Draft
Draft for the owner to review before this page is used for Paddle domain review. It is not legal advice. Replace the bracketed name and contact address before publication. GDPR applies because the seller is an individual in Sweden.
The controller for the account and the short links is the seller, an individual in Sweden: [your legal name], [contact email]. Paddle is the merchant of record and an independent controller for the payment data it collects at checkout.
An account stores an email address and a password hash. A session stores a hash of the cookie, a security token, a coarse browser family, and an expiry. Raw IP addresses are not stored. The waitlist stores an email address and the time consent was given, and it sends nothing. Links store the destination URL and a tracking-stripped form of that URL. Clicks are stored only as daily totals by class. The short domains set no cookies.
Link destinations are compared on our server with copies of the PhishTank, abuse.ch URLhaus, and OpenPhish feeds. Those URLs are not sent to those services. When Google Web Risk is switched on, the destination URL is sent to Google for a lookup.
Click totals are kept for 30 days on Free, one year on Starter, and while the subscription is active on Pro. This retention is a draft and the owner must confirm it. You can ask for access, correction, or deletion of the account data by writing to [contact email]. You can also complain to the Swedish Authority for Privacy Protection (IMY).
We do not sell personal data.