Privacy Policy

1. Who we are

Haulinks (“Haulinks,” “we,” “us”) is a creator-commerce platform for the Israeli market, operated by Rotem Shamir, registered in Israel as a sole proprietor (עוסק פטור). Creators post about products; shoppers click through; Haulinks tracks which sales came from which creator. Haulinks never handles payment or checkout itself — every purchase happens on the brand's or retailer's own site. We are a redirect-and-attribution layer, not a merchant.

This policy explains what personal data we collect, why, who we share it with, and what control you have over it — whether you're a shopper clicking a link, a creator running a storefront, or someone who applied to become one.

2. Data we collect

If you're a shopper (you clicked a creator's link)

You do not need an account to browse a storefront or click a product link. We collect:

• A salted, one-way hash of your IP address and a salted, one-way hash of your browser's user-agent string. Neither can be reversed back to your actual IP address or browser identity — the salt is a secret only our servers hold. We use this to measure clicks and detect abuse (fraudulent or bot traffic), not to identify you individually.
• Your country, derived from our hosting provider's edge network, not from your IP address directly.
• Which product link and which creator's post you came from, and when.
• If you set a language preference on the site, we store that choice in a cookie (hl_lang) containing nothing but “English” or “Hebrew.”

If you're a creator (you run a Haulinks storefront)

• Account identity: your email address and a securely hashed password, managed by our authentication provider (Supabase). We never see or store your plaintext password.
• Profile information you provide: avatar image, bio, and language preference. You can edit or remove this at any time from your dashboard.
• If you connect Instagram: an access token and your Instagram user ID, used to let you import your own posts. This is stored in a part of our database that no user session — including yours — can read directly; only our servers can use it, and only to act on your behalf.
• Instagram content you choose to import: when you import a post, we copy its caption, media (image or video), and timestamp into our own storage. We do this so the post keeps working on your storefront even after Instagram's own temporary media links expire — we do not import anything you don't explicitly choose to bring in.

If you applied to become a creator

If you filled out our “Join us as a Creator” form, we collect your name, email address, Instagram handle, and whatever message you included, so we can review your application and get back to you.

Brands

Haulinks does not have any live brand partnerships today. Creators paste a product link themselves; no brand account, contract, or data-sharing relationship exists yet. We've built (but not turned on) the ability for a brand to securely receive sales-confirmation data and reconcile it with us in the future — if and when a real brand relationship goes live, this section will be updated to describe what that brand receives, and this policy will be re-published with that change called out.

Information we generate automatically

• System logs: to keep the service reliable and secure, our servers automatically log a hash of your IP address and (unlike the click data above) your raw user-agent string, tied to system events. See §4 for how long this is kept.
• Email records: every account-related email we send you (password resets, notifications) is archived on our side so we can investigate delivery problems if you report one.

3. Who we share data with

We use a small number of service providers (“subprocessors”) to run Haulinks. None of them are permitted to use your data for their own purposes — they process it only to provide their service to us.

4. How long we keep data

Data is kept only as long as it serves the purpose it was collected for. The specific numbers below are our current retention targets, based on common practice for platforms of this kind.

• System logs (IP hash + user-agent): 90 days, then deleted. Kept only long enough to investigate and respond to abuse or security incidents.
• Email archive: 12 months, then deleted or anonymized. Kept only long enough to resolve delivery disputes or support requests.
• Click data: not currently deleted on a schedule — this is aggregate attribution data (which link, which country, which timestamp), not tied to a reversible identity, and is the core record a creator relies on to negotiate and verify their own brand deals. Haulinks doesn't compute or pay out commission itself, so this is attribution evidence, not a payout ledger.
• Account data (creators): kept for as long as the account is active, deleted on request — see §5.

5. Your rights, and how to delete your data

You can ask us to access, correct, or delete the personal data we hold about you.

• Creators: you can delete your account and all associated personal data from Settings → Delete account in your dashboard.
• Instagram users: if you disconnect Instagram or request deletion through Meta, we delete the data associated with your Instagram connection as soon as Meta notifies us, via our data-deletion callback endpoint.
• Anyone else (shoppers, creator applicants): email us at privacy@haulinks.com and we will act on your request within 30 days.

6. Instagram-specific disclosure

Haulinks requests only the instagram_business_basic permission from Meta — this lets us read a creator's own posts so they can import them. We do not request, and cannot use, any permission to publish or post anything to Instagram on your behalf.

7. Cookies and tracking

We use:

• hl_lang — remembers your language choice (English/Hebrew). No personal data, not used for tracking.
• A session cookie, if you're logged in as a creator — required for the dashboard to function.
• Click tracking as described in §2 — this happens automatically when you follow a creator's product link, as part of how the redirect and attribution service works, not through a separate tracking cookie.

The click tracking above is not cookie-based — it reads request headers server-side, not anything stored on your device — so it sits outside EU ePrivacy's cookie-consent rule by definition. Of the cookies Haulinks actually sets (session, language, a one-time OAuth security token), all fall in the “strictly necessary/functional” category ePrivacy generally exempts from opt-in consent, so we don't show a cookie banner.

8. Promo codes and redirect links — what this is not

Storefronts display promo codes that belong to the creator — Haulinks does not negotiate or set these on a brand's behalf. Every product link routes through a Haulinks redirect so we can measure the click. This is not an affiliate relationship: as of this policy, no brand compensates a creator for a sale, so there is nothing to disclose as a paid endorsement. What we do disclose, plainly: a link you click on a Haulinks storefront passes through Haulinks' own servers before reaching the brand's site, for attribution purposes only.

9. International data transfers

Our service providers (§3) may process data outside Israel — for example, Supabase's infrastructure region and Vercel's global edge network. We take reasonable measures to ensure any such transfer is handled consistently with applicable law.

10. Children's privacy

Haulinks is not directed at children, and we do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

We'll update this page when what we collect or do with it changes, and update the “Last updated” date at the top. For material changes, we'll notify creators by email.

12. Contact us

Questions about this policy, or a request about your data: privacy@haulinks.com.