This policy explains what personal information ShortURL.is collects, why, who we share it with, how long we keep it and what rights you have. It covers:
- people with an account;
- visitors to shorturl.is;
- people who click our short links, scan our QR codes or visit bio pages;
- anyone who contacts us or reports a link.
Who we are
ShortURL.is (shorturl.is and our short link domains such as gourl.is) is run by a sole trader in the United Kingdom, who is the controller of the information described here. Contact: [email protected], or our contact page.
Pages made by our customers. If you fill in a form on a bio page or overlay made by one of our customers, or a customer adds tracking pixels to their links or pages, that customer decides what is collected and why. For that information the customer is the controller and we handle it on their behalf. Please contact them about it.
Information we collect
If you have an account
- Account details: email address, username, password (stored only as a one-way hash), your name if you add it, and a profile picture if you upload one.
- Sign-in with another account: if you choose to sign in with another account (the sign-in button on the login page), we receive that account's ID, your name and your email address. We never see its password.
- Sign-in through someone else's single sign-on: if whoever manages a workspace you use, such as your employer, has set up single sign-on for ShortURL.is, their sign-in system tells us who you are each time you sign in: an identifier from that system, your name and your email address. If their system also manages accounts for us automatically, it sends us the same details, and whether your access is switched on, before you have ever visited the site. In that case we received your information from their system, not from you. They can also end your access to their workspace and sign you out.
- Billing details: name or company name, billing address, country and tax number if you give one. Card payments are handled by our payment provider. We never see your full card number; we receive the card type, the last four digits and the expiry date.
- Country at sign-up: worked out from your IP address.
- Sign-in history: for each sign-in, the date, IP address, approximate location (city and country), browser and operating system. You can see it on your account's Security page. We use it to warn you about sign-ins from new places.
- Security settings: your two-factor authentication settings.
- What you create:
- links, aliases, bio pages, QR codes, uploaded images and files;
- connected domains, tracking pixel IDs and campaign names;
- email addresses of team members you invite;
- details of tools you connect, such as account IDs or access keys.
- Affiliate programme: if you join, the email address you give for payouts and a record of the customers you refer.
- Emails with us: messages you send us and our replies.
If you click a short link, scan a QR code or visit a bio page
For each visit we record:
- the date and time, and which link or page it was;
- your IP address;
- your approximate location (country and city), worked out from the IP address without sending it to anyone else;
- your browser and operating system (the name only);
- your device's language setting;
- the page you came from, if your browser shares it.
We use this to count visits and show the link's owner statistics: totals, countries, cities, browsers, operating systems, languages and referring sites. The link's owner never sees your IP address. We do not count clicks by known bots, or by owners on their own links.
If you visit shorturl.is
- Our hosting and security providers process your IP address and basic request details to deliver pages and protect the site.
- Website analytics run only if you accept analytics cookies in our cookie banner.
- Some forms (sign-in, sign-up, contact, report and shortening without an account) use a bot-protection check.
If you contact us or report a link
- Contact form: your name, email address and message are emailed to us. Before that, they are checked for spam by a spam-checking service.
- Link reports: the link, the reason, your email address and your IP address. We remove the IP address once the report has been dealt with.
If you shorten a link without an account
We store the link and when it was created. A cookie may remember your recent links in that browser, and the links you made just before signing up so we can add them to your new account.
Why we use it, and our lawful basis
- Providing the service you signed up for: your account, links, pages, QR codes, statistics, billing and service emails such as security alerts and receipts. Lawful basis: our contract with you.
- Single sign-on: letting you sign in through the sign-in system of whoever manages your workspace, and letting them add you to it and remove you from it. Lawful basis: our contract with the account holder who set it up, and legitimate interests (yours, theirs and ours) in secure, managed access.
- Click statistics: counting visits and showing owners how their links perform, and spotting misuse. Lawful basis: legitimate interests (ours and our customers'), kept to the minimum described above.
Keeping the service safe:
- sign-in history and limits on repeated attempts;
- checking links against safety services;
- blocking misleading aliases;
- dealing with reports.
Lawful basis: legitimate interests in protecting our users, the people who click links, and the service.
- Keeping records the law requires, such as payment and tax records. Lawful basis: legal obligation.
- News about ShortURL.is: occasional emails about our service to account holders. Lawful basis: legitimate interests, and the "soft opt-in" for customers under the Privacy and Electronic Communications Regulations. You can unsubscribe at any time with the link in any of these emails or in your account Settings.
- Weekly report email: on plans that include it, sent to account holders. You can turn it off in Settings.
- Website analytics: lawful basis: your consent, which you can withdraw at any time from the cookie settings.
We do not sell personal information and we do not use it for advertising.
Who we share it with
We use these kinds of providers to run the service. They may only use the information to provide their service to us, and are bound by contract to protect it.
- Hosting providers: host our systems and data in the European Economic Area.
- Delivery and security providers: deliver and protect our sites, including bot checks on forms.
