Privacy Policy

This Privacy Policy describes how OctoURL ("we", "us", "our") collects, uses and protects personal data when You use our website at https://octourl.com, our short links, our dashboard and our API (together, the "Service"). It also explains the rights You have over that data.

OctoURL is the data controller for the personal data described here. For questions about this policy, or to exercise any of Your rights, contact us at [email protected] or through our contact page.

Data We Collect

Account data

When You create an account we store Your email address, Your first and last name if You provide them, Your country, and the date Your email was verified. We do not store account passwords: sign-in works either through a one-time link sent to Your email address, or through Google Sign-In, in which case we store the identifier Google returns for Your account.

Billing data

Payments are processed by Stripe. We never see or store Your full card number. Our records hold Your Stripe customer identifier, the card brand and its last four digits, Your subscription status and plan, and the invoices and transactions issued to You.

Content You create

We store the links You shorten - destination URL, alias, label, tags, expiry date, any password You set on a link - along with any custom domains You connect and the API keys You issue. If You shorten a link without an account, we store it against an anonymous token in Your browser rather than against an identity.

Click data

Every time someone follows a OctoURL short link, we record the visit so the owner of that link can see its statistics. Each record contains the IP address, the browser user agent string, the referring page, the country derived from the IP address, and the browser, operating system and device type parsed from the user agent, plus whether the visitor appeared to be an automated bot. This is collected about the person clicking the link, who may not be an OctoURL account holder.

Marketing attribution

On Your first visit we record where You came from - the referring website, the campaign parameters in the URL, and the first page You landed on. If You later create an account, that information is attached to it so we can understand which channels bring people to the Service.

Support and abuse reports

Messages You send through our contact form, and reports submitted through our "Report a Link" form, are stored together with the name, email address and IP address supplied with them.

Technical data

Our servers and error monitoring keep short-lived technical logs of requests and exceptions, which can include IP addresses and user agents. Website usage is measured as described in our Cookie Policy.

Why We Use It, and On What Legal Basis

• To provide the Service - creating and resolving short links, showing You Your analytics, authenticating You, and supporting You. Legal basis: performance of our contract with You.
• To take payment - subscriptions, one-time purchases, invoices and refunds. Legal basis: performance of our contract, and our legal obligation to keep accounting records.
• To keep the Service safe - rate limiting, fraud and abuse prevention, and acting on reports of malicious or illegal links. Legal basis: our legitimate interest in protecting the Service and the people who click our links.
• To measure and improve - understanding which pages and channels work. Legal basis: Your consent for cookie based analytics, and our legitimate interest for aggregate, cookieless measurement.
• To communicate - service emails such as sign-in links, receipts and important changes. Legal basis: performance of our contract. Marketing email, if we ever send it, is sent only on the basis of Your consent, and every message carries an unsubscribe link.

We do not sell Your personal data, and we do not use Your links or Your click data to build advertising profiles of You.

Who We Share It With

We share personal data only with the service providers that make the Service work, each under a data processing agreement that limits them to processing it on our instructions:

• Stripe - payment processing, subscription management and invoicing.
• Google - Google Sign-In where You choose it, and Google Analytics where You consent to analytics cookies.
• Resend - delivery of transactional email such as sign-in links and receipts.
• Sentry - error and performance monitoring, which may incidentally include technical request data.
• Cloudflare - traffic delivery and protection, which also supplies the country we associate with a request.
• Telegram - we send ourselves an internal notification containing the email address and name of each new account so that we notice signups as they happen.
• Our hosting and database providers - storage and serving of the Service.

We may also disclose personal data where we are legally required to do so, where it is necessary to establish, exercise or defend legal claims, or in connection with a merger, acquisition or sale of assets - in which case we will notify You before Your data becomes subject to a different privacy policy.

International Transfers

Some of our providers process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, so Your data keeps an equivalent level of protection.

How Long We Keep It

• Account data - for as long as Your account exists. When You delete Your account we remove it, apart from records we must retain by law, such as invoices.
• Links - for as long as they exist in Your account. A deleted link is recoverable for 30 days and is then permanently purged, together with its click records.
• Links created without an account - permanently deleted 7 days after creation.
• Deleted API keys - permanently purged 30 days after deletion.
• Click records - kept for the life of the link they belong to, so that its statistics remain meaningful.
• Contact messages and abuse reports - kept for as long as needed to handle the matter and to defend against repeat abuse.
• Billing records - kept for the retention period required by applicable tax and accounting law.

Your Rights

Under the GDPR and equivalent laws You have the right to access the personal data we hold about You, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent You have given without affecting processing that already took place.

You can exercise most of these directly: Your profile settings let You correct Your details and delete Your account and its links outright, and the cookie banner lets You change or withdraw Your cookie consent. For anything else, write to [email protected] and we will respond within one month.

If You believe we have handled Your data improperly, You also have the right to lodge a complaint with Your local data protection supervisory authority.

Security

All traffic to the Service is encrypted in transit. Passwords You set on individual links are stored hashed, never in readable form, and API keys are stored as hashes so they cannot be recovered after they are shown to You once. We apply a strict content security policy, rate limit sensitive endpoints, and restrict internal access to personal data to those who need it. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

Links to Other Sites

A short link takes the visitor to a destination we do not operate. Once they arrive, that site's own privacy policy governs what happens to their data. We strongly advise reviewing the privacy policy of every site You visit.

Children's Privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If You believe a child has provided us with personal data, contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised, and we will notify account holders by email of any material change before it takes effect. Your continued use of the Service after a change means You accept the updated policy. See also our Terms and Conditions.

Contact Us

If You have any questions about this Privacy Policy, contact us by email at [email protected].