Privacy Policy
This Privacy Policy explains how LocalToLink (“we”, “us”) collects, uses, and protects information when you use our tunneling service. This notice is provided in accordance with GDPR Article 13.
1. Data Controller
LocalToLink is the data controller for personal data processed through this service. Contact: [email protected]
2. What We Collect
- IP addresses — collected when you create tunnels, connect to tunnels, or visit our website. IP addresses are personal data under GDPR.
- Tunnel metadata — session IDs, timestamps, subdomain, request/response sizes, and connection status.
- Abuse reports — URLs, categories, details, and optional contact information you submit.
- Admin account data — email and WebAuthn credentials for authorized administrators only.
3. What We Do Not Collect
We do not store the contents of traffic forwarded through tunnels by default. We do not require an account for the free tier.
4. Legal Basis (GDPR)
- Legitimate interest (Art. 6(1)(f)) — security logging, abuse prevention, and service operation.
- Contract performance (Art. 6(1)(b)) — providing the tunneling service you request.
- Legal obligation (Art. 6(1)(c)) — compliance with applicable laws including CSAM reporting requirements.
5. Data Retention
| Data type | Retention period |
|---|---|
| Tunnel metadata | 30 days |
| Security/access logs (incl. IP addresses) | 6–12 months |
| Audit logs | 2 years (append-only) |
| Abuse reports and evidence | Resolution + 1 year |
| CSAM evidence (upon actual knowledge) | ≥ 1 year (legal requirement) |
6. Your Rights
If you are in the European Economic Area, you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing. Erasure requests are honored except where legal retention duties apply. Contact [email protected].
7. Security
We implement technical and organizational measures to protect data, including encrypted connections, access controls, and audit logging.
8. Changes
We may update this Privacy Policy. Material changes will be reflected in the “Last updated” date above.