Privacy Policy

Last updated: 8 October 2026

This Privacy Policy explains how Ivan Voitovych, sole proprietor, trading as “Urlicer” ("we", "us") collects, uses, and shares information when you use the Urlicer service at urlicer.com (the "Service"). We are the data controller for the data described here, except where section 3a or section 14 of our Terms of Service say we process data on behalf of a customer. Urlicer is designed to collect as little personal data as possible. Most notably, our click analytics are cookieless and never store your raw IP address.

1. Information we collect

• Account data: your name, email address, a hash of your password, and your team memberships. If you signed up from one of our landing pages, we also note which page it was.
• Signing in with Google (optional): if you choose "Continue with Google", Google tells us your email address, whether it is verified, and an identifier for your Google account. We keep the email address and that identifier, and nothing else from Google; such an account has no password with us unless you add one. Google learns that you signed in to Urlicer and when, and handles that under its own privacy policy. Your browser is sent to Google only when you press that button.
• Link data: the short links you create, their destination URLs, and per-link settings (alias, expiry, password protection, targeting/rotation rules).
• Click analytics (privacy-preserving): when someone follows one of your links we record the event on your behalf, to power your dashboards, and for ourselves, to keep the Service secure and prevent abuse. We store: a hash of the visitor's IP address (IP addresses are hashed and never stored); the approximate country only (country level, derived locally from the IP, not city or precise location); the referrer domain (e.g. "twitter.com", not the full referring URL); the device type, browser, and operating system derived from the user-agent; and whether the click came from a QR code. We do not set tracking cookies on visitors to our own websites and we do not build advertising profiles. Customers can add advertising tags to links on their own domains; see section 3a.
• Support data: the messages and any attachments you send us.
• Billing data: your plan and subscription status, and the billing country Paddle reports. Payment card details are collected and processed by Paddle (section 4); we never see or store full card numbers.

2. How we use information and our legal bases

We use this data to provide, maintain, secure, and improve the Service; to detect and prevent abuse (such as malware and phishing links); to process your subscription; to send you transactional email (account, billing, and security notices) and, where you have opted in or where permitted, product updates; and to comply with legal obligations. Our legal bases (GDPR / UK GDPR) are: performance of a contract (operating your account), legitimate interests (securing the Service, preventing abuse, and product analytics on pseudonymised data), consent where required, and legal obligation.

3. Cookies

Urlicer uses only strictly-necessary and functional first-party cookies. We use no advertising or cross-site tracking cookies, and neither our click analytics nor the analytics we run on our own website use cookies at all, so we do not display a cookie consent banner. The cookies we set are:

• Authentication & session: to keep you signed in, and for up to ten minutes to carry a sign-in with Google from the moment you press the button until you return.
• Security (CSRF): to protect form submissions.
• Protected-link unlock: set only after you enter a link's password, so you are not asked again.
• A/B variant: set only on a link running a split test, to keep a visitor on the same destination; it stores a variant number only and is not used to track or profile.
• Pixel consent (px_consent): set only on a customer's own domain whose links use advertising tags (section 3a). It stores your answer to the consent question, the platforms it covered and a random reference, for 6 months, so you are not asked every time.

3a. Links on our customers' own domains

Customers can add advertising tags ("retargeting pixels") from platforms such as Meta, Google, LinkedIn, TikTok and X to short links on their own custom domains. When you open such a link, that customer is the controller: it decides which platforms receive data and why, and its privacy policy applies. The platforms receive the data directly from your browser, under their own privacy policies; we do not receive it. We serve the page for the customer, as its processor.

Before any tag loads we ask you, naming the customer's business and linking its privacy policy. If you say no, nothing loads. If your browser sends a Global Privacy Control signal, no tag loads. You can change your answer at any time at the link's domain followed by /privacy-choices. We keep a record of each answer for 18 months under a random reference, without your IP address or browser details, so the customer can show what you agreed to. We never load these tags on urlicer.com or ivi.to. To exercise your rights about data a customer collected this way, contact that customer; we will help them answer.

4. Payments (Paddle)

Payments are processed by Paddle.com Market Ltd, our authorised reseller and Merchant of Record. When you check out, your payment information is provided directly to Paddle and handled under Paddle's privacy policy. Paddle is the seller of record and handles payment, tax, and invoicing; it shares back with us only limited data such as your subscription status, plan, and billing country.

5. Service providers (sub-processors)

We share data with the providers below, each under contractual data-protection obligations. We do not sell your personal information.

6. International transfers

Our hosting (netcup, servers in the Netherlands), the delivery of our emails (our own mail server, hosted with Hetzner in Finland), our encrypted backups (Hetzner, Germany) and our website analytics (Pirsch, servers in Germany) all stay inside the EU. Some other providers, for example Google and Paddle, may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

7. Retention

We keep account data while your account is active and as needed for legitimate business and legal purposes. Click analytics are retained for the retention window of your plan, after which they are deleted. Links created without an account are given a limited lifetime and expire automatically. Answers to the consent question for customers' advertising tags (section 3a) are kept for 18 months. Abuse and security records are kept as long as needed to protect the Service.

8. Your rights

Depending on where you live (for example the EEA/UK under the GDPR, or California under the CCPA/CPRA) you may have the right to access, correct, delete, export, or restrict the processing of your data, to object to processing, and to withdraw consent. You can export your links and analytics yourself from within the app; to access, correct, or delete your account and associated data, contact privacy@urlicer.com and we will action your request. We do not sell personal information, so there is nothing to opt out of under "do not sell". Advertising tags on a customer's domain are that customer's; see section 3a for how to decline them. You may also lodge a complaint with your local data-protection supervisory authority.

9. Security

We protect data with measures including password hashing, encryption in transit (HTTPS), pseudonymisation of analytics, and access controls; Security and backups describes them. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of a qualifying breach as required by law.

10. Children

You must be at least 18 years old (or the age of majority in your jurisdiction) to use the Service, as our Terms of Service require. We do not knowingly collect data from anyone younger.

11. Changes & contact

We may update this policy; material changes will be posted here with a new date. Data-protection contact: privacy@urlicer.com. General enquiries: ivan@urlicer.com. To report an abusive or harmful link, see urlicer.com/report or email abuse@urlicer.com.

Ivan Voitovych, sole proprietor
Kniahyni Olgy 98v, Lviv 79053, Ukraine

See also our Terms of Service and Refund Policy.