Privacy notice

Last updated 4 October 2026

This notice explains what fnlnk collects, what we do with it, what we never see, and the rights you have over your data. It is written in plain English on purpose. If something is unclear, write to us and we will explain it again.

1. Who we are

fnlnk is operated by CG APPS Ltd, a company registered in England and Wales (company number 17266903), at 66 Paul Street, London EC2A 4NA. CG APPS Ltd is the data controller for the personal data described in this notice.

2. What we collect

We collect only what the product actually needs in order to work. For creators that is:

Account details: your email, your fnlnk handle, your display name, your payout currency, and the fact that you confirmed you are 18 or older.
Your single profile photo, when you upload one.
The public links you add to your profile.
Tip records: the amount, currency, time, the fan's optional name, the fan's optional message, and the state of the tip (pending, available, refunded, and so on).
Delivery records: which thank-you content item was sent for each tip and when the private link expired, so we can evidence delivery and resolve disputes.
Upload confirmations: each time you send a thank-you, the confirmation you gave (which wording you confirmed and when), with the tip it was for and whether it was a photo or a message. It is recorded in three places. The thank-you's own record holds it with the full IP address the thank-you was sent from and a fingerprint (a hash) of the photo or message; while a message thank-you is live, that record also holds the message itself. Our audit log records the upload and the confirmation as two entries, and a third if you remove a thank-you, each with the full IP address and your browser's user agent (the name and version of your browser and device software), and with which account did it (until that account is deleted), the thank-you's identifier, and details such as the tip it was for and the wording you confirmed, so the entries can be matched to the thank-you, to the tip and to the copy below, and through them to you. A separate copy of the confirmation, keeping only the network part of the IP address, is kept even after the thank-you or your account is deleted; that copy never includes the photo, the message or its fingerprint. Section 7 sets out how long each of these is kept, what we delete automatically and what we dispose of by hand, and how you can ask us to remove them.
Payout records: when you withdraw, where to, the amount, and the outcome.
If you choose a MassPay wallet for your payouts: the email address you give for that wallet, which we keep, and your first name, last name and country, which we read from your verified identity when you set the wallet up and pass to MassPay without storing them.
Identity verification status, as verification (KYC) is required before a creator's tips are activated and before the first tip can be accepted. Identity documents themselves are handled by our verification provider and are not stored on our servers.
Sign-in records and a basic audit log of sensitive actions on your account.

For fans sending a tip, that is:

The amount and currency of the tip.
Your email address, which you provide at checkout. We use it for two purposes only: to deliver the creator's thank-you content item to you, and to help prevent fraud and abuse. We keep it only as long as we need it for those purposes and to meet our legal duties, then delete or anonymise it.
The optional name and the optional message you chose to add.
The fact that you confirmed the purchase at checkout.
A reference returned by our payment provider so the tip can be matched and, where appropriate, refunded.

3. What we do not collect

We never see or store your full card number. Card details are entered into a secure field hosted by our payment provider, are sent directly to that provider, and are tokenised there. fnlnk only ever holds the token reference.

We do not collect your real name as a fan, unless you choose to type it in the optional name field. Fans do not need a fnlnk account.

4. How we use what we collect

We use personal data for these purposes, each on the legal basis shown:

To provide the service you signed up for or paid for, which is necessary for our contract with you: showing a creator's public profile, recording a tip, delivering the thank-you content item, crediting a creator's balance, processing a payout, and contacting creators about their account (confirmations, security notices, and important changes to the service).
For our legitimate interests in keeping the platform and its payments safe and honest: preventing and detecting fraud and abuse, moderating content, reviewing reports, enforcing the Acceptable Use Policy, keeping evidence that the people in thank-you content consented to it, and answering chargebacks, disputes and legal claims. You can object to this (section 9).
To meet our legal obligations: keeping accounting and tax records, and responding to lawful orders and requests from regulators, courts and law enforcement.

Our payment provider's contract with us requires us to keep some records and to be able to show some evidence. That is a contractual requirement, not a legal obligation of ours, so for those records we rely on our legitimate interests, not on a legal obligation.

