1. Data
We process account email, user identifiers, language, workspaces, links, domains, audit records, normalized billing state and public sponsor profiles.
Redirect IP addresses are immediately transformed into a temporary HMAC fingerprint and are not stored raw by URLPivot. When the edge supplies an approximate country, we store only its ISO country code.
2. Purpose
We use the data to authenticate, authorize, operate redirects, prevent abuse, measure aggregated events, provide support, bill and meet legal duties.
3. Providers
Technical operators may include self-hosted Supabase Auth, PostgreSQL, Cloudflare, Stripe and Resend. Each integration is limited to the necessary purpose and depends on approved configuration.
4. Retention
Click and page events follow the active plan window and cap: Free keeps up to 30 days and 5,000 events, Pro up to 180 days and 25,000 events, and Agency up to 365 days and 100,000 events per workspace. An operational job deletes events beyond age or cap and writes immutable execution evidence.
Profiles, memberships, managed content, financial records, audit logs and safety evidence have separate lifecycles. A commercial downgrade does not itself cause immediate deletion; operational, fraud, safety and applicable retention duties are reviewed first.
5. Cookies and subject requests
Analytics are optional. Campaign attribution requires explicit acceptance of the current preference: it retains a random browser token and the source, medium and campaign labels of an institutional entry for 30 days. Inside URLPivot, that entry is linked to confirmation of a new account and its first Link created through the panel with current consent, without collecting Link content or customer Page activity. Raw campaign records have a 60-day retention period and are cleaned by the operational job. Withdrawal stops future attribution and removes the entry from reports; the token is cleared after the server confirms withdrawal, with a later retry if the service is unavailable. The old public-visit preference does not automatically enable this purpose.
URLPivot uses strictly necessary authentication and security cookies. Analytics cookies are optional and remain separate. Freebuff marketing measurement is off by default and requires separate consent; only an opaque ad-click identifier and a random event ID with signup_completed after confirmation of a newly created account are sent. We never send email, account/session identifiers, or page URLs to Freebuff. Marketing consent can be withdrawn at any time; withdrawal stops future events and clears this browser's stored click ID.
An authenticated account can download a bounded data copy and open access, correction, portability or deletion-review requests. Each request has a visible status and a 15-day internal service target. A person verifies identity, ownership and retention exceptions before deciding. The internal target does not replace deadlines or conclusions under applicable law.