Privacy policy

1. Data controller

Lucas Peyrusaubes, sole trader, 387 avenue Louis Bozzo, 83000 Toulon, France — SIRET 883 738 833 00010.

For any question or request about your data: contact@tinylink.fr.

2. Data we process

Account: last name, first name, email address, password (stored as a hash, never in clear text), profile picture, interface language and theme, creation date, last activity date.

Content you create: pages, links, titles, descriptions, images, styles, QR codes, tags.

Sign-ins: date, IP address, country, region, city, operating system and browser, so that you can spot an access you do not recognise.

Traffic to your pages and links: date, country, city, device type, browser, referrer. These measurements are aggregated; they are not used to identify a visitor.

Country, region and city are derived from the IP address on our own servers, using a geolocation database (DB-IP): the address is not sent to any third party for this.

Payment: for a subscription, the customer identifier and the state of the subscription. Card details are entered at Stripe and never pass through our servers.

Support: the content of the messages you send us and, for a bug report, the page concerned, the browser and the operating system.

3. Purposes and legal bases

Providing the service, managing your account and your content — performance of the contract.

Billing and managing subscriptions — performance of the contract and legal accounting obligations.

Keeping the service secure: sign-in rate limiting, abuse detection, sign-in history — legitimate interest.

Answering your support requests — performance of the contract and legitimate interest.

Measuring traffic on the marketing site — consent, collected through the banner; without consent, no measurement is stored.

Sending you messages about how the service runs (address verification, security alert, subscription renewal) — performance of the contract.

4. Recipients and processors

Data is neither sold nor rented. It is accessible to the publisher and to the following providers, each only for what their task requires:

• o2switch (France) — hosting of the websites and the database.
• Stripe (United States, Ireland) — subscription payment and invoicing.
• Google Ireland Limited — traffic measurement on the marketing site (Google Analytics), only after consent.
• Discord (United States) — internal operational notifications, which may contain an account name and the address of reported content.
• The notifications-tinylink.fr mail server — delivery of service emails.

Some of these providers are established outside the European Union. The corresponding transfers rely on the European Commission’s standard contractual clauses or on an adequacy decision.

5. Requests from public authorities

An authority — police, courts, public administration — may request the disclosure of data. Such requests are rare and are never handled automatically: each one follows the steps below.

• Legality review: before any disclosure, the request is checked — the authority making it, the legal basis invoked, the procedure followed and the exact scope of what is sought.
• Challenge: a request without a valid legal basis, or whose scope exceeds what the law allows, is refused and challenged through the available remedies.
• Minimisation: only the data expressly covered by the request is disclosed, never a whole account, never the data of an unrelated third party.
• Documentation: every request received is recorded — its date, its author, its basis, the reasoning followed, the response given and any data transmitted.

Unless the law forbids it, the person concerned is informed of the request targeting them.

6. Retention periods

Account and content: for the life of the account, then erased when it is deleted.

Sign-in history: thirteen months.

Traffic statistics: kept in aggregated form so that periods can be compared.

Accounting records and invoices: ten years, as legally required.

Support messages: three years from the last exchange.

Traffic measurement: the period set by the tool, at most thirteen months for cookies.

7. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions about what happens to your data after your death.

These rights are exercised at contact@tinylink.fr. You will receive an answer within one month. Proof of identity may be requested where there is reasonable doubt about who is asking.

You can delete your account yourself from your workspace, Account tab.

You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

8. Cookies and trackers

Necessary cookies, set without consent: sign-in session, “remember me” token if you enable it, interface language and theme, and your choice on the banner.

Measurement cookies, set only after acceptance: Google Analytics, to understand which pages of the marketing site are visited.

You can accept, refuse or change your choice at any time from « Manage cookies » in the site footer, or delete these cookies from your browser settings; the service remains usable.

No advertising cookie and no social network tracker is set.

9. TinyLink browser extension

The TinyLink extension for Chrome and compatible browsers connects to your account with an API token that you generate in your workspace (Library, Integrations tab).

• The tokens you add, the selected environment and your display preferences are stored in your browser’s local storage. They are only sent to the TinyLink API (api.tinylink.fr), to shorten, list, edit or delete your links and generate their QR codes.
• The address of the active tab is read only when you open the extension, to prefill the link to shorten. It is sent to TinyLink only if you shorten it; it is then handled like any link created from your workspace.
• The extension collects no history and no browsing data, contains no analytics tool and communicates with no third party.

Removing a token in the extension, or uninstalling it, erases this data from your browser. A token can also be revoked at any time from your workspace: it then stops working immediately.

10. Security

Traffic is encrypted with TLS. Passwords are stored as hashes computed with a suitable algorithm, never in clear text. Database access is restricted and sign-in attempts are rate limited by IP address.

In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with article 34 of the GDPR.

11. Changes to this policy

This policy may change along with the service. The date of the last update appears at the top of the page; in the event of a substantial change, account holders are informed by email.