We do not sell personal data. We do not share personal data with anyone for their own advertising or analytics use.

5. Fan names and messages

Fans do not need an account to send a tip. The name and message fields are optional. What a fan enters there may appear publicly on the page of the creator they tipped: the name, the message and the tip amount in that creator's recent tips, and the name with the total tipped under that name in that creator's Top Spenders. A fan who leaves the name blank appears as Anonymous; a message they enter can still appear.

If the creator has connected an X account for auto-posting, a tip can also be posted publicly to that creator's X account. The post can include the name (or Anonymous if the name was left blank) and the tip amount. It never includes the message. The creator can change the wording and switch these posts off. Refunding a tip does not automatically remove an X post already made about it; to ask for a post to be removed, write to us (section 9).

The creator also sees the amount and the time of each tip. The creator does not see the fan's email, full name, or payment details.

6. Sharing with providers

We use a small number of trusted providers to operate the service. Each receives only what it needs to do its job:

Payment providers, to take a card payment and return a token. Our card payments are acquired by Trust Payments.
Payout provider, to send money to a verified creator.
If you choose a MassPay wallet for your payouts, MassPay, which receives your MassPay email address, first name, last name and country to set up your wallet and pay into it.
Identity verification provider, as a creator is required to verify before their tips are activated and before accepting a first tip.
Content moderation and delivery provider, to screen a thank-you content item before delivery and serve it to the paying fan through a private, expiring link.
Email provider, to send creator account and tip-received notifications.
Hosting and database provider, to run the application and store the records described in section 2.

Some of these providers act only on our instructions, as our processors, under contracts that limit them to the purpose we shared the data for. Others act as controllers in their own right for some or all of what they do, and then their own privacy notices apply. Trust Payments acts as an independent controller when it provides card acquiring: it uses the payment data it receives for its own purposes, such as meeting card-scheme rules and its own legal obligations. See Trust Payments' privacy notice at trustpayments.com/privacy-policy.

7. Storage and security

We use reputable infrastructure and service providers. Some of them process data outside the United Kingdom or the European Economic Area. Where that happens, we rely on the international-transfer safeguards required by the UK GDPR, including the UK International Data Transfer Agreement or the UK addendum to the EU Standard Contractual Clauses.

We keep records for as long as we need to provide the service, meet our legal duties, and answer chargebacks and disputes. After that we delete them or anonymise them so the person can no longer be identified. Some records are kept for longer, and they still identify you for as long as we keep them; the paragraphs below set out the ones connected to thank-yous. Deleting an IP address or a user agent from a record does not anonymise the record.

Upload confirmations are kept longer than the thank-you they confirm. Our payment provider's terms require us to keep records connected to a payment for at least five years after that payment, or after any later refund or chargeback of it. Separately, we have undertaken to our payment provider that we can show, on request, that the people in the content consented to it. So we keep the separate copy of an upload confirmation for five years after the latest payment event on the tip it was for, even if the thank-you or your account has been deleted. A thank-you removed before its separate copy was made has no copy; for it, we keep the audit-log entry that recorded the confirmation for those same five years instead, although its full IP address and user agent are still deleted after 12 months, as described below. Under our policy, a payment event is the payment itself, a refund or chargeback of it (including one made in a different currency from the tip), or a later refund or chargeback that we recorded but did not act on because the tip had already been reversed. We keep it for longer while any report against your account is still open, while a payment review of that tip is still open, or while we have been asked to keep it by our payment provider or the police, or need it for a dispute. Then we delete it automatically.

Full IP addresses from uploads are kept for a shorter period. We delete the full IP address on a thank-you's record, and the full IP address and browser user agent on the audit-log entries for its upload, its confirmation and any removal you make, 12 months after the later of that request and the latest payment event (as described above) on the tip it was for. Twelve months is our own policy; it is not set by our payment provider or by law. Deleting your account does not change that date. We keep them for longer while any report against your account is still open or a payment review of that tip is still open. Where the separate copy of the confirmation described above exists, we also keep them while we have been asked to keep that copy by our payment provider or the police, or need it for a dispute. We keep the full IP address on a thank-you's record until any separate copy due for it has been made from it. This deletion is automatic: we check every day, so it normally happens in the next daily clean-up after the date. Deleting them removes only those two details: it does not delete or anonymise the record or the entry they were on.

