Privacy Policy

Information we collect

• Account information: name, email address, password (stored hashed, never in plain text).
• Service content: the long URLs you shorten, the aliases and tags you create, your links and their configuration.
• Visit data for your shortened links: approximate IP address (for country/city geolocation), browser user-agent, referrer, timestamp. This data is used to provide your statistics; we never sell it and never use it for advertising purposes.
• Billing information: processed directly by Stripe (see below); we never store your payment card number on our servers.
• Correspondence: if you write to us at [email protected], we keep that exchange to follow up.

Purposes of collection

We collect this information to: create and operate your account, provide the link-shortening service and its associated statistics, process payments, provide support, and comply with our legal obligations.

Where your data is hosted

• Account, links, link statistics, and traffic analytics (Umami): hosted on an OVH server located in Beauharnois, Quebec, Canada.
• Transactional emails (account confirmation, password reset, invoices): delivered by Duva, a transactional email service hosted in Canada.
• Payments: processed by Stripe, a company whose servers and subprocessors are located outside Quebec (the United States and elsewhere). Stripe is PCI-DSS Level 1 certified.
• Abuse protection for shortening without an account: Cloudflare Turnstile (Cloudflare, Inc., United States) checks that the request comes from a human, with no advertising cookies; its use is covered by the Cloudflare Turnstile Privacy Addendum. Google Web Risk (Google LLC, United States) checks that the destination address is not malicious: that address is sent to it, with no information about you.

Information entrusted to Stripe is therefore communicated outside Quebec. We only share with our providers what is strictly necessary for them to perform their function (email address and message content for Duva; payment and billing information for Stripe).

Retention

Your information is kept for as long as your account is active. After your account is deleted, your account information and links are removed from our systems; billing records may be retained longer where the law requires it.

Cookies

We use a strictly necessary session cookie for authentication. If you shorten a link without an account, a second cookie (valid for 30 days) remembers those links' codes in your browser, only so we can offer to attach them to an account; it contains no email or personal information. We also keep your IP address for a few hours up to a day to limit how many links can be created without an account. For general traffic statistics (page views, referrers), we use Umami, an analytics tool we self-host on our own server: it sets no cookies and does not identify visitors individually. We use no advertising cookies and no third-party analytics service (Google Analytics or similar).

Your rights

Under Quebec law, you may at any time:

• access the personal information we hold about you;
• request that it be corrected if it is inaccurate or incomplete;
• withdraw your consent to its collection or use, subject to our legal obligations;
• request the deletion of your account and associated information (also possible directly from Settings).

To exercise these rights, write to [email protected]. If you feel your complaint has not been handled adequately, you may contact Quebec's Commission d'accès à l'information.

Security

Communications with klipo.link are encrypted (HTTPS). Passwords are hashed, and API access keys can be revoked at any time from your settings.

Changes

We may update this policy. Material changes will be announced by email or on this page.

Contact us

For any question about this policy: [email protected].