Privacy Policy

Last updated: July 14, 2026

1. Who we are

This Privacy Policy explains how Iloo Pro ("we", "us", the "data controller" under the EU General Data Protection Regulation, "GDPR") collects, uses, and shares information when you visit an Iloo Pro page, use the Iloo Pro dashboard, or interact with a panel we host. This policy applies to two kinds of people: panel owners(people with an Iloo Pro account) and panel visitors (people who open a public link-in-bio page).

Because our users and their visitors may be located in the European Union, we apply GDPR principles as our baseline standard regardless of where you access the Service from.

2. Data we collect

2.1 Panel visitors

Data	Why we collect it
Timestamp, referrer, user-agent, query parameters, and country of each visit/click	To show panel owners aggregate analytics (views, clicks, top sources, device type)
IP address (processed transiently for security checks and unique-visitor counting)	To classify traffic as human/bot, run WAF rules, and check IP reputation via our sub-processor ipquery.io (see §4). Also used to count how many distinct people visited a panel: the IP is turned into a one-way, per-panel salted hash and added to a probabilistic counter that does not retain its members, so the original IP cannot be recovered from it and the same visitor cannot be correlated across different panels. IP addresses are not stored in the visit-analytics log described above.
IP address, reputation flags (VPN/Tor/proxy/datacenter), and block reason — only when a request is flagged or blocked	Security log used to protect panels from abusive automated traffic and to maintain a temporary IP blocklist

2.2 Panel owners (account holders)

Data	Why we collect it
Email, name, authentication credentials/session	Account creation and login, handled by our authentication provider, Clerk
Panel content: links, text, avatar/banner/background images, custom domain configuration	To operate the Service you configure
Billing email, name, card brand and last 4 digits, subscription/customer/ order identifiers, billing history	To process your subscription via our payment processor, Lemon Squeezy. We never receive or store your full card number
Language and theme preference	To remember your dashboard display preferences across sessions

3. Legal bases for processing (GDPR Art. 6)

Performance of a contract — account management, hosting your panels, billing.
Legitimate interest — bot/crawler detection, WAF security checks, IP reputation lookups, and aggregate analytics, which we rely on to keep the Service secure and to give panel owners visibility into their traffic.
Consent — where required for specific non-essential features, we will ask for your consent separately.
Legal obligation — where we must retain or disclose data to comply with the law.

4. Sub-processors and third parties

Provider	Purpose	Data involved
Clerk	Authentication and session management	Email, name, credentials, session tokens
Lemon Squeezy	Payment processing and subscription billing	Email, name, card brand/last 4 digits, billing identifiers
Hostinger	Physical server infrastructure (a private, self-managed VPS) on which our application, database, and uploaded files run and are stored	All of the data above, as stored data
Cloudflare	Content delivery, TLS/HTTPS, DDoS protection, and the Turnstile human-verification check shown to grey-zone traffic before a link destination is revealed (including in invisible mode, with no visible interaction)	Visitor IP address, browser/device signals, and interaction data processed by Cloudflare to route traffic and to render the verification check and return a pass/fail result. See Cloudflare'sTurnstile Privacy Noticefor details on what Cloudflare collects and how it is used.
Resend	Outbound email delivery (for example, replies our team sends you)	Recipient email address and the content of the message sent
ipquery.io	IP reputation lookup for security/bot filtering	Visitor IP address (results cached for 12 hours)
Google Fonts	Serving web font files used in our interface	Visitor IP address and browser user-agent, transmitted directly to Google when a page loads (necessary for Google to serve the correct font file)
Sentry	Technical error, performance and activity logging for the dashboard, the landing page, and legal/status pages — never for our users' public panels	Request pathname, error message and stack trace, performance measurements, your IP address, HTTP headers, non-sensitive cookies, and the content of requests and responses (for example, form data you submit in the dashboard). Session cookies and any header carrying a credential or signature (for example, your API key if you use our stats API) are automatically redacted before being sent to Sentry. The content of internal webmail messages (see Microsoft below) is excluded from what Sentry receives
Microsoft (Outlook.com)	Internal notification copy of the mailbox our team uses to reply to you (any address @iloopro.com)	A forwarded copy of the full content (headers, subject, body) of every message sent to an @iloopro.com address, delivered to a personal Outlook.com mailbox as an operational backup of our internal webmail

These providers may process data outside your country of residence, including outside the European Economic Area. Where that occurs, we rely on their own GDPR-compliant safeguards (such as Standard Contractual Clauses) as offered by each provider.

5. Cookies

We use a small number of functional cookies — to remember your display preferences (such as language and visual theme), to keep you signed in via our authentication provider, Clerk, and, once you pass a Cloudflare Turnstile check, to remember for 12 hours that you already did so (so you are not challenged again on every visit). Cloudflare Turnstile itself may also set its own cookies as part of running that check; see its Turnstile Privacy Notice. These are functional cookies, not advertising or third-party tracking cookies; we do not use cookies to build cross-site advertising profiles.

6. Data retention

Per-visit analytics events are kept as a rolling log limited to the 200 most recent events per panel (older events are automatically dropped as new ones arrive); aggregate daily/total counters are kept until you or an administrator resets them.
Security (WAF) events are kept as a rolling log limited to the 150 most recent events per panel.
Geo-filter block events (IP, country, timestamp — only logged for panels using the optional country-restriction feature) are kept as a rolling log limited to the 50 most recent events per panel, and expire automatically after 90 days.
IP blocklist entries expire automatically after 30 days.
IP reputation lookups are cached for 12 hours.
Internal webmail messages (@iloopro.com) are kept until an administrator deletes them at your request; we do not yet purge them automatically by age.
Account, panel, and subscription records are kept for as long as your account is active, and for a reasonable period afterward as required for legal, tax, or dispute-resolution purposes. When an account is deleted, its panels stop being served publicly immediately; the underlying records are purged manually afterward.

7. Your rights (GDPR)

If the GDPR applies to you, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data ("right to be forgotten").
Request a portable copy of your data.
Object to or request restriction of certain processing based on legitimate interest.
Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us on Telegram.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them.

9. Security

We use industry-standard technical measures (including our WAF and IP-reputation checks described above) to protect the Service and the data we hold. No system is completely secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above.

11. Contact

Questions about this Privacy Policy or your data? Contact us on Telegram.