The other records connected to thank-yous are not deleted automatically. We review them every month and dispose of them by hand, under a written procedure. The audit-log entries for a thank-you's upload, its confirmation and any removal you make are deleted once their full IP address is due for deletion as described above, except an entry recording a confirmation that has no separate copy, which is kept for the five years described above. At the same point, the record of a thank-you that has expired, was removed by our moderation team, or did not pass our scan is reduced to what our payment and delivery records rely on, such as the tip it was for, your account, its status, whether and when it was approved and delivered, and the confirmation you gave. Its fingerprint, any remaining message, its scan details and its full IP address are removed, and we keep the reduced record for as long as we keep that tip's payment records. A record not linked to any tip is deleted. A photo that did not pass our scan is deleted no later than the first monthly review held more than 30 days after the scan (our storage settings can delete it sooner), and a photo still under review is decided at the monthly review; either is kept longer only while we still need it for that review, for your appeal, or because we have been asked to keep it. A thank-you our scan flags as possibly illegal is not disposed of under this procedure: we decide separately what the law requires us to keep or report. We keep any of these records for longer while one of the holds described above applies.

Until they are deleted, these records still identify the thank-you and the tip it was for. The audit-log entries also show your account until it is deleted. After that they no longer name your account, but they can still be linked to you: the separate copy of the confirmation keeps your account's identifier for as long as it is kept, and so do any of our payment records for that tip that still exist. Deleted records can remain in our providers' backups until those backups expire; if we ever restore from a backup, we repeat the deletions recorded since it was taken before we use the restored data.

Your dashboard offers removal for one case only: a photo that did not pass our scan or is still under review. Our system will also accept a direct request from your account to remove the record of a thank-you that was approved or has already been delivered, even though the dashboard does not offer it. It does not accept one for a thank-you removed by our moderation team, or for the record of an approved thank-you that was never delivered. Those are limits of the dashboard and of that request, not of your rights: you can ask us to delete or restrict any of the records described above, including the audit-log entries and the reduced records (section 9), and we handle that by hand. Removing a thank-you does not remove the separate copy of the upload confirmation. Where we need to keep something (the separate copy during its five-year period or a hold, or our payment records), we will tell you what and why.

8. Moderation access to thank-you content

A thank-you content item is delivered privately to the fan who paid for it. Separately from that delivery, authorised trust and safety staff can open an item to check it against our Acceptable Use Policy. That access is limited to those staff, requires a second authentication step, and is recorded: we keep a record of which item was released, to which member of staff, and when. The record shows that content was released to them; it is not a record that anyone read it.

This does not change what we keep or for how long. Retention and deletion work exactly as described above: a delivered item is purged after its delivery window, an undelivered one after our retention period, an item removed by moderation is purged at the point it is removed, and an item removed at your own request is purged at that point too, on the terms in section 7.

9. Your rights

Under the UK GDPR you have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct it;
ask us to delete it, or to limit how we use it, where the law allows;
object at any time to our using it for our legitimate interests (section 4). We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims, and we will tell you which;
receive the personal data you gave us, where we use it to perform our contract with you, in a structured, commonly used and machine-readable format, and ask us to send it to another organisation where that is technically feasible;
where we rely on your consent for something, withdraw it at any time; this does not affect what we did before you withdrew it.

These rights do not depend on what your dashboard offers. Where the dashboard has no control for what you are asking, write to us and we will handle it by hand. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

We will respond within one month. Where we cannot act on a request, for example because we need a record for a legal claim or the law requires us to keep it, we will tell you why.

10. Changes to this notice

If we make a material change to this notice we will surface it in the product and update the “Last updated” date at the top of this page.

Contact

Data questions and rights requests can go to support@fnlnk.com.