Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you create an account, we collect:

• Email address
• Username and password (encrypted)
• Payment information (processed securely by our payment providers)
• Any URLs you choose to shorten
• Custom aliases you create

1.2 Analytics Data

When someone clicks your shortened links, we collect:

• Click timestamps
• Referrer information (where the click came from)
• Device and browser information
• Approximate geographic location (country/city level)
• IP addresses (anonymized after 30 days)

1.3 Automatically Collected Information

We automatically collect certain technical information including cookies, log data, and usage statistics to improve our service and ensure security.

1.4 Short links, app sessions, and payments

Visiting a shortened destination link does not rely on first-party marketing cookies for the click. When you use our web application, we set a strictly necessary HTTP-only session cookie after login to keep you signed in until you log out or the session expires. Subscriptions and billing use Stripe Checkout and the Stripe Customer Billing Portal; card and billing details are handled on Stripe's systems in line with Stripe's privacy policy.

2. How We Use Your Information

We use collected information to:

• Provide and maintain our URL shortening service
• Generate analytics and insights for your shortened links
• Process payments and manage your subscription
• Send you service updates and important notifications
• Improve our product and develop new features
• Prevent fraud and ensure platform security
• Comply with legal obligations

3. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• Service Providers: Third-party companies that help us operate (e.g., cloud hosting, payment processing)
• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: In the event of a merger, acquisition, or sale of assets
• With Your Consent: Any other sharing will be done with your explicit permission

4. Data Security

We implement industry-standard security measures including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Regular security audits and updates
• Access controls and authentication
• Secure data centers with physical security

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

5. Your rights (GDPR)

If the GDPR applies to our processing of your personal data, you have in particular the rights under Articles 15–22 GDPR, including to:

• Access (Art. 15): Obtain confirmation and a copy of your personal data we process
• Rectification (Art. 16): Correct inaccurate or incomplete data
• Erasure (Art. 17): Request deletion where applicable
• Restriction (Art. 18): Request restriction of processing in defined cases
• Data portability (Art. 20): Receive your data in a structured, machine-readable format where applicable
• Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time

You may also lodge a complaint with a supervisory authority. For our seat in Berlin, the competent authority is typically the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI).

To exercise your rights, contact us at privacy@shorty.com. You are not required to use a specific form; please describe your request clearly so we can respond within one month (subject to any permitted extension under Art. 12 GDPR).

6. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Analyze how you use our service
• Improve performance and user experience

You can control cookies through your browser settings, but some features may not work properly if disabled.

7. Data Retention

We retain your data as long as your account is active. After account deletion, we delete or anonymize your personal data within 90 days, except where we're legally required to retain it longer. Analytics data is anonymized after 30 days.

8. International data transfers

Some subprocessors (e.g. payment or hosting) may process data outside the European Economic Area (EEA). Where required under Chapter V GDPR, we rely on appropriate safeguards such as the European Commission's standard contractual clauses (SCCs) or adequacy decisions. A copy of relevant safeguards may be provided upon request where not already published by the processor.

9. Children and adolescents

The service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 without applicable parental consent under national law. If you believe we have collected such data, please contact us immediately so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes via email or through our service. Continued use of Shorty after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: info@wunderdata.com
• Postal / business address: Wunderdata GmbH, Angermünder Straße 20, Haus B 104, 16247 Joachimsthal, Germany — see Impressum.
• Contact form: Contact us