1. Data Controller Information
Under GDPR, we act as the data controller for your personal information. Our contact details are:
- Data Controller: Zipy URL Shortener Platform
- Email: privacy@zipy.ink
- Address: 8819 Ohio St. South Gate, CA 90280
- Data Protection Officer: dpo@zipy.ink
You can contact our Data Protection Officer directly for any GDPR-related inquiries or to exercise your rights.
2. Legal Basis for Processing
We process your personal data based on the following legal grounds under GDPR:
- Consent: For marketing communications and analytics
- Contract: To provide our URL shortening services
- Legitimate Interest: For security, fraud prevention, and service improvement
- Legal Obligation: When required by law
You can withdraw consent at any time through your account settings or by contacting us.
3. Your GDPR Rights
Under GDPR, you have the following rights regarding your personal data:
- Right to Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Portability: Receive your data in a structured format
- Right to Restrict Processing: Limit how we use your data
- Right to Object: Object to processing based on legitimate interests
To exercise any of these rights, contact our Data Protection Officer at dpo@zipy.ink
4. Data Processing & AI Features
Our AI-powered features process data as follows:
- AI Link Suggestions: Analyzes content to suggest custom aliases
- Analytics Processing: Tracks link performance and user behavior
- Security Scanning: Monitors for malicious content and fraud
- Service Optimization: Improves platform performance and features
AI processing is based on legitimate interests and does not involve automated decision-making that significantly affects you.
5. Data Retention & Deletion
We retain your data for the following periods:
- Account Data: Until account deletion or 2 years of inactivity
- Link Analytics: 3 years for service improvement
- Log Files: 12 months for security purposes
- Marketing Data: Until consent withdrawal
You can request immediate deletion of your data, and we will process this within 30 days as required by GDPR.
6. International Data Transfers
Your data may be transferred outside the EU/EEA:
- We use GDPR-compliant data transfer mechanisms
- Adequacy decisions and standard contractual clauses
- Appropriate safeguards for all international transfers
- Regular assessments of data protection standards
All international transfers comply with GDPR Chapter V requirements and maintain equivalent data protection standards.