Privacy Policy
Effective date: October 25, 2026
How Chainlink collects, uses, shares, keeps and protects personal information when you use the Chainlink purchasing service, and what you can do about it.
Summary
- What we collect: account details, sign-in records, and the business content your organization puts into the Service, including supplier and buyer contact details, emails and documents.
- Sensitive information: we do not ask for it, but documents uploaded by your organization can contain tax, bank or identification numbers. Automatic replies never include them.
- Third parties: we receive information from suppliers and buyers through the emails and documents your organization handles, and from Google if you sign in with Google.
- How we use it: to provide the Service, keep it secure, take payments for our fees and comply with law. We do not use it to train AI models or for advertising.
- Sharing: with the service providers listed in section 4, and with the suppliers and buyers your organization writes to. We do not sell personal information.
- Where data is stored: in the United States.
- Your rights: you can ask us to access, correct or delete your information by emailing contact@getchainlinked.com.
If you have questions or concerns, contact us at contact@getchainlinked.com. Reading this policy will help you understand your privacy rights and choices. If you do not agree with it, please do not use the Service.
1. What information do we collect?
We collect information from you, from your organization, and from the suppliers and buyers who exchange messages and documents with your organization.
| Information | Where it comes from | Why we have it |
|---|---|---|
| Name, email address, and sign-in records (one-time codes, session, IP address, browser type) | You | To create and secure your account |
| Name, email address and profile picture | Google, if you sign in with Google | To sign you in and identify your account |
| Contact details and business roles of supplier and buyer staff (name, email, phone, role) | Your organization, supplier and buyer emails, and documents | To run purchase orders, supplier communication and shipment tracking |
| Email messages: sender, recipients, subjects, bodies, and attachment names, sizes and types | Emails sent to and from your organization’s addresses | To route and track orders and supplier questions |
| Documents (purchase orders, invoices, shipment documents, supplier forms) and the information extracted from them | Your organization | To extract, organize, search and summarize records |
| Payment status and amounts for our fees | Dodo Payments | To record payments and balances. Card details are entered on Dodo Payments’ checkout and are not stored by us. |
| Audit events, error logs and rate-limit counters | Generated by the Service | To keep the Service secure and reliable and to prevent abuse |
Sensitive information. We do not ask for sensitive information such as health data or religious beliefs. Documents uploaded by your organization can contain identifiers such as tax, company registration and bank account numbers. We store them only as they appear in those documents. The Service does not include them in automatic replies to suppliers.
If you do not provide information the Service needs, we may not be able to give you access to it. Your organization is responsible for the accuracy of the business content it submits.
2. How do we use your information?
We use personal information for these purposes:
- To create accounts, sign you in and keep your account working.
- To provide the Service: receive, store, read, extract, summarize, search and route documents and emails; answer supplier questions and draft messages within the permissions your organization sets; and track purchase orders and shipments.
- To send service emails, such as sign-in codes, access and approval messages, and purchase order and confirmation requests.
- To take payments for our fees and keep payment records.
- To keep the Service secure and to prevent fraud and abuse, including rate limits, bot protection and checks on inbound email.
- To comply with law and respond to valid legal requests.
We do not use personal information to train AI models, and we do not use it for advertising. We do not currently send marketing emails.
3. What legal bases do we rely on?
We process personal information only where we have a valid legal basis under applicable law. Depending on where you are, these may include your consent, compliance with legal obligations, the performance of a contract with you or your organization, protection of vital interests, and our legitimate interests in running and securing the Service.
Consent. Where we rely on consent, you can withdraw it at any time, as described in section 12. Withdrawal does not affect processing done before it.
Canada. Where Canadian law applies, we rely on your express or implied consent, except in the limited cases the law allows without consent, such as to investigate fraud or comply with a court order.
