Privacy Policy

Last updated: April 2026

1. Introduction

animo.li ("we", "our", or "the Service") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our link shortening, event registration, and Link-in-Bio profile services.

We operate in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 of the Republic of the Philippines, and its Implementing Rules and Regulations (IRR). We are committed to upholding the rights of data subjects as prescribed by the National Privacy Commission (NPC).

2. Data Subjects & Roles

We interact with several categories of data subjects, each with different data processing purposes:

2.1 Authenticated Users (All Signed-In Users)

Any person who signs in to animo.li via Google OAuth. This includes link creators, event organizers, and event registrants.

2.2 Link Creators

Users who create and manage short links. We process their account data and link metadata (slug, destination URL, click counts, pin status).

2.3 Profile Owners

Users who create a Link-in-Bio profile page (e.g., animo.li/zel). We process their profile content — including display name, bio, avatar, cover photo, background photo, profile links, and affiliations — as well as their email visibility preference. When a profile is published, this content is publicly accessible to anyone.

2.4 Event Organizers

Users who create events and registration forms. They act as data controllers for the registration data they collect from attendees. We process their account data, event content (titles, descriptions, cover images), and form configurations.

2.5 Event Registrants

Users (or guests) who register for events. We process their registration form responses — which may include name, email, ID number, and custom field data as configured by the event organizer. Registration data is shared with the event organizer.

2.6 Invited Users

Individuals who receive email invitations to collaborate on events. We process their email address and invitation token until the invitation is accepted or expires.

2.7 Anonymous Visitors

Visitors who click on short links or view public event pages without signing in. We collect only anonymous, aggregate click counts. We do not track or identify individual visitors.

3. Information We Collect

3.1 Account Information (via Google OAuth)

When you sign in with Google, we receive and store:

  • Full name
  • Email address
  • Profile picture URL
  • Google account ID (for authentication)

3.2 Link Data

  • Custom slug (e.g., "my-link")
  • Destination URL
  • Aggregate click count (anonymous)
  • Creation and last-clicked timestamps

3.3 Profile Data (Link-in-Bio)

When you create a Link-in-Bio profile, we collect and store:

  • Display name (up to 50 characters)
  • Bio (up to 240 characters)
  • Avatar image, cover photo, and background photo (uploaded images stored in S3-compatible storage)
  • Profile URL slug (e.g., "zel" → animo.li/zel)
  • Email visibility preference: public (shown to all), DLSU-only (shown only to signed-in @dlsu.edu.ph users), or disabled (never shown)
  • Profile links — each with a title, URL, optional description, optional icon, and a visibility toggle
  • Affiliations — each with an organization name, optional role, optional logo, and a color label

When your profile is published, the above content (except your email address, which follows your visibility setting) is publicly accessible to anyone, including unauthenticated visitors.

3.4 Event Data

  • Event title, description, and slug
  • Cover image (uploaded by organizer)
  • Form field configurations (field types, labels, options)
  • Publication status, linked Google Sheet ID/URL (if connected)

3.5 Registration Data (Event Registrants)

When you register for an event, we collect the responses you provide in the registration form, which may include:

  • Name and email address
  • ID number (optional — stored in your profile to pre-fill future registrations)
  • Membership status
  • Custom field responses as configured by the event organizer (e.g., text inputs, dropdown selections)
  • Organizer notes (added by the event organizer, not by you)

3.6 Invitation Data

  • Invitee email address
  • Assigned role (editor, responses viewer)
  • Unique invitation token
  • Inviter identity (for audit purposes)

3.7 Session & Authentication Data

  • Session token and expiry
  • IP address and user agent (for security purposes)
  • OAuth access and refresh tokens (encrypted)

4. How We Use Your Information

  • Authentication & account management: To verify your identity and maintain your session.
  • Link shortening: To create, store, and redirect short links, and to display aggregate click analytics to link owners.
  • Link-in-Bio profile: To create and serve your public profile page, displaying your display name, bio, avatar, cover photo, background photo, profile links, affiliations, and (where permitted by your visibility setting) your email address.
  • Event management: To create event pages, process registrations, and share registration data with event organizers.
  • Google Sheets export: To export event registration data to a Google Sheet when requested by the event organizer. This requires the organizer to grant Google Sheets access.
  • Email invitations: To send invitation emails for event collaboration via Resend.
  • Pre-filling forms: To store your ID number (if provided) for pre-filling future event registration forms.
  • Payment processing: To process event creation payments via PayPal (we do not store payment card details).

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. Data is shared only in the following circumstances:

  • Event organizers: Your registration data is shared with the organizer of the specific event you registered for. They may export this data to Google Sheets.
  • Event collaborators: Users invited to collaborate on an event may view registration data according to their assigned role (editor or responses viewer).
  • Third-party services: We use Google OAuth (authentication), Google Sheets API (data export), PayPal (payments), and Resend (transactional emails). Each service receives only the minimum data necessary.
  • Legal requirements: We may disclose information if required by law or to comply with a valid legal process.

6. File Storage

Profile images (avatar, cover photo, and background photo) and event cover images are uploaded to S3-compatible storage (MinIO). Profile images on published profiles are publicly accessible; event cover images are accessible via presigned URLs. We do not scan or analyze the content of uploaded files beyond serving them for their intended purpose.

7. Data Storage & Security

Your data is stored in a PostgreSQL database. All data in transit is encrypted via TLS/HTTPS. We implement reasonable organizational, technical, and physical security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Access to data is scoped by user. You can only access your own resources unless explicitly granted access through event collaboration invitations.

8. Data Retention

  • Account data: Retained for as long as your account is active. Deleted upon account deletion request.
  • Short links: Retained until deleted by the creator or removed by an administrator.
  • Profile data: Display name, bio, photos, profile links, and affiliations are retained until you delete your profile or request account deletion. Uploaded images are also deleted from storage at that time.
  • Event data & registrations: Retained until the event is deleted by its creator or organizer.
  • Invitation data: Retained until the invitation is accepted, declined, or the associated event is deleted.
  • Session data: Automatically expired and cleaned up after the session expires.

9. Your Rights Under the Data Privacy Act of 2012

As a data subject under R.A. 10173, you have the following rights:

  • Right to be informed: You have the right to know how your personal data is being collected, used, and processed.
  • Right to access: You may request access to your personal data that we hold.
  • Right to rectification: You may request correction of inaccurate or incomplete personal data.
  • Right to erasure or blocking: You may request deletion or blocking of your personal data under certain conditions.
  • Right to data portability: You may request a copy of your data in a structured, commonly used format.
  • Right to object: You may object to the processing of your personal data under certain conditions.
  • Right to file a complaint: You may file a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.

Users who are DLSU students, faculty, or staff are additionally protected under the DLSU Student Handbook and may raise data privacy concerns with the Student Discipline Formation Office (SDFO).

10. Cookies

We use essential cookies only for authentication and session management (specifically, the better-auth.session_token cookie). We do not use third-party tracking cookies, advertising cookies, or analytics cookies.

11. Children's Privacy

The Service is not directed at individuals under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

13. Related Documents

Please also review our Terms of Service which govern your use of the Service.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data privacy rights, please contact us at [email protected].