Privacy Policy

This policy explains what personal data HitLink collects, why, and your rights under the GDPR.

Who is responsible

The controller is an individual in Sweden: Janid Inayat. Write to us through the contact form. Paddle is an independent controller for the payment data it collects at checkout.

What HitLink stores

An account stores an email address and a password hash. A session stores a hash of the cookie, a security token, your browser type (for example Chrome), and an expiry. We don't store your IP address. Our server holds it briefly in memory to block abuse, and Cloudflare processes it as our network provider.

The waitlist stores an email address, the time you agreed to be emailed, the version of the wording you agreed to, and where the signup came from: the referring host (the full address only when the referrer is a HitLink page), the campaign tags in the link you followed (utm tags, such as utm_source=newsletter), the first page of that visit, and the page with the form. The form sends it for that visit only. We do not set a cookie for it, and we do not store it in the browser. We do not use third-party trackers or fingerprinting, and this record does not include an IP address. We email a confirmation link to the address you type. You are on the list only after you open that link. The link works once and lasts 48 hours. If you do not open it within 7 days, we delete the address. You can submit the form again to get a new link. Waitlist emails include a link that removes the address. The same record is kept with the account. Signup sources are deleted with the account.

The contact form and the report-a-link form store the email address you type, your message, and, for a report, the link you send. The feedback form stores the kind of note, your message, an optional rating, whether you said we may contact you, and the page path you came from. That path has no query string. If you are signed in, we also store your account id and the email on the account. If you are not, the email is optional. We use these notes to reply, to look into abuse, and to improve HitLink. An address you give, or the account email when you are signed in, is the reply-to on the message we send ourselves. Cloudflare Turnstile checks that a person who is not signed in sent the contact, report, or feedback form. We do not store your IP address for this.

Links store the address they open and a copy of that address with tracking tags removed. For each link we store visit totals, split by type of visit, country, device type (such as a mobile or a computer), and whether the visit came directly or from another site. We don't store who visited. Links on an account you are using are not removed just because they are old. Deleting a link stops it immediately. Visitors see that it was removed by its owner, and the short ending is kept so it is never reused. We keep the page address and the visit totals for 30 days, then erase them. If the link was blocked as unsafe, or someone reported it, we keep that address and those totals until the report's retention ends, which is 24 months. The short domains set no cookies.

A custom domain stores the hostname with your account. A hostname can be personal data. We also store an ownership token and the check status. We do not store the rest of your DNS zone. When you remove a domain, the hostname stays while the account exists so the short codes are not given to someone else. When you close the account, that hostname is replaced and the token is deleted. When a certificate is requested, the hostname is sent to Let's Encrypt. Your email address is not sent.

Why we use data, and our legal basis

Account, links and billing are needed to provide the service you asked for (contract).
The waitlist email is sent with your consent, after you confirm the address. You can withdraw that consent any time with the remove link in the email, or by asking to be removed.
How you found us, security, abuse prevention and safety checks rely on our legitimate interest in running a safe service and understanding what marketing works.

Safety checks

Link addresses are compared on our server with copies of the PhishTank, abuse.ch URLhaus, and OpenPhish lists. Those addresses are not sent to those services. When you create a link, we send its address to Google Web Risk to check it. Later checks use a copy of Google's list on our server, and the address is sent to Google again only if that copy shows a possible match. If a check can't run, the link is still created and marked check pending.

Companies that help us run HitLink

Paddle, our reseller, for checkout, tax, invoices, and the customer portal. Paddle is in the UK.
Brevo, for account email such as address confirmation and password reset. Brevo may process data outside the EU.
Cloudflare, in the USA, for DNS, the proxy, and Turnstile on the contact, report, and feedback forms when you are not signed in. Cloudflare processes IP addresses.
Hetzner, for the server in Finland.
Google Web Risk, in the USA, for address checks.
Let's Encrypt (ISRG), in the USA, for certificates on a custom domain. The hostname appears in public Certificate Transparency logs. Your email address is not sent.
abuse.ch, for the URLhaus list downloaded to our server.
PhishTank, for the phishing list downloaded to our server.
OpenPhish, for the community phishing list downloaded to our server.

Transfers outside the EU

Some providers are outside the EU: Google and Cloudflare (USA), Paddle (UK), and Brevo where it processes mail outside the EU. Transfers rely on the EU–US Data Privacy Framework or the EU's standard contractual clauses, and for the UK, the EU adequacy decision.

How long we keep it

An address that has not been confirmed is deleted after 7 days. Confirmed waitlist entries are deleted after 2 years at most, and sooner if you ask or if we no longer need the address. Account data is kept while you have an account. A free account that has not been signed in to, and has not been used through the API, for 12 months is emailed. You have 30 days to log in. If you do not, we pause the account: the dashboard is locked, and the short links still work. Logging in turns it back on and keeps your links. If you still do not log in for another 6 months, we delete the account. The short links then stop working. The page addresses and visit totals are erased after 30 days, or after 24 months when a safety report still needs them. A paid plan that is still running, including one that is cancelled but paid through the end of the period, or one that is past due, is not paused or deleted for inactivity. A signup whose email is never confirmed is deleted after 30 days. How you found us is deleted with the account. Visit totals stay with the link while you are using it. Totals older than 2 years are combined into monthly totals, which the dashboard still shows. We do not delete a link you are still using because it is old. Contact messages and feedback are deleted after 12 months. Abuse reports are deleted after 24 months. If you delete your account, feedback you sent is kept without your name or email. Contact messages tied to the account are kept the same way. A link report tied to the account keeps your email only while it is still evidence for an open abuse case, for the same 24 months. The kind, the message, a rating, the page path, and the time you sent it stay until that usual retention ends. A reported or unsafe link keeps its page address until that report retention ends.

You can delete the account yourself in Settings after you log in. That removes your email, password, sessions, sign-in links, and the record of how you found us, and any waitlist row for that email. If you delete your account, feedback you sent is kept without your name or email. Contact messages tied to the account are kept the same way. A link report tied to the account keeps your email only while it is still evidence for an open abuse case, for the same 24 months. Each short link then says it was removed by its owner. The short code is kept so it is never reused. The page address and the visit totals stay for 30 days, or for 24 months when a safety report still needs them, and are then erased. A paid subscription is cancelled immediately, and that cancellation does not refund the payment. You can ask for the refund through the contact form. If you cannot use Settings, the contact form is the fallback and we will delete the account. After deletion we keep at most the Paddle customer id and subscription id, with no email and no account id, so a refund or a chargeback can be matched. Paddle holds the invoices as merchant of record.

Your rights

You can ask to see, correct, export or delete your data, to restrict or object to how we use it, or to be removed from the waitlist. Use the contact form and we'll reply within one month. You can also complain to the Swedish Authority for Privacy Protection (IMY).

We do not sell personal data.

Home · Pricing · Terms · Refunds