Log in Start for free

Privacy Policy

Last updated: 5 November 2026

NjiLink lets you create an online catalog for your business products and share it with customers through a link (e.g. in your Instagram bio). Orders are placed directly on WhatsApp. This page explains what data we collect, why, and what rights you have under the General Data Protection Regulation (GDPR).

Contents
  1. Who we are
  2. Data we collect
  3. How we use your data
  4. Legal basis
  5. Who we share data with
  6. International transfers
  7. Cookies and analytics
  8. Payments, free trial and refunds
  9. How long we keep data
  10. Security
  11. Your rights
  12. Children
  13. Changes to this policy
  14. Contact

1. Who we are

NjiLink is operated by Buna Tech, based in Shkodër, Albania, which is the data controller for the personal data described here. For the product and business information you publish in your catalog, you are responsible for the content; we store and display it on your behalf.

2. Data we collect

From catalog owners (when you register):

  • Account data: username or email and password (stored hashed, never in readable text).
  • Business data: name, logo, brand color, location, WhatsApp number and catalog address (slug).
  • Content you upload: products, photos, prices, categories, sizes and descriptions.
  • Account plan (Free or Pro), trial status and subscription period.
  • Limited billing information received from Paddle (see section 8).

From visitors of public catalogs:

  • Basic technical data: IP address, browser/device type and pages visited. Used for security and catalog statistics.
  • When you click "Order", WhatsApp opens with a pre-filled message (product and size). We do not see or store your conversation with the business; it takes place between you and the business on WhatsApp, under WhatsApp's own policies.

We do not collect data from your Instagram profile. We do not ask for special categories of data (health, biometric, etc.) and we do not sell personal data.

3. How we use your data

  • To create and manage your account and catalog.
  • To display the public catalog and connect customers with the business via WhatsApp.
  • To manage Free and Pro plans, free trials, subscriptions and their limits.
  • To send service notifications (account, password recovery, important changes).
  • To provide visit statistics to Pro owners.
  • To protect the platform from abuse, spam and fraud.

4. Legal basis

Under Article 6 GDPR we process data on the basis of contract (to provide the service you requested), legitimate interests (security, statistics, improving the service), consent (where required) and legal obligation (e.g. accounting and tax). We also comply with applicable Albanian data protection law.

5. Who we share data with

We share data only with providers we need to operate:

ProviderPurpose
Hosting (VPS)Running the application and storing data
CloudflareCDN, speed and protection against attacks
Google FontsDisplaying fonts (Google receives the visitor's IP address)
PaddlePayment processing, taxes, invoices and refunds for Pro subscriptions
WhatsApp (Meta)When you click "Order", you are redirected to WhatsApp

We may disclose data to competent authorities where required by law. We do not sell data to third parties.

6. International transfers

Some providers (e.g. Cloudflare, Google, Meta, Paddle) may process data outside the European Economic Area. Where this happens, we rely on safeguards under Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.

7. Cookies and analytics

  • Strictly necessary: login session and CSRF protection cookies. Login does not work without them.
  • Statistics: Pro plans include visit analytics for the catalog. It measures overall usage (number of visits, products viewed) and is not intended to identify individual visitors.

You can manage cookies in your browser settings; blocking the necessary ones will prevent login.

8. Payments, free trial and refunds

The Free plan costs nothing. The Pro plan is paid through Paddle, which acts as our Merchant of Record: Paddle sells the subscription to you, processes the payment, and handles taxes (e.g. VAT), invoices and refunds.

  • Free trial: new Pro subscribers get a 14-day free trial.
  • Refund: after the trial ends and the first payment is made, you have a further 14 days to request a full refund, giving you about one month to test the platform. Request it by emailing us or through Paddle.
  • Cancellation: you can cancel at any time; access continues until the end of the paid period.

Paddle collects and processes your payment details (name, email, billing address, country, payment method, tax ID) as an independent controller under Paddle's Privacy Policy. We never see or store your full card details. We receive only limited information such as your email, country, plan, subscription status, amounts and dates. We may keep payment records for accounting and tax reasons.

9. How long we keep data

  • Account and catalog data: while your account is active.
  • After account deletion: we erase data within 30 days, except what we must keep by law (e.g. accounting records).
  • Technical logs: up to 90 days.

10. Security

We use HTTPS, hashed passwords, CSRF protection, restricted server access and backups. No system is 100% secure, but we take reasonable measures and will notify affected users and, where required, the supervisory authority in case of a data breach.

11. Your rights

Under the GDPR you have the right to:

  • Access your data (Art. 15);
  • Rectify inaccurate data (Art. 16);
  • Erasure, the "right to be forgotten" (Art. 17): ask us to delete your account and personal data. For now, send your request by email; self-service deletion from the "Account" page is coming soon. We erase data without undue delay, except what the law requires us to keep;
  • Restrict processing (Art. 18);
  • Data portability (Art. 20);
  • Object to processing based on legitimate interests (Art. 21);
  • Withdraw consent at any time, without affecting earlier processing.

Write to [email protected] or on WhatsApp and we will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, such as the data protection authority in your EU country of residence or the Commissioner for the Right to Information and Protection of Personal Data in Albania.

12. Children

The service is intended for businesses and people over 16. We do not knowingly collect data from children; if we discover it, we delete it.

13. Changes to this policy

We may update this policy from time to time. For important changes we will notify you by email or a dashboard notice, and the date above will be updated.

14. Contact

For any privacy question:
Email: [email protected]
Address: Shkodër, Albania