Roles
In short
When you use ShortZen to handle other people’s personal data, you decide what happens to it and we act on your instructions.
Where you use ShortZen to process personal data belonging to your own end users or customers (for example, destination URLs, click analytics, or bio-page visitor data), you act as the data controller and ShortZen acts as your data processor under applicable data-protection law, including the EU/UK GDPR.
Sub-processors
In short
The same providers named in the Privacy Policy, each under its own agreement, and we give notice before adding one that materially changes how data is handled.
We use the sub-processors listed in our Privacy Policy (Clerk, Neon, Dodo Payments, Resend, Vercel, Upstash, Cloudflare, Google Web Risk, Anthropic (only for AI slug suggestions and broken-link fix suggestions), Better Stack, Sentry, and PostHog), each bound by its own data-processing agreement with us. We will not engage a new sub-processor that materially changes our data-handling posture without providing reasonable notice.
Security measures
In short
Encrypted in transit and at rest, with production access restricted to authorised people and logged.
Data is encrypted in transit (TLS) and at rest at our infrastructure providers. Access to production data is restricted to authorized personnel and logged. See our Privacy Policy and Terms of Service for the full data-handling posture, retention windows, and deletion commitments.
International transfers
In short
Data may be processed outside your country, and where that needs a legal basis we rely on Standard Contractual Clauses or an equivalent.
Our sub-processors may process data outside your jurisdiction. Where required, transfers rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism maintained by that sub-processor.
Requesting a signed copy
In short
Email for a countersigned copy. Signing it does not change any of the terms above.
For a countersigned DPA (e.g. required for your own enterprise procurement process), email legal@shortzen.io. This page is the standard terms; a signed copy does not alter them.