TL;DR: I compared seven link in bio tools using six checks of their public privacy documentation. Linkie scores 6 of 6, Linktree and Stan Store 3 each, Milkshake, Beacons and Link.me 1 each, and Lnk.Bio 0. These scores describe the documents reviewed, not whether a tool or your page is GDPR compliant. Linkie and Linktree publish a processor agreement you can obtain. Hosting, transfers, privacy representatives and any tracking you add also matter.
By Denis Qyra, Marketer at Linkie · Last updated 27 October 2026
How I scored this
I work at Linkie. Each tool earns one point for six documentation checks: an obtainable DPA, a published sub-processor list, named transfer safeguards, a processing country, an EU privacy representative, and verifiable independent security certification or audit information.
“Not found” means absent from the documents reviewed, not necessarily unavailable. Conditional transfer safeguards count if named. Scores measure documentation, not GDPR compliance; tracker behavior and account deletion are outside the score.
Documents reviewed 17–22 September 2026; DPA status rechecked 25 October. These seven popular tools do not represent the whole market.
The comparison at a glance
Read between 17 and 22 September 2026. Processor agreements rechecked on 25 October 2026.
Tool | Score | Entity | Where data goes | Processor agreement | Worth knowing |
|---|---|---|---|---|---|
6/6 | Kalemi Code, Albania; incorporated in the US | Frankfurt per policy | Pre-signed; names Linkie; contractual transfer safeguards | Built-in analytics; no advertising pixel field | |
3/6 | Linktree Pty Ltd, Collingwood VIC | Australia, US and other countries; contractual safeguards | Published, auto-incorporated, 2022 | Permits sharing with brand partners | |
3/6 | Find Community, Inc., Venice CA | United States | DPA not found in documents reviewed | EU and UK privacy representatives; optional advertising pixels | |
1/6 | Codelbee Pty Ltd, Melbourne | Australia and the US | DPA not found in documents reviewed | Optional Meta Pixel on Pro; subscriber emails forwarded | |
1/6 | Beacons AI Inc., San Francisco | United States | Not found in documents reviewed | Optional creator-added tracking pixels | |
1/6 | Me Global App, Inc., Boca Raton FL | EEA, Switzerland, UK to the US | Not found in documents reviewed | Six ad networks named in the policy | |
0/6 | Gimucco PTE LTD, Singapore | AWS host, no country stated | Not found in documents reviewed | Policy lists advertising and session recording; US-law sale/sharing disclosures |
The scoreboard
Linkie leads this six-check documentation comparison. Linktree and Stan Store tie on three checks. A public DPA was found for Linkie and Linktree; for the other five, one was not found in the documents reviewed.
Linkie, 6 of 6. Documents all six checks: an obtainable DPA, a published sub-processor list, contractual transfer safeguards, Frankfurt hosting, an EU privacy representative and verifiable ISO/IEC 27001 certification information.
Linktree, 3 of 6. Documents a DPA incorporated into its terms, contractual transfer safeguards and processing countries. A published sub-processor list, EU privacy representative and verifiable independent certification were not found in the documents reviewed.
Stan Store, 3 of 6. States a processing country, names EU and UK privacy representatives, and describes possible adequacy decisions or contractual protections for transfers. That conditional transfer statement earns the same documentation point as a named safeguard elsewhere. A DPA, published sub-processor list and verifiable certification were not found.
Milkshake, 1 of 6. States processing countries. A DPA, published sub-processor list, named transfer safeguard, EU privacy representative and verifiable certification were not found in the documents reviewed. Optional Meta Pixel support is discussed separately and does not reduce its score.
Beacons, 1 of 6. Names the United States as a possible processing destination. The other five documentation checks were not found in the documents reviewed. Optional creator-added pixels are outside the score.
Link.me, 1 of 6. Names the United States as a transfer destination. The other five documentation checks were not found in the documents reviewed. Its advertising-service disclosures are discussed separately.