4. Who do we share information with?
We share information only as described here. We do not sell personal information. We share it with the following service providers, each bound by a written contract to protect the information and to use it only to provide its service to us:
| Provider | What it does for us | Where information is processed |
|---|---|---|
| Amazon Web Services | File storage, inbound and outbound email, and AI models (Amazon Bedrock) | United States |
| Vercel | Application hosting, logs, scheduled tasks, bot protection and firewall | United States (iad1, US East) |
| Neon | Database holding application records | United States (us-east-1) |
| Resend | Sending transactional email | Per the provider’s privacy policy |
| Sign-in, if you choose it | Per Google’s privacy policy | |
| Dodo Payments | Payment processing for our fees | Per the provider’s privacy policy |
Some providers may process information in other countries, as described in their privacy policies.
- Suppliers and buyers. Emails the Service sends on your organization’s behalf go to the people your organization writes to. Those recipients receive the content of the email, including the sender details and any attachments.
- Legal reasons. We may disclose information when the law requires it, or to protect the rights, property or safety of people or of Chainlink.
- Business transfers. We may share or transfer information in connection with a merger, sale of company assets, financing or acquisition of all or part of our business. We will require the recipient to protect it under this policy.
5. Do we use cookies and other tracking technologies?
We use essential cookies to keep you signed in and to protect the Service, and preference cookies to remember interface settings. We do not use analytics, advertising or cross-site tracking cookies. Dodo Payments sets fraud-prevention cookies on its own checkout pages.
For the full list and how to refuse cookies, see our Cookie Notice at getchainlinked.com/cookies. If you turn off essential cookies, you may not be able to sign in.
6. Do we offer AI-based features?
Some features use AI models to read documents and emails, extract information, and draft replies and proposed actions. Your organization reviews the outputs and decides on orders, suppliers and payments. Some answers to supplier questions are sent automatically. Supplier messages that ask for sensitive identifiers are held for a person to answer.
- We send document and message content to Amazon Bedrock models hosted in the us-east-1, us-east-2 and us-west-2 regions of the United States.
- Our AWS account is set so that AWS does not store the prompts or outputs for these models (zero data retention, set on 18 October 2026). AWS states that it does not use customer content to train Amazon Bedrock models.
- Before content reaches a model, we remove tax, bank, credential, personal ID and card numbers from the buyer information the model can use.
- We do not train or fine-tune AI models on your information.
7. How do we handle Google sign-in?
If you sign in with Google, we receive your name, email address and profile picture from Google. We use them only to sign you in and identify your account. We store Google’s access tokens encrypted. Google’s own privacy policy describes how Google handles its data.
8. Is your information transferred internationally?
Information is stored and processed in the United States. Our database and application hosting are in US regions, and our AI processing runs in US regions. Chainlink does not offer EU or UK data residency.
If you are in the European Economic Area, the United Kingdom or Switzerland, the United States may not have data protection laws as comprehensive as yours. We take the measures described in this policy and use the transfer mechanisms our providers offer where the law requires them.
9. How long do we keep your information?
We keep information for as long as needed for the purposes in this policy, unless the law requires or allows a longer period. The periods are:
| Information | How long we keep it |
|---|---|
| Sign-in sessions | Until they expire |
| One-time sign-in codes | Expire after 10 minutes and are deleted one day later |
| Rate-limit counters | Two days |
| Background job records | 30 days after the job finishes or fails |
| Email that does not match any organization (message and file) | 30 days |
| Organization records: purchase orders, documents, emails, contacts and supplier questions | While your organization uses the Service. Deleted when the organization is deleted, or after termination once the export period in its order form has ended |
| Account details (name, email, Google profile) | Until the account is deleted on request |
| Audit events (including reads of other organizations’ data by platform administrators) | 365 days |
| Backups | 90 days. Deleted information can remain in backups until then |
When a retention period ends, we delete the information or make it impossible to identify you, using methods that make recovery impractical.
10. How do we keep your information safe?
We protect information with these measures:
- HTTPS for the Service, and encryption at rest by our providers.
- Google access tokens stored encrypted by the application.
- Access limited to members of approved organizations. New organizations are not active until a platform administrator approves them.
- Platform administrators’ reads of data across organizations are recorded in an audit log.
- One-time sign-in codes instead of passwords, with rate limits and bot protection on sign-in and access-request pages.
- Checks on inbound email so that messages are acted on only when their sender is authenticated.
- Security headers on every page, and a dependency audit in our continuous integration checks.
