Privacy Policy
At LShorter, transparency and data minimization are core principles of our distributed edge architecture. This Privacy Policy details how we collect, use, disclose, and safeguard your data when using our platform and redirect engine.
Zero-Visitor Cookies
We never plant tracking cookies, local beacons, or advertising fingerprints on visitors who click your shortened links.
Edge IP Anonymization
Visitor IP addresses are anonymized and hashed at the Cloudflare Edge PoP level before telemetry is recorded.
GDPR & CCPA Compliant
Strict compliance with European GDPR (RGPD) and California CCPA regulations. Full right to export or delete your account data.
PathLock™ Cryptographic PINs
PIN protection uses one-way cryptographic hashes. Your passwords and PIN codes are never stored in plaintext.
1. Introduction & Company Overview
LShorter ("LShorter", "we", "us", or "our") provides high-performance URL shortening, programmable edge routing, A/B testing, dynamic QR codes, and analytics infrastructure designed for modern digital teams and developers.
This Privacy Policy applies to personal data collected via our website (lsho.cc), dashboard applications, APIs, SDKs, and link redirection services. By accessing or using LShorter, you acknowledge that you have read and understood this Privacy Policy.
2. Information We Collect
We clearly differentiate between data collected from Registered Account Users and telemetry collected from End-User Link Visitors:
A. Registered Account Holders
- Account Identification: Full name, email address, password hash (encrypted with modern bcrypt algorithms), or third-party OAuth profile IDs (Google, GitHub).
- Billing & Payment Information: Payment transactions and subscription orders are processed directly through our Merchant of Record and payment provider, Paddle (Paddle.com Market Ltd), which complies with PCI-DSS Level 1 standards. Paddle securely manages checkout, recurring billing, fraud prevention, and international tax compliance. LShorter never stores or sees raw credit card numbers or CVV codes.
- Customer Support Communications: Inquiries, bug reports, and communications submitted via email or our support channels.
- Configuration & Assets: Custom domains, destination URLs, geographic routing rules, UTM parameters, and webhook endpoints.
B. Link Visitors (Anonymous Edge Redirection)
When someone clicks a shortened link hosted on LShorter or a verified custom domain, our edge infrastructure processes the incoming HTTP request. To preserve privacy:
- No Personal Profiling: We do NOT create persistent behavioral profiles, track across distinct domains, or sell browsing histories.
- Coarse Telemetry Only: Country, region, city, device category (Mobile/Desktop/Tablet), OS, browser engine, and HTTP referrer header.
- Zero Third-Party Advertising Trackers: No marketing pixels or ad beacons are introduced into the redirect sequence by LShorter.
3. Link Visitor Privacy & Edge Routing
Our redirect engine operates across Cloudflare's 310+ global edge locations. We implement strict data minimization principles:
IP Address Anonymization at the Edge
Raw visitor IP addresses are evaluated solely in temporary RAM at the edge node to resolve country/city geo-coordinates and detect malicious DDoS traffic. The raw IP is immediately discarded or transformed into a salted, one-way hash before any click telemetry is permanently saved.
PathLock™ Zero-Knowledge Protection
When a user configures a PIN code on a shortened link, the PIN is verified using cryptographic hashing. Neither LShorter operators nor database backups hold your PIN in plaintext.
Zero-Referrer Destination Masking
When Zero-Referrer masking is enabled, LShorter terminates the HTTP Referrer chain via HTTP headers and secure client meta-redirection, preventing downstream origin leakage to destination servers.
4. Legal Basis for Processing under GDPR
For individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data under the following lawful bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):
- Performance of Contract (Art. 6(1)(b)): To provide our services, authenticate accounts, execute redirects, process subscription orders, and fulfill our Terms of Service.
- Legitimate Interests (Art. 6(1)(f)): To secure our edge infrastructure against phishing, abuse, fraud, and bot attacks, as well as to optimize platform performance and uptime.
- Compliance with Legal Obligations (Art. 6(1)(c)): To maintain tax, accounting, and corporate audit records as mandated by applicable laws.
- Consent (Art. 6(1)(a)): Where explicitly obtained, such as for optional marketing updates (which you can withdraw at any time).
5. Data Retention Schedules
We store data only for as long as necessary to fulfill the operational purposes described in this policy:
| Data Category | Tier / Context | Retention Window |
|---|---|---|
| Click Analytics & Telemetry | Starter (Free) Plan | 30 Days (Rolling window enforced at edge & query level) |
| Click Analytics & Telemetry | Pro Plan | 365 Days (1 Year rolling window) |
| Click Analytics & Telemetry | Business & Enterprise Plans | Full Account Lifetime |
| Account Profile & Auth Data | All Active Accounts | Retained until account deletion by user |
| Billing & Tax Records | Paid Subscriptions | 7 Years (Managed by Merchant of Record Paddle for statutory audits) |
6. Third-Party Sub-Processors
To guarantee high availability, global low-latency resolution, and secure billing, we rely on industry-leading infrastructure partners who meet stringent data protection agreements:
Cloudflare Inc.
Global Edge Workers, Anycast DNS, DDoS mitigation, and KV storage.
USA & Global PoPs (SOC 2, ISO 27001)Convex Inc.
Realtime serverless transactional database and cloud application backend.
USA (SOC 2 Type II Certified)Paddle.com Market Ltd
Merchant of Record, checkout, global payment processing, fraud prevention, and international tax/VAT compliance.
UK / Global (PCI-DSS Level 1 Merchant of Record)Resend Inc.
Transactional email delivery, login magic links, and team invites.
USA (GDPR Compliant DPA)7. Your Rights (GDPR, CCPA & Global)
Under European (GDPR), UK, and Californian (CCPA/CPRA) privacy legislations, you enjoy substantial rights over your personal data:
• Right of Access & Data Portability (GDPR Art. 15, 20)
You may request a copy of all personal information we hold about you in a structured, machine-readable JSON/CSV format directly from your Dashboard Settings.
• Right to Rectification & Deletion (GDPR Art. 16, 17)
You have the right to correct inaccurate records or permanently delete ("Right to be Forgotten") your account and associated links. Deleting your account irreversibly removes all shortened links and historical telemetry.
• CCPA Notice: We Do NOT Sell or Share Personal Information
LShorter has not sold, does not sell, and will never sell personal information to third parties or data brokers. We do not engage in cross-context behavioral advertising.
8. Technical & Organizational Security
We implement comprehensive enterprise-grade security controls:
- Transport Layer Security: All web traffic and edge redirection calls are encrypted using Modern TLS 1.3 with automatic HSTS enforcement.
- Database Encryption: All data stored at rest is encrypted with AES-256 standard encryption keys.
- Anti-Phishing Automated Scanners: Destination URLs are systematically screened against global real-time malware and malicious intelligence databases to protect internet users.
- Security Incident Reporting: Vulnerability disclosures, suspected breaches, or infrastructure audits should be reported directly to our security engineering team at security@lsho.cc.
9. Children's Privacy
LShorter is not designed for or marketed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a minor has provided us with personal data, please contact our privacy desk immediately.
10. Changes to This Policy
We may revise this Privacy Policy periodically to reflect technological changes, new legal requirements, or enhancements to our platform. Material modifications will be signaled by updating the "Effective Date" at the top of this document and providing prominent notice within your dashboard or via email.
11. Contact Privacy Desk
If you have inquiries regarding this Privacy Policy or wish to exercise your GDPR/CCPA statutory rights, reach out to our team:
Organization: LShorter Inc. (Data Protection & Legal Compliance Desk)
