1. Scope
This Privacy Policy applies to SURLS.me websites, applications, APIs, link infrastructure, and related services that link to or reference this Policy. It describes how information is handled when you visit our website, create or use an account, create or access links, use our APIs, or otherwise interact with the service.
SURLS.me is designed to provide secure link infrastructure. Some customers may use the service to process links or files on behalf of their own users. In those situations, the customer may have additional privacy responsibilities for the data they control.
2. Information we may collect
Account information
When you create an account, we may collect information such as your name, email address, authentication information, organization or workspace information, and account preferences.
Link and service data
Depending on the features you use, we may process destination URLs, short codes, custom domains, link settings, expiration times, usage limits, access-control settings, files or file references, API configuration, and other information needed to provide the service.
Usage and technical information
We may collect technical information associated with requests and service usage, such as IP address, browser or user-agent information, device information, timestamps, referring URL, approximate geographic information, request status, and security events. The exact information collected depends on the feature and configuration involved.
Payment information
If you purchase a paid service, payment information may be processed by our payment providers. We may receive transaction identifiers, billing status, plan information, and limited billing details needed to manage your account, but payment-card information may be handled directly by the payment provider.
3. How we use information
We may use information to:
- create and administer accounts;
- create, redirect, protect, deliver, and analyze links;
- provide requested webpages, files, APIs, analytics, and other features;
- authenticate users and enforce passwords, PINs, OTPs, expiration, usage limits, and access rules;
- detect fraud, abuse, malicious activity, security incidents, and violations of our Terms;
- operate, maintain, troubleshoot, monitor, and improve the service;
- process payments and manage subscriptions;
- communicate with you about service operation, security, support, and material changes; and
- comply with applicable legal obligations and respond to lawful requests.
4. Link access, analytics, and security data
SURLS.me may process request information when someone opens a link. Depending on the link configuration and enabled analytics, this can include timestamp, IP address, user-agent or device information, referrer, approximate location, country, access result, and other technical request data.
These signals can be used to provide analytics and to enforce security controls such as country restrictions, IP restrictions, device rules, referrer rules, expiration, and usage limits.
If you create a protected link, information required to enforce that protection may necessarily be processed. For example, an OTP or password-protected request must be evaluated before access can be granted.
5. Cookies and similar technologies
SURLS.me may use cookies, local storage, and similar technologies to keep the service working, maintain sessions, remember preferences, protect against abuse, and understand service usage.
Some cookies may be essential to authentication or security and cannot be disabled without affecting functionality. Where non-essential cookies or similar technologies are used, applicable consent or preference mechanisms may be provided based on your location and legal requirements.
6. When information may be shared
We do not sell personal information to third parties as a business model. We may share information in the following circumstances:
- Service providers: with vendors that provide infrastructure, hosting, storage, analytics, email, payments, security, monitoring, or other services necessary to operate SURLS.me.
- Customer-directed processing: where a customer uses SURLS.me to process data or links for its own users, as necessary to provide that customer's configured service.
- Legal and safety reasons: when reasonably necessary to comply with law, legal process, enforce our Terms, investigate abuse, protect users, or protect the rights, safety, and security of SURLS.me.
- Business transfers: in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to applicable law.
- With your direction: when you ask or authorize us to share information.
7. Data retention and deletion
We retain information for as long as reasonably necessary to provide the service, maintain security, meet contractual and legal obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of information and how the service is used.
When information is no longer required, we may delete it, anonymize it, or securely isolate it according to our operational and legal requirements. Cached, backup, logging, or security records may persist for a limited period after primary deletion where technically or legally necessary.
8. Security
We use reasonable technical and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include access controls, encryption where appropriate, logging, monitoring, infrastructure security, and secure development practices.
No internet service can guarantee absolute security. You are responsible for protecting your account credentials, API keys, passwords, PINs, OTPs, and other secrets you control.
9. Your privacy rights and choices
Depending on where you live and subject to applicable law, you may have rights to request access to, correction of, deletion of, restriction of, or portability of certain personal information, or to object to or withdraw consent for certain processing.
You may also have the right to lodge a complaint with a relevant data-protection or privacy authority. We may need to verify your identity before completing a request and may retain information where required or permitted by law.
To make a privacy request, contact us through the SURLS.me contact page.
10. Children's privacy
SURLS.me is not directed to children who are below the minimum age required to use the service under applicable law. We do not knowingly seek to collect personal information from children who are not permitted to use the service. If you believe a child has provided personal information to us improperly, please contact us so we can review and take appropriate action.
11. International processing
SURLS.me and its service providers may process information in countries other than the country where you live. Where required by applicable law, we use appropriate safeguards for international transfers of personal information.
12. Changes to this Privacy Policy
We may update this Privacy Policy as our service, technology, or legal obligations change. If we make material changes, we will take reasonable steps to provide notice through the service or another appropriate channel. The updated Policy will be effective on the date stated at the top of the page.
13. Contact
If you have a privacy question, want to exercise a privacy right, or believe your information has been handled improperly, please contact us through the SURLS.me contact page.