No electronic transmission or storage is completely secure. We cannot guarantee that hackers, cybercriminals or other unauthorized third parties will never defeat our security. You should access the Service only from a secure device and network.
11. Do we collect information from minors?
The Service is for businesses and is not intended for children under 18 or the equivalent age in your jurisdiction. We do not knowingly collect personal information from them. If you believe we have collected information from a child, contact us at contact@getchainlinked.com and we will delete it.
12. What are your privacy rights?
Depending on where you live, you may have rights to request access to your personal information, to request correction or deletion, to restrict or object to processing, to receive a copy of your information, and not to be subject to decisions made solely by automated means that have significant effects. If such a decision is made, we will tell you, explain the main factors, and offer a way to request human review.
How to exercise your rights. Email contact@getchainlinked.com from the address on your account. We will verify your identity before acting on a request. We handle these requests by hand.
Information your organization controls. Purchase orders, documents and emails belong to your organization, and we process them on its instructions. Contact your organization first. We will help it respond to your request.
Withdrawing consent. Where we rely on consent, you can withdraw it at any time by emailing contact@getchainlinked.com. Withdrawal does not affect processing done before it.
Marketing. We do not currently send marketing emails. If we do, each one will include an unsubscribe link. Service emails, such as sign-in codes and purchase order messages, are part of the Service and are not marketing.
Your account. To update or delete your account, email contact@getchainlinked.com. When we delete an account we delete the related information, except what we must keep for security, legal or fraud-prevention reasons.
If you are in the United Kingdom and are unhappy with how we handled your information, you can complain to us, and you also have the right to complain to the Information Commissioner’s Office (ico.org.uk). If you are in the EEA, you can complain to your member state’s data protection authority.
13. Do-not-track features
Some browsers offer a Do-Not-Track setting. There is no uniform standard for recognizing these signals yet, so we do not respond to them.
14. Do United States residents have specific privacy rights?
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the right to request access to, a copy of, or deletion of the personal information we hold about you, to correct it, and to withdraw consent. You may also have the right to opt out of targeted advertising, the sale of personal data, and profiling that produces significant effects. These rights are subject to exceptions under applicable law.
The table shows the categories of personal information we have collected in the past twelve months.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email address, IP address, account identifiers | Yes |
| B. Customer records information | Name, contact information, and business role of supplier and buyer staff | Yes |
| C. Protected classifications | Gender, age, race, national origin and similar characteristics | No |
| D. Commercial information | Transaction details on purchase orders, payment status and amounts for our fees | Yes |
| E. Biometric information | Fingerprints, voiceprints | No |
| F. Internet activity | Browsing history and interactions with other websites or advertisements | No |
| G. Geolocation data | Device location | No |
| H. Audio, video or call recordings | Recordings made in connection with our business | No |
| I. Professional or employment information | Business role of supplier and buyer staff | Yes |
| J. Education information | Student records and directory information | No |
| K. Inferences | Profiles of individuals’ preferences or characteristics | No |
| L. Sensitive personal information | Tax, bank and identification numbers that may appear in uploaded documents | Incidentally, in uploaded documents only |
Sources. You, your organization, suppliers and buyers through the emails and documents they exchange with your organization, and Google if you sign in with Google.
Sharing. We disclose personal information to the service providers in section 4 for business purposes, under written contracts. We have not sold or shared personal information for targeted advertising in the past twelve months, and we will not do so without updating this policy.
How to exercise these rights. Email contact@getchainlinked.com. Some states let you appoint an authorized agent. We may ask the agent for written, signed proof of authority.
Appeals. If we decline your request, you may appeal by emailing contact@getchainlinked.com.
15. Do other regions have specific privacy rights?
Residents of Australia and New Zealand may request access to, or correction of, their personal information by contacting us at contact@getchainlinked.com. Residents of the Republic of South Africa may contact the Information Regulator at enquiries@inforegulator.org.za.
16. Do we make updates to this policy?
Yes. We update this policy when needed to keep it accurate and compliant with the law. The date at the top shows when it was last revised. If we make material changes, we will notify you by posting a notice in the Service or by email before the change takes effect.
17. How can you contact us about this policy?
If you have questions or comments about this policy, email us at contact@getchainlinked.com.