Global Privacy Policy
At 2urly.com, protecting your privacy and safeguarding data transparency is fundamental to our platform. This Global Privacy Policy explains what information we collect when you create short links, scan QR codes, view Link-in-Bio pages, or register an account, how we process and protect that information, and your statutory rights under the EU General Data Protection Regulation (GDPR), UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA).
1. Categories of Information We Collect
- Account & Profile Information: When you register for an account, we collect your name/brand name, chosen username (`@handle`), email address, and bcrypt-hashed password.
- Shortened Link & Bio Page Data: Destination URLs, custom back-half aliases, QR code configurations, and public Bio Page links submitted by users.
- Redirect & Click Telemetry: When a visitor clicks a 2urly short link or scans a 2urly QR code, our edge routers process standard HTTP request metadata (anonymized/truncated IP country lookup, browser user-agent family, referring domain, and timestamp) to perform the redirect, prevent bot abuse, and generate aggregate click counts.
2. Legal Bases for Processing (GDPR Article 6)
| Processing Activity | Data Categories | GDPR Legal Basis | Retention Period |
|---|---|---|---|
| URL Redirection & QR Routing | Short code, Destination URL, HTTP Headers | Article 6(1)(b) Contract & 6(1)(f) Legitimate Interest | Active life of link |
| Account & Bio Page Hosting | Name, Email, `@username`, Bio JSON | Article 6(1)(b) Performance of Contract | Until account deletion |
| Trust & Safety Anti-Abuse | Security logs, Phishing/Malware indicators | Article 6(1)(f) Security & Fraud Prevention | 90 Days rolling |
| Consent & Privacy Preferences | Cookie consent state (`2urly_consent`) | Article 6(1)(c) Legal Obligation | 12 Months |
3. How We Share & Protect Information
We never sell your personal information to third-party data brokers. Data is processed exclusively through vetted infrastructure partners (such as Cloudflare global edge network for DDoS/TLS termination) under strict Data Processing Addendums (DPAs) and TLS 1.3 encryption.
4. Your Privacy Rights (GDPR, UK GDPR & CCPA)
Depending on your location, you have the right to: (a) access and export a copy of your personal data, (b) rectify inaccurate profile details, (c) request permanent erasure ("Right to be Forgotten"), (d) restrict or object to processing, and (e) opt out of non-essential cookies at any time via our Interactive Privacy Manager.