Privacy Policy

1. Data controller

The data controller for data collected through the URLW service is:
Anablabs SAS
France
DPO contact: dpo@anablabs.com

2. Data collected

We only collect data necessary for the service to operate:

• Account data: email address, hashed password (bcrypt)
• Shortened links: destination URL, generated short code, creation date
• Click statistics: click counter per link (IP not retained after processing)
• Payment data: processed exclusively by Stripe — we store no banking data
• Technical logs: IP addresses, user-agent (retained 30 days maximum)

3. Purposes of processing

• Provision of the URL shortening service
• Account authentication and security
• Click statistics tracking for your use
• Billing and subscription management
• Sending transactional emails (confirmations, invoices)
• Detection and prevention of abuse and spam

4. Legal bases

• Contract performance: processing necessary to provide the subscribed service
• Legitimate interest: security, anti-abuse, service improvement
• Consent: marketing communications (if you have expressly consented)
• Legal obligation: retention of billing data required by law

5. Retention period

• Account data: retained while the account is active
• Shortened links: retained while the account is active
• Billing data: 10 years (accounting obligation)
• Logs: 30 days maximum
• Upon deletion request: complete erasure within 30 days

6. Data recipients

Your data is processed by the following sub-processors, all GDPR compliant:

• OVH SAS (hosting) — Gravelines, France 🇫🇷
• Stripe Inc. (payment) — transfer governed by EU Standard Contractual Clauses
• Amazon Web Services (email via SES) — eu-west-1 region

No data is sold to third parties for advertising or commercial purposes.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right of rectification: correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to portability: receive your data in a readable format
• Right to object: object to certain processing
• Right to restriction of processing

To exercise your rights: dpo@anablabs.com
Response time: 30 days maximum.
To file a complaint: you can contact the CNIL (cnil.fr).

8. Cookies

URLW only uses strictly necessary cookies for the service to function (authentication session, CSRF protection). No advertising or third-party tracking cookies are set.

9. Hosting

The entire service is hosted in France at OVH (Gravelines datacenter, France). Your data does not leave the European Union, except for email flows governed by appropriate safeguards.