Privacy Policy

1. Who this policy covers

This policy explains how Redirect Console ("the Service", operated by [LEGAL ENTITY NAME] of [ADDRESS], "we", "us") handles personal information in two roles:

• Account holders — people who register for an account to manage redirects. For you we act as a service provider.
• Visitors — people who follow a redirect or land on a page hosted by the Service on one of our customers' domains. For you, the customer who owns that domain is the responsible party for the redirect's destination; we process visitor data described below on their behalf.

2. What we collect

• Account data: name, email address, password (hashed), optional two-factor settings, API token labels, and billing status. Payment card data is handled entirely by our payment processor [STRIPE / PROCESSOR NAME] and never reaches our servers.
• Click/visit data (for redirects you operate): the visitor's IP address (see §4 for truncation), browser user agent, referring page, the link path visited, bot classification, and the time of the visit. Used to operate the redirect, protect against abuse, and provide click statistics.
• Security logs: failed sign-in attempts (30-day retention) and an administrative audit trail of changes made in the console.
• Billing records: subscription status events (90-day retention in-app; the processor retains its own records).
• GeoIP: country-level IP geolocation is performed only if an administrator has enabled a licensed provider, and only over an encrypted connection. When no provider is enabled, no geolocation occurs at all.

3. Cookies

The Service sets a single strictly-necessary session cookie after sign-in. We do not use advertising, analytics, or third-party tracking cookies.

4. Retention and anonymization

Click IP addresses are stored in truncated form — IPv4 addresses keep their first three octets (e.g. x.x.x.0) and IPv6 addresses are cut to their /48 network prefix — so full visitor addresses are not retained in click logs. Country-level statistics remain accurate at this granularity. Click data is retained for a default of 730 days and then automatically deleted. Sign-in attempt logs are deleted after 30 days; in-app billing events after 90 days. Closed accounts are deleted as described in §6.

5. Access and correction

Account holders can view and correct their name and email from My Profile at any time, and download a copy of their data ("Download my data"). You may also contact [PRIVACY CONTACT EMAIL] to exercise access, correction, or privacy-rights requests (including under PIPEDA, GDPR, or applicable state law), and we will respond within a reasonable period.

6. Deletion

Accounts that own no redirects or registered domains can be deleted self-service from My Profile. Otherwise — so that shared infrastructure and other users' data are not damaged — deletion is handled by support on request to [PRIVACY CONTACT EMAIL]. Deleting an account removes the account record, credentials, two-factor data, and API tokens; click history tied to deleted redirects is removed with them.

7. Sharing

We do not sell personal information. We share it only with: infrastructure providers who host the Service ([HOSTING PROVIDER(S)]), the payment processor, and the email delivery provider used for transactional messages — each solely to operate the Service, or when required by law.

8. Security

Credentials are stored hashed; administrative access requires two-factor authentication; traffic is served over HTTPS. No system is perfectly secure, and we make no guarantee of absolute security.

9. Your jurisdiction rights

Depending on where you live, you may have additional rights (access, deletion, correction, withdrawal of consent, complaint to a regulator — e.g. a Canadian privacy commissioner, a EU member-state supervisory authority, or a US state attorney general). Nothing in this policy limits those rights.

10. Changes

We may update this policy; material changes will be reflected by a new effective date above. Continued use after a change constitutes acceptance where permitted by law.

11. Contact

Privacy questions: [PRIVACY CONTACT EMAIL]. Abuse reports: abuse@urlpath.cloud.