Privacy policy

This policy explains which personal data we process when you use the service, why, who we share it with, how long we keep it and how to exercise your rights. It is written to comply with Chilean Law 21.719 (which reforms Law 19.628 and takes effect on 1 December 2026), Brazil’s LGPD and the European Union’s GDPR.

1. Who is responsible

• Data controller: [RAZÓN SOCIAL]
• Tax ID (RUT): [RUT]
• Privacy contact and data protection officer (DPO): [EMAIL DPO]

If you use the service from Brazil or the European Union and the law requires a local representative, their details will be published here before launch: [LOCAL REPRESENTATIVE, IF APPLICABLE].

2. Which data we process

Category	Data	Source
Account	Name, email address, language, password hash (never the password), role and plan, date and version of the terms accepted, suspension date if any	You, when signing up
Sign-in with Google	Name, email and profile picture that Google shares with us	Google, with your authorization
Sessions	Session identifier and browser (user agent). We do not store your IP address	Your browser
Links	Destination URL, code or alias, creation and expiry dates, status	You
Click statistics	Date, country (provided by Cloudflare) and device type, in aggregate counters. We store no IP address or visitor identifier	Whoever opens a short link
Billing (Premium)	Paddle customer and subscription identifiers, status and period end. Paddle processes your card and payment data; we do not receive it	Paddle
Abuse reports	Reported link, reason, details and, if you provide it, your email	The reporter
Security	Actions by our administrators on accounts and links (audit log)	Us
Moderation events	Account and link involved, destination URL and its domain, risk signals detected (for example, blocked domain or imitated brand), severity, decision taken and who reviewed it. They do not include your IP	Us, from the link you try to create or edit

3. Why we use it and the legal basis

Purpose	Legal basis
Create your account, authenticate you and provide the link shortening service	Performance of a contract (Law 21.719; LGPD art. 7 V; GDPR art. 6(1)(b))
Charge and manage the Premium subscription, issue receipts	Performance of a contract and tax-law obligation
Send transactional emails (verification, password reset, billing and plan-change notices)	Performance of a contract
Prevent phishing, malware and other abuse: validate URLs, query Google Web Risk, keep a list of blocked domains, rate-limit abusive traffic, handle reports	Legitimate interest in the security of the service (LGPD art. 7 IX; GDPR art. 6(1)(f))
Count clicks on your links (statistics)	Performance of a contract
Keep the audit log of administrative actions	Legitimate interest and accountability
Record moderation events when a destination is rejected, goes under review or triggers a suspension, to decide, defend our measures and preserve evidence	Legitimate interest in the security of the service and in defending claims; legal obligation when an authority requires it (LGPD art. 7 II and IX; GDPR art. 6(1)(c) and 6(1)(f))
Comply with legal obligations and respond to authority requests	Legal obligation
Non-essential analytics or cookies	Consent. We do not use them today; if we enable them we will ask for your consent first

We do not sell your data and do not use it for advertising or to build commercial profiles. Automatic URL screening may reject a link or put it under review. When a signal confirms high risk (the threat provider flags it, the domain is on our blocklist or the URL carries credentials), we suspend the account immediately. This is an automated decision with a significant effect: you have the right to ask for a person to review it, to state your view and to contest it by writing to [EMAIL DPO].

4. Who we share it with (sub-processors)

Provider	Purpose	Data
Cloudflare, Inc.	Hosting and running the service (Workers, D1, KV), anti-bot protection (Turnstile), transactional email delivery and content delivery network	All service data; the IP address of site visitors passes through its network
Paddle.com Market Ltd	Payment gateway and Merchant of Record: charges you, calculates and remits taxes. Acts as an independent controller for payment and billing data	Email, country, payment and billing data
Google LLC	Sign-in with Google (OAuth) and URL checks with Web Risk	Profile data you authorize; destination URL to check

We require each provider to give contractual data protection safeguards. We may add other sign-in providers; this list will be updated before we do.

5. International transfers

Our providers operate in several countries, including the United States, so your data may be processed outside Chile, Brazil or the European Union. We only do so with providers that offer adequate safeguards, such as standard contractual clauses or other mechanisms recognized by Law 21.719, the LGPD and the GDPR, and only as far as needed to provide the service. You can ask us for more information about these safeguards at [EMAIL DPO].

6. How long we keep data

Data	Period
Account data	As long as the account exists. Deleting it removes the data in cascade, except as noted below
Inactive free accounts	24 months without activity: we notify you by email and then delete them
Sessions	30 days, renewed while you use them
Click statistics	13 months
Audit log	24 months
Moderation events	12 months from the event, even if you delete your account earlier (evidence for authorities and defense of claims)
Billing records	The period required by the applicable tax law (in Chile, 6 years) [VERIFY WITH TAX ADVISER]; they are anonymized when you delete your account
Abuse reports	While open and up to 24 months after resolution [CONFIRM PERIOD]

7. Your rights and how to exercise them

You have the right of access, rectification, erasure (cancellation), objection and portability (ARCOP), to temporarily block processing and to withdraw your consent where consent is the basis. Under the LGPD and the GDPR you also have the equivalent rights in their articles 18 and 15 to 22.

• Access and portability: in your account, Privacy section, download your data as JSON.
• Rectification: edit your profile in your account.
• Erasure: delete your account from the Privacy section. Billing records we are legally required to keep are anonymized.
• Objection, blocking and any other request: write to [EMAIL DPO]. We reply within 15 business days at most, without prejudice to the legal deadlines that apply.

We may ask you to prove your identity so that nobody else gets access to your data. Exercising your rights is free of charge.

If you are not satisfied with our answer, you can complain to the Agencia de Protección de Datos Personales (Chile), the ANPD (Brazil) or the supervisory authority of your EU country.

8. Security and breaches

We protect data with encryption in transit, hashed passwords, HttpOnly session cookies, role-based access control and an audit log. If a breach affects your data, we will notify the competent authority and the people affected without undue delay, as required by the applicable law.

9. Minors

The service is not directed at people under 18 [CONFIRM MINIMUM AGE WITH LEGAL ADVISER]. If we find an account of a minor without the authorization the law requires, we will delete it.

10. Cookies

We only use essential cookies (session and language), so the site shows no consent banner. Details are in the Cookie policy.

11. Changes to this policy

We publish every version with its date. If a change is significant, we will email you before it takes effect. We record the version of the terms you accepted when creating your account.

12. Contact

For any privacy question: [EMAIL DPO] · [RAZÓN SOCIAL], RUT [RUT].