do either.
• Right to withdraw consent: where we rely on your consent, you may withdraw it at any time and as easily as you gave it. Withdrawing consent does not affect processing already carried out, and we will stop processing within a reasonable period unless another lawful ground requires us to continue.
• Right of grievance redressal: see the contact below. You must give us the opportunity to resolve a complaint before approaching the Data Protection Board of India.
• Right to nominate: you may nominate another individual to exercise these rights on your behalf if you die or become unable to do so yourself. Write to the grievance contact below with the nominee's name and contact details.

Grievance contact. Complaints and rights requests under the DPDP Act should be sent to [email protected], marked "DPDP request". We will acknowledge within 7 days and respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Your duties. The DPDP Act also asks Data Principals not to impersonate another person when providing data, not to suppress material information, and not to file false or frivolous complaints.

Personal data breaches. If a breach affects your personal data, we will notify you and the Data Protection Board of India as required by the Act, describing what happened, the likely consequences, and the steps we are taking.

Transfers outside India. The providers listed in Section 5 may process data outside India. The DPDP Act permits this except to territories the Central Government has restricted by notification; we do not transfer personal data to any such territory.

We may update this Policy from time to time. Material changes will be reflected in the "Last updated" date above, and where appropriate we will notify you by email.

Questions about this Policy or your data? Email [email protected].