Lnk.Bio, 0 of 6. Names AWS as host without stating a storage country in the reviewed policy. Its sub-processor list is described as available on request, which does not meet the published-list check. The other documentation checks were not found. Its advertising disclosures do not affect this score.
The detail behind each line is below, with the quotes and dates it came from.
The comparison
Linkie, 6 of 6
Entity: Kalemi Code, headquartered in Tirana, Albania, and incorporated in the United States. Where data goes: servers in Frankfurt per the privacy policy, revised 8 July 2026. Processor agreement: published through the Kalemi Code Privacy Center, pre-signed, names Linkie, states primary storage in AWS Frankfurt and incorporates standard contractual clauses under Modules 2 and 3. Sub-processor list: published. EU privacy representative: named, in Zagreb. Certification: ISO/IEC 27001 for information security. These documents describe Linkie’s safeguards; they do not make a customer’s page compliant automatically.
Linktree, 3 of 6
Entity: Linktree Pty Ltd, Collingwood, Victoria, Australia. Where data goes: the privacy notice, effective 5 July 2026, says Australia, the United States and other countries. Processor agreement: published and incorporated into its terms automatically, effective 27 April 2022, and the addendum names the Australian entity as importer and describes standard contractual clauses. Australia holds no EU adequacy decision, so those transfers run on safeguards rather than adequacy. Trackers: its notice says cookie use “may also constitute a sale or sharing of personal information under California law”, and permits sharing account and commercial information with brand partners. Not found: sub-processor list, EU representative, independent certification.
Stan Store, 3 of 6
Entity: Find Community, Inc., trading as Stan, Venice, California, policy revised 25 November 2025. Where data goes: the United States. EU representative: named for the EU and a second for the UK, both with addresses, which is broader than ours. Transfers: covered by a conditional, that it “may rely on an EU Commission or UK government adequacy decision or contractual protections.” Trackers: its help centre documents pixel fields for Meta, TikTok, Google Analytics and Pinterest on Creator Pro. It states plainly that “Find Community, Inc. is the controller of your personal information in accordance with data protection laws of the European Economic Area and the United Kingdom.” Not found, across ten pages of policy: processor agreement, sub-processor list, standard contractual clauses.
Milkshake, 1 of 6
Entity: Codelbee Pty Ltd, Melbourne, privacy policy version 1.3, June 2026. Where data goes: “We are based in Australia so your data will be processed in Australia and the US.” Trackers: a Meta Pixel on the Pro plan, which its own documentation says “sends PageView events with a URL parameter, LinkClick events with a URL parameter and contact events on mailing list subscription events.” Its cookie policy also says that if you disable a category, “we may still use information gathered from cookies that were set before they were disabled.” Its policy also says that under the GDPR, Codelbee is “a ‘data controller’ of your personal information.” Not found, across five documents read in full: processor agreement, sub-processor list, transfer mechanism, EU representative, certification.
Beacons, 1 of 6
Entity: Beacons AI Inc., San Francisco, policy effective 19 August 2024 and updated 22 November 2025. Where data goes: it says personal information “may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.” Trackers: it tells creators to “add your tracking pixel URLs to integrate with platforms like Google, Pinterest, and more.” Named third parties: Stripe, PayPal, Plaid, OpenAI, Google, Shopify and the Gmail API. Not found: processor agreement, sub-processor list, standard contractual clauses, EU representative, certification.
Lnk.Bio, 0 of 6
Entity: Gimucco PTE LTD, Singapore, policy updated 9 April 2026. Where data goes: Amazon Web Services is named as host but no country is stated, and the place of processing clause is generic. Trackers: Google AdSense, TikTok conversion tracking, TikTok Remarketing, and Microsoft Clarity for heat mapping and session recording. Session recording is not visit counting. In its US state law section, for all four categories of data it lists, it answers “Sold or Shared: Yes. Targeted Advertising: Yes.” Sub-processor list: not published, though it says the list “may be requested from the Owner at any time.” Not found: processor agreement, transfer mechanism, EU representative, certification.
