Privacy Policy

1. Who we are

Clipto ("we", "us", "our") is a URL shortening service available at clipto.link, operated by:

Cortex Overdrive s. r. o.
Karpatské námestie 7770/10A
831 06 Bratislava - mestská časť Rača
Slovakia
Company ID (IČO): 55435670
Tax ID (DIČ): 2121985173

We are the data controller for personal data collected through this service. For privacy-related questions, contact support@clipto.link.

2. What data we collect

• Account data: name, email address, account password (bcrypt-hashed, irreversible)
• Link data: shortened URLs, destination URLs, custom slugs, expiry dates, campaign and contact assignments
• Contact data: first name, last name, organization — third-party individuals you choose to associate with links
• Link passwords (Pro): optional passwords you set on individual links — see Section 3
• Usage data: click counts and timestamps
• Click analytics: hashed IP address, user agent, referrer, country
• Billing data: subscription status (active / past due / paused / canceled) and Paddle customer ID. Payment card details are handled exclusively by Paddle and never stored by us.
• Registration IP address: stored at sign-up to prevent abuse (bulk account creation). Not shared with third parties.
• Internal service analytics: when you sign up or log in, we record aggregated, non-identifiable usage metrics such as country (derived from IP address), browser, operating system, device type, and referrer. This data is used solely by us to understand how the service is used, improve the product, and is never shared with third parties or made visible to other users.

We do not scan or inspect the destination URLs you shorten.

Contact data: When you create contacts and associate them with links, you are entering personal data about third-party individuals. You are responsible for ensuring you have a lawful basis to share this information with us. Contact data is deleted when you remove the contact or delete your account.

3. Link passwords (Pro feature)

Pro users can protect individual short links with a password. Because the dashboard lets you view a password you previously set, we store these passwords in two forms:

• A bcrypt hash, used to verify visitors who try to unlock the link. This form is irreversible.
• An AES-256-GCM encrypted copy, used to display the password back to you in your dashboard. The encryption key is derived from our application secret.

This means link passwords are technically reversible by us. Do not reuse passwords you use elsewhere as link passwords. Account login passwords are stored only as bcrypt hashes and cannot be recovered.

4. Why we collect it

• To provide the URL shortening service
• To send transactional emails (email verification, password reset, billing receipts)
• To show you analytics about your links
• To manage your subscription
• To maintain security and prevent abuse

5. Legal basis (GDPR)

• Contract performance — to provide the service you signed up for
• Legitimate interests — security monitoring and fraud prevention
• Consent — for optional communications, withdrawable at any time

6. Data retention

We retain your account and link data for as long as your account is active. Click events are retained for the lifetime of the link. Deleting your account permanently removes all associated personal data within 30 days. Billing records are retained for as long as required by applicable tax and accounting law (typically up to 7 years), even after account deletion.

Internal service analytics: The aggregated usage metrics we collect (see Section 2) may be periodically compressed into summary form (e.g. monthly totals by event type), after which the underlying individual records are deleted. These summaries do not contain personal data. This process does not affect your user-facing data — your links, click analytics, campaigns, and contacts remain intact.

No backup guarantee: While we take reasonable measures to protect your data, we do not guarantee data preservation or provide user-accessible backup or recovery services. We recommend using the export features in your dashboard to maintain your own copies of important data.

7. Your rights

Under GDPR you have the right to:

• Access — export all your data from your dashboard settings
• Erasure — delete your account and all associated data at any time
• Portability — download your data in JSON or CSV format
• Rectification — contact us to correct inaccurate data
• Object — contact us to object to processing based on legitimate interests
• Restriction — contact us to request restricted processing

We will respond to all requests within 30 days.

8. Third-party processors

• Resend — transactional email delivery
• Paddle — payment processing and subscription management (Merchant of Record — handles VAT and tax compliance)
• Cloudflare — CAPTCHA verification (Turnstile) and security services
• Railway — cloud infrastructure and hosting

9. International transfers

Our sub-processors may process your data outside the EEA. Where this occurs, we ensure adequate protection through the European Commission's Standard Contractual Clauses (SCCs) or another lawful transfer mechanism under Chapter V of the GDPR.

10. Cookies

We use the following cookies and local storage items:

• auth-token (httpOnly cookie) — maintains your authenticated session. Strictly necessary.
• theme (localStorage) — stores your light/dark mode preference. Functional, not used for tracking.

We do not use tracking or advertising cookies.

11. Data breach notification

In the event of a personal data breach posing a risk to your rights, we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR, and you directly where required by Article 34 GDPR.

12. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority in your EU member state of residence or place of work. A full list of authorities is available at edpb.europa.eu.

13. Contact

For any privacy-related questions or requests, contact us at support@clipto.link.