Privacy policy

1. Data controller

Lucas Peyrusaubes, sole trader, 387 avenue Louis Bozzo, 83000 Toulon, France — SIRET 883 738 833 00010.

For any question or request about your data: contact@tinylink.fr.

2. Data we process

Account: last name, first name, email address, password (stored as a hash, never in clear text), profile picture, interface language and theme, creation date, last activity date.

Content you create: pages, links, titles, descriptions, images, styles, QR codes, tags.

Sign-ins: date, IP address, country, region, city, operating system and browser, so that you can spot an access you do not recognise.

Traffic to your pages and links: date, country, city, device type, browser, referrer. These measurements are aggregated; they are not used to identify a visitor.

Payment: for a subscription, the customer identifier and the state of the subscription. Card details are entered at Stripe and never pass through our servers.

Support: the content of the messages you send us and, for a bug report, the page concerned, the browser and the operating system.

3. Purposes and legal bases

Providing the service, managing your account and your content — performance of the contract.

Billing and managing subscriptions — performance of the contract and legal accounting obligations.

Keeping the service secure: sign-in rate limiting, abuse detection, sign-in history — legitimate interest.

Answering your support requests — performance of the contract and legitimate interest.

Measuring traffic on the marketing site — consent, collected through the banner; without consent, no measurement is stored.

Sending you messages about how the service runs (address verification, security alert, subscription renewal) — performance of the contract.

4. Recipients and processors

Data is neither sold nor rented. It is accessible to the publisher and to the following providers, each only for what their task requires:

• o2switch (France) — hosting of the websites and the database.
• Stripe (United States, Ireland) — subscription payment and invoicing.
• Google Ireland Limited — traffic measurement on the marketing site (Google Analytics), only after consent.
• ipstack (United States) — turning an IP address into country, region and city for statistics and sign-in history.
• userstack (United States) — identifying the browser and system when a bug is reported.
• Discord (United States) — internal operational notifications, which may contain an account name and the address of reported content.
• The notifications-tinylink.fr mail server — delivery of service emails.

Some of these providers are established outside the European Union. The corresponding transfers rely on the European Commission’s standard contractual clauses or on an adequacy decision.

5. Retention periods

Account and content: for the life of the account, then erased when it is deleted.

Sign-in history: thirteen months.

Traffic statistics: kept in aggregated form so that periods can be compared.

Accounting records and invoices: ten years, as legally required.

Support messages: three years from the last exchange.

Traffic measurement: the period set by the tool, at most thirteen months for cookies.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions about what happens to your data after your death.

These rights are exercised at contact@tinylink.fr. You will receive an answer within one month. Proof of identity may be requested where there is reasonable doubt about who is asking.

You can delete your account yourself from your workspace, Account tab.

You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

7. Cookies and trackers

Necessary cookies, set without consent: sign-in session, “remember me” token if you enable it, interface language and theme, and your choice on the banner.

Measurement cookies, set only after acceptance: Google Analytics, to understand which pages of the marketing site are visited.

You can refuse or delete these cookies at any time from your browser settings; the service remains usable.

No advertising cookie and no social network tracker is set.

8. Security

Traffic is encrypted with TLS. Passwords are stored as hashes computed with a suitable algorithm, never in clear text. Database access is restricted and sign-in attempts are rate limited by IP address.

In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with article 34 of the GDPR.

9. Changes to this policy

This policy may change along with the service. The date of the last update appears at the top of the page; in the event of a substantial change, account holders are informed by email.