Link.me, 1 of 6
Entity: Me Global App, Inc., Boca Raton, Florida, policy updated 30 June 2026. Where data goes: “We may transfer personal data from the EEA, Switzerland, and the UK to the United States and other countries.” Trackers: its named service providers include Google Analytics, Datadog, Instabug and Stripe, followed by a run of advertising networks, Google Ads, X Corp., Facebook, Pinterest, TikTok and Snapchat. That is six ad networks disclosed in the policy itself, more than anyone else in this set. Not found: processor agreement, sub-processor list, transfer mechanism, EU representative, certification.
Where the others beat us
Linktree’s processor agreement is easier to get than ours. Theirs is incorporated into the terms automatically, so there is nothing to sign. Ours is pre-signed but you complete and return it before it binds. Theirs is less work, and it scores the same point ours does.
Stan Store names privacy representatives for both the EU and UK. Linkie’s published representative covers the EU. That broader coverage is useful for customers reviewing both jurisdictions.
Milkshake’s help centre says subscriber emails are forwarded to Google Sheets or Mailchimp rather than permanently stored on the creator’s behalf. That is useful context about email collection, which is separate from the six documentation checks.
Optional tracking pixels need a separate review
A documentation score cannot tell you what loads on a visitor’s device. Optional tracking integrations deserve their own review.
Stan Store, Milkshake and Beacons document fields for creator-added tracking pixels. Offering that option does not establish that advertising trackers run by default, so it does not reduce their documentation scores.
If you enable a tracking integration, review its purpose, what information it sends and which consent requirements apply. The platform’s privacy policy does not replace your own responsibilities for the choices you make on your page.
Lnk.Bio and Link.me list advertising services in their policies. That disclosure alone does not establish whether a particular service runs on every public page or before consent. Confirm actual behavior separately from reading the policy.
Milkshake also describes a Meta Pixel contact event when a visitor subscribes. If that integration is enabled, forwarding an email to a spreadsheet and sending a tracking event are separate processing activities to review.
Read sale and sharing disclosures in context
Lnk.Bio’s US state privacy section uses the legal categories “sale” and “sharing.” Those categories can include advertising-related disclosures and should not be read as proof that the platform sells a list of visitor identities for money.
Compare the privacy terms for the specific product you use. A company may operate several products with different purposes, integrations and data practices.
Where Linkie sits
Our policy says Linkie runs on servers in Frankfurt, Germany. Kalemi Code is headquartered in Tirana, Albania, and incorporated in the United States. Hosting in Germany does not mean every service provider processes data only in Germany, or that Linkie is established in the EU.
Linkie provides built-in analytics for your public page. The details below describe that feature; they should not be read as claims about every service used on the Linkie marketing website or app. You can compare available features on our plans page.
Linkie analytics records total views, total clicks, bounce rate, source and country, and device, operating system and browser. Read more about Linkie’s GDPR features and the privacy documents available for your review.
Choosing a link in bio for Germany
For a German GDPR (DSGVO) review, ask for the AV-Vertrag, the German term for a data processing agreement. Linkie makes a DPA and sub-processor list available for your review.
Linkie hosts its service in Frankfurt, Germany, and offers basic visitor analytics and consent controls for third-party embeds. These are useful features when comparing a Linktree alternative in Germany. Hosting in Germany does not mean every service provider processes data only there; review the transfer terms and the services you add to your page too.
What to do about your own page
Publish a privacy notice for your page and name the organizations involved and why. Get the processor agreement for anything done on your behalf and read what it covers. Write down which international transfers apply. And before you switch on a pixel, decide what you are going to tell visitors, because at that point the answer is yours rather than your vendor’s.
