Who we are
In short
ShortZen is the service this policy describes and the controller of the data it holds. Every route to reach us is an email address, and they are all answered.
ShortZen is a link-management service. For the data described in this policy it acts as the data controller: it decides what is collected and why. The exception is where you use it to process personal data belonging to your own customers or end users; there you are the controller and we are your processor, and the Data Processing Agreement sets out those roles.
Write to privacy@shortzen.io about anything in this policy, including a request to exercise the rights below. Security reports go to security@shortzen.io and everything else to hello@shortzen.io. These are read and answered directly rather than routed through a ticket queue.
If your own compliance process needs details this page does not carry (a countersigned copy of a document, or details for a vendor record), write to legal@shortzen.io and we will answer.
Information we collect
In short
Your account details, how you found us when you signed up, the links you make, aggregate analytics about clicks on them, and the technical data needed to bill you and keep the service safe.
Account information you provide when you sign up: your name, email address, and the authentication details handled by our identity provider, Clerk.
How you found us, recorded once when you sign up: the campaign (UTM) values on the link you followed, the hostname of the site that sent you (not its full address), the page you landed on and which button you pressed. It is read from the page you arrive on and kept with your account record, not in your browser, and it is deleted with your account.
Product data you create: destination URLs, slugs, tags, custom domains, and the links you shorten.
Analytics we generate when your links are visited: click counts, referrers, approximate country and city (derived from IP, not stored as a profile), device, and browser. Unique-visitor counts are computed with HyperLogLog, a privacy-preserving estimation method that does not retain individual visitor identities. If a workspace opts into Audience analytics, we also set a first-party cookie (`sz_vid`) on the short domain and store only an HMAC of that cookie bound to the workspace: never the cookie value, never an IP as an identity. That hash is used only for new-versus-returning metrics and last-click conversion attribution, and it is deleted with the click row when analytics retention runs. When conversion tracking is also entitled, the redirect may append a short-lived opaque token to the destination URL (not the cookie) so the destination can attribute a conversion; the token expires in 24 hours and is not a stable identifier.
Technical and billing data: IP address and request metadata used for security and rate-limiting, and payment details processed by Dodo Payments (we never store full card numbers).
How we use your information
In short
To run the service, to keep it free of abuse, and to write to you about your account. Non-essential email is opt-out from Settings.
To operate the service: creating short links, resolving redirects, and producing the analytics you see in your dashboard.
To secure the platform: detecting abuse, enforcing rate limits, screening destinations for malware and phishing, and investigating violations of our terms.
To communicate with you about your account, billing, security, and material changes to the service. You can opt out of non-essential product and marketing email from Settings.
Data retention & deletion
In short
You can delete your account at any time. There is a 14-day window to change your mind, then erasure completes within 30 days, apart from records we are legally required to keep.
We retain personal data for as long as your account is active, then delete or anonymise it. Analytics history is retained per your plan (30 to 730 days).
You can delete your account at any time from Settings. Deletion is not immediate: we hold the account for a 14-day grace period during which you can cancel it and keep everything, then permanently erase your personal data and links. Erasure completes within 30 days of your request.
Some records survive erasure because we are required to keep them. Invoices and subscription records are retained to meet legal and accounting obligations; security and audit entries are retained with your identifiers reduced to an anonymous reference; and if you have unsubscribed, we keep your email address on a do-not-contact list so we do not write to you again. Workspaces shared with other people are not deleted: content you created there stays with the workspace and is reassigned to a remaining owner.
Your rights
In short
You can ask to see, correct, export or delete your personal data, and we answer within the time the law where you live allows.
Depending on where you live (including under the EU/UK GDPR, the California CCPA/CPRA, and India's DPDPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.
To exercise any of these rights, email privacy@shortzen.io. We respond within the timeframe required by applicable law.
Contact
In short
One address for anything about this policy or your data.
Questions about this policy or your data? Email privacy@shortzen.io.