Privacy Policy & Data Security Statement

Data Protection & Privacy Governance

Last Updated & Effective: October 07, 2026 | Version: 4.0

Commitment to User Privacy: At FreeURLShort, we believe privacy is a fundamental digital right. We design our link management infrastructure, redirection engine, and telemetry analytics from the ground up to minimize data collection, protect personal anonymity, and comply strictly with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and global privacy frameworks.

1. Introduction & Identity of Data Controller

This Privacy Policy governs the manner in which FreeURLShort ("we", "us", "our", or "the Platform") collects, uses, maintains, protects, and discloses information gathered from users ("Users", "Account Holders", or "Visitors") of our website (freeurlshort.com), our REST API, customer management dashboards, and any shortened link redirected via our domain infrastructure.

For the purposes of applicable data protection legislation (including GDPR Article 4(7)), FreeURLShort operates as the Data Controller for personal data collected through user accounts, customer service interactions, and website navigation. For redirection telemetry processed on behalf of business customers utilizing our custom domain enterprise engine, FreeURLShort acts as a Data Processor.

2. Categories of Information We Collect

We collect information in three distinct contexts to deliver reliable, lightning-fast URL shortening and analytics services:

A. Information You Voluntarily Provide to Us

• Account Registration & Profile Details: When you register an account, we collect your full name (strictly validated alphabet characters), unique email address, encrypted password hash (utilizing industry-standard bcrypt with high work factors), and chosen profile preferences.
• Custom Domain & Branded Link Configurations: When you connect a custom domain via CNAME, we store the domain hostname, DNS validation status, custom root-redirect destinations, and custom 404 fallback targets.
• Billing & Subscription Records: When you subscribe to premium tiers, transaction processing is handled via PCI-DSS Level 1 certified third-party payment gateways (e.g., Stripe, PayPal). We store non-sensitive billing metadata including transaction identifiers, plan type, invoice history, and billing dates. We never store raw payment card numbers on our servers.
• Customer Support Communications: Content of support tickets, email inquiries, and bug reports submitted through our contact channels.

B. Information Collected Through Short Link Redirections (End-User Telemetry)

When an internet user clicks or scans a shortened link powered by FreeURLShort, our edge routing nodes capture necessary network telemetry to provide aggregated analytics to the link creator while safeguarding the visitor's individual identity:

• IP Address Anonymization: Incoming IP addresses are temporarily evaluated to determine coarse geographical location (country and metropolitan city) and detect automated bot traffic. To protect privacy, all stored IP addresses are automatically pseudonymized and truncated (the final octet for IPv4 or the final 64 bits for IPv6 are masked before any database storage or analytics aggregation).
• Browser User-Agent & Device Type: We parse HTTP headers to identify the browser family (e.g., Chrome, Safari, Firefox), operating system (e.g., iOS, Android, Windows, macOS), and hardware form factor (Mobile, Desktop, Tablet) to generate device breakdown statistics.
• HTTP Referrer Information: The originating URL or platform where the short link was clicked (e.g., Twitter/X, LinkedIn, Facebook, direct email client), enabling link creators to evaluate marketing campaign performance.
• Timestamp & Redirection Status: The exact date, time, and HTTP redirection code (301 Permanent or 307/308 Temporary) associated with the click event.

C. Information Collected Automatically on Our Website

When you navigate our marketing and dashboard web pages, we collect standard server logs and employ privacy-preserving session cookies to maintain your login session, prevent Cross-Site Request Forgery (CSRF), and monitor platform security. Please refer to our dedicated Cookie Policy for complete details.

3. Legal Bases for Processing Under GDPR (Article 6)

Under European data protection law, we only process personal information when we have a verified lawful basis to do so:

Processing Activity	Categories of Data	Lawful Basis under GDPR
Account Provisioning & Authentication	Name, email, password hash, session tokens	Performance of a Contract (Art. 6(1)(b)) — Necessary to deliver your account services.
Executing URL Redirections	Destination URL, short slug, routing tags	Performance of a Contract (Art. 6(1)(b)) — Fulfilling the primary core link shortening service.
Click Analytics Aggregation	Anonymized IP, Referrer, User-Agent, Country	Legitimate Interests (Art. 6(1)(f)) — Legitimate interest in providing link performance telemetry.
Anti-Abuse & Phishing Detection	Destination URL, request headers, IP reputation	Legitimate Interests (Art. 6(1)(f)) & Legal Obligation (Art. 6(1)(c)) — Protecting the internet ecosystem from malicious actors.
Customer Support & Inquiries	Name, email, message history	Legitimate Interests (Art. 6(1)(f)) — Responding to user support inquiries effectively.
Billing & Tax Compliance	Invoices, transaction IDs, VAT/country data	Legal Obligation (Art. 6(1)(c)) — Adhering to statutory tax, financial, and accounting laws.