- Email providers: send and receive our email.
- Payment providers: take card payments and hold billing details. They also act as controllers for their own fraud-prevention and legal duties.
- Sign-in providers: only if you choose to sign in with another account and, if whoever manages your workspace has set up single sign-on, their own sign-in system.
- Analytics providers: help us measure how the site is used, only with your consent.
- Link-safety and spam-checking services: check link destinations for danger (only the destination address is sent) and messages sent through contact forms for spam.
- Icon and avatar services: your browser asks them for the icon of a link's destination site in your dashboard, and, if you have not uploaded a profile picture, for one using a scrambled (hashed) form of your email address.
- Tools you connect: only if you connect them to your account.
- Our customers: the owner of a link or bio page sees the statistics described above, and the information you send through their forms.
You can ask us at any time which providers have handled your information. Account holders can also ask for the full list of providers we use, at [email protected].
We may also share information:
- if the law requires it, or to protect people from fraud or harm;
- with someone who takes over the service, in which case this policy continues to apply.
Where it is stored
- Our own systems and email are hosted in the European Economic Area. UK law treats it as giving adequate protection.
- Some providers may process information in the United States or elsewhere. When they do, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework or by the UK's approved data transfer contracts.
How long we keep it
- Account information: while your account is open. When the account is deleted we delete it, and copies in our backups are removed as the backups are replaced.
- Click statistics (including IP addresses): for the data retention period of the link owner's plan, shown on our pricing page, and then deleted automatically. If a paid plan ends, we keep the account's records for 90 days in case it comes back, and after that only what the free plan's period allows. Click records for links made without an account are kept with no end date, but their IP addresses are removed after 30 days.
- Sign-in history: while your account is open.
- Records linking your account to a single sign-on system (an identifier from that system, your email address as it was when you last signed in, and the date): while your account and that single sign-on connection both exist. We delete them when either ends; for a deleted account this happens within a day.
- Payment and tax records: as long as tax law requires, usually six years.
- Form submissions on customers' pages: until the customer deletes them or their account is deleted.
- Contact messages and link reports: as long as we need them to deal with the matter and prevent repeat abuse.
- Security records (such as blocked sign-in attempts): as long as we need them to protect the service.
- Analytics data: 14 months.
Cookies
We use these cookies and similar storage:
Essential (needed for the site to work)
- A session cookie that keeps you signed in during a visit and protects forms and password-protected links. Deleted when you close your browser.
- A sign-in cookie that keeps you signed in if you choose "remember me". Up to 30 days.
- A cookie that ties a single sign-on sign-in to the browser that started it, so nobody else can complete it for you. 10 minutes.
- A cookie that remembers your cookie choices. 1 year.
- Security cookies from our delivery and security provider, to protect the site against bots and attacks. 30 minutes to 1 year.
- A cookie that pauses sign-in after too many failed attempts. 1 hour.
- Cookies that remember a language you choose (1 day), the bio page name you picked while signing up (2 days), and that you accepted cookies on a link's consent page (15 days).
- Your browser's storage that remembers light or dark mode.
Link and guest features
- A cookie set when you click a short link, so a repeat click within 15 minutes is not counted twice. 15 minutes.
- A cookie that remembers the links you shortened without an account. 1 year.
- A cookie that remembers the links you shortened just before signing up, so they can be added to your new account. 30 days.
- A cookie that remembers which affiliate referred you, if you arrived through a referral link. 90 days.
Analytics (only if you accept)
- Cookies from our analytics provider that help us understand how the site is used. Up to 2 years.
You can change your choice at any time through the cookie settings, and you can delete cookies in your browser.
Bio pages and link pages made by our customers may also load their own tracking pixels or embedded content (such as videos, maps or booking tools). Those set their own cookies, under the customer's responsibility.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your information;
- correct it;
- delete it;
- restrict how we use it;
- send it to you or another organisation in a portable form.
You can also:
- object to our use of it, and at any time to direct marketing;
- withdraw consent where we rely on it.
To use these rights, email [email protected]. We may need to confirm who you are, and we will reply within one month.
For click records, we cannot usually tell which visits were yours unless you give us the link, the approximate time and your IP address.
If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Security
We protect your information with:
- encrypted connections;
- passwords stored as strong one-way hashes;
- optional two-factor authentication;
- measures to detect and block misuse and attacks;
- access limited to what is needed to run the service.
No system is perfectly secure, so please use a strong, unique password and turn on two-factor authentication.
Automated checks
We automatically check new links and aliases against safety services and block lists, and may disable a link that fails. These checks are about links, not people. If you think we have blocked something by mistake, contact us and a person will review it.
Children
The service is not for anyone under 18, and we do not knowingly collect information about children. If you believe a child has given us information, please contact us and we will delete it.
Changes to this policy
We may update this policy when the service or the law changes. If a change is significant, we will tell account holders by email or on the site before it takes effect. The date at the top shows when it last changed.