The right setup depends on what your page collects, what you embed, where your visitors are, and which of those choices you made yourself. The EDPB guidance on controllers and processors is the readable version of why a single label for the whole relationship does not work.
Questions people ask
Which link in bio tool is the most GDPR compliant?
No tool can make your page compliant on its own. Linkie leads this six-check documentation comparison with 6 of 6; Linktree and Stan Store each score 3. The score measures the public information found in the documents reviewed, not legal compliance or product safety.
Is Linktree GDPR compliant?
Linktree scores 3 of 6 documentation checks: it publishes a DPA, describes contractual transfer safeguards and states processing countries. A published sub-processor list, EU privacy representative and verifiable independent certification were not found in the documents reviewed. Whether your use is compliant depends on your page and processing activities. We also keep a broader list of Linktree alternatives if you are comparing on more than privacy.
Which link in bio tools publish a DPA?
Linkie and Linktree publish a DPA you can obtain. Linktree incorporates its agreement into its terms; Linkie’s agreement is available through the Kalemi Code Privacy Center, pre-signed and naming Linkie. A DPA was not found for the other five in the policies and terms reviewed on 25 October 2026. A company describing itself as a controller does not rule out it acting as a processor for other activities.
Can I use Linkie as a Linktree alternative in Germany?
Yes. Linkie hosts its service in Frankfurt, Germany. Its basic visitor analytics, consent controls for third-party embeds and available privacy documents make it an option to consider. For your DSGVO review, read the Privacy Policy, DPA (AV-Vertrag) and sub-processor list. Your own page setup and any third-party services still matter.
What does DSGVO mean?
It is the German name for GDPR, short for Datenschutz-Grundverordnung. Same regulation, same obligations. A German customer asking whether you are DSGVO konform is asking exactly this, and usually wants the AV-Vertrag.
Is any link in bio tool based in the EU?
None of these seven tools was identified as EU-established in the documents reviewed. Linktree and Milkshake are Australian; Beacons, Stan and Link.me identify US entities; Lnk.Bio identifies a Singapore entity. Kalemi Code is headquartered in Albania and incorporated in the US, while Linkie hosts in Frankfurt. Smaller EU-based tools also exist; these seven do not represent the whole market.
Do I need a cookie banner on my link in bio page?
It depends what runs and why. Storage needed to make the page work is treated differently from optional analytics or an embedded video. Check what actually loads before a visitor chooses and after they reject, rather than whether a banner appears. If you added a tracking pixel, assume the answer is yes.
Is a free tool worse for privacy?
Price does not decide it. Compare what each plan collects and shares and which controls you get. Our breakdowns of Linktree and Beacons cover the money side.
If you want to check ours
Everything this article scores us on is public, so you can redo the checks on Linkie the same way I did on everyone else. The privacy policy names Frankfurt, the EU privacy representative and the ISO/IEC 27001 certification. The processor agreement comes through the Kalemi Code Privacy Center, pre-signed and naming Linkie, with the sub-processor list beside it. If you are buying for a German client, the AV-Vertrag is that document and it is the one to ask for first.
If you would rather look at the product than the paperwork, the free plan puts no Linkie branding on your page and does not ask for a card. Our plans page shows what Plus adds on top.
Sources and method
Primary documents, all read between 17 and 22 September 2026: the privacy policies of Linkie, Linktree, Beacons AI, Stan, Milkshake, Lnk.Bio and Link.me; Linktree’s Data Processing Addendum; Kalemi Code’s DPA and sub-processor list; and the help centre articles on pixel settings for Stan, Milkshake and Beacons. Scores reflect those documents on those dates and nothing else. Processor agreement status was rechecked on 25 October 2026 against each company’s current privacy policy and terms.
One correction worth recording. A document circulating as a Beacons processor agreement belongs to beacons.sh, a private mesh product operated by L1fe AI, which has nothing to do with Beacons AI Inc. I nearly used it. Matching names are not a corporate relationship.