4. How We Use and Share Information

We use personal information strictly for legitimate product delivery and security governance. We do not sell, rent, trade, or monetize your personal information or your visitors' click data to data brokers, third-party advertising networks, or marketing agencies.

We only share data with trusted sub-processors bound by strict confidentiality and data protection agreements (DPAs):

• Infrastructure & Edge Hosting: Distributed edge cloud providers (e.g., Cloudflare, Hetzner, AWS) for DDoS mitigation, Anycast routing, and server computing.
• Transactional Email Services: Transactional email delivery providers (e.g., Mailgun, Amazon SES) for password resets, email verification, and critical service notifications.
• Payment Gateways: PCI-compliant billing processors (Stripe, PayPal) for subscription handling.
• Law Enforcement & Legal Requests: We may disclose information if required to comply with a valid court order, subpoena, or lawful government request, or to investigate illegal malware distribution, child exploitation material, or cyber terrorism.

5. Data Retention Schedules

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Account Data: Retained for the duration of your active account lifecycle. If you delete your account, your profile data, API keys, and custom domain bindings are permanently deleted within thirty (30) days.
• Raw Click Logs: Raw IP logs are anonymized within twenty-four (24) hours. Aggregated statistical counters (e.g., total clicks per day, top countries, top referrers) are retained to provide ongoing historical charts for your active links.
• Deleted Short Links: When you delete a short link from your dashboard, the redirection route is immediately deactivated, and underlying routing records are expunged from primary databases within 30 days.
• Financial & Tax Invoices: Retained for statutory periods (typically 7 to 10 years) to satisfy regulatory accounting and tax audits.

6. Global Privacy Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you have comprehensive statutory rights over your personal data:

• Right of Access (Art. 15 GDPR): You have the right to request a complete copy of the personal information we hold about you.
• Right to Rectification (Art. 16 GDPR): You may update or correct inaccurate profile details at any time directly through your Customer Dashboard.
• Right to Erasure ("Right to Be Forgotten") (Art. 17 GDPR): You have the right to request the complete deletion of your account and associated personal data.
• Right to Data Portability (Art. 20 GDPR): You can export your link data, redirection targets, and aggregated telemetry in structured JSON or CSV format.
• Right to Restrict or Object to Processing (Arts. 18 & 21 GDPR): You may object to processing based on legitimate interests or request temporary restriction of processing.
• California Consumer Privacy Rights (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, opt out of any sale/sharing of personal data (FreeURLShort does not sell or share data), and receive equal service without discrimination.

To exercise any of these rights, please contact our Data Protection Team at privacy@freeurlshort.com. We verify your identity and respond to all verified requests within thirty (30) days without charging a fee.

7. Data Security Safeguards

We employ robust technical and organizational security measures (TOMs) designed to protect data against unauthorized access, destruction, loss, or alteration:

• End-to-end transport layer security (TLS 1.3 encryption) for all data in transit across our web portals, API, and redirection gateways.
• Strong cryptographic password hashing utilizing bcrypt with individual unique salts.
• Database encryption at rest utilizing AES-256 for sensitive configuration fields.
• Isolated multi-tenant data architecture and strict role-based access control (RBAC) ensuring employees access data only on a verified need-to-know basis.
• Automated vulnerability scanning, web application firewalls (WAF), rate-limiting, and distributed denial-of-service (DDoS) mitigation.

8. International Data Transfers

Your information may be transferred to, stored, and processed in servers located outside your country of residence, including within the European Union and the United States. Where personal data originating in the European Economic Area (EEA), United Kingdom, or Switzerland is transferred internationally, we ensure adequate protections are in place by relying on the European Commission's approved Standard Contractual Clauses (SCCs) and participating in the EU-U.S. Data Privacy Framework where applicable.

9. Children's Privacy

Our platform is an enterprise-grade developer and marketing tool strictly directed at individuals aged 16 and older. We do not knowingly solicit or collect personal information from children under the age of 16. If we learn that we have inadvertently collected information from a child under 16 without parental consent, we will promptly delete that information from our records.

10. Contacting Our Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data protection practices, please contact our Data Protection Officer: