Privacy Policy

1. Introduction

Codelloy (“we”, “us”, or “our”) operates a SaaS platform for smart link and QR code generation, analytics, and custom domain routing. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have over your data.

By using the Service, you agree to the collection and use of information as described in this Policy. This Policy applies to our website, dashboard application, API, and any other product or service that links to this Policy.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect your name, email address, and (if applicable) your organization name. If you authenticate via Google OAuth, we receive your name and email from Google.

2.2 Billing Data

Payment processing is handled by Stripe. We do not store your full credit card number or CVV. Stripe provides us with a payment token and billing address for invoicing purposes.

2.3 Usage and Configuration Data

We store the smart links, QR codes, custom domains, and other configuration you create through the Service, along with metadata such as creation timestamps and settings.

2.4 Analytics Data from Link Clicks

When an end user clicks one of your smart links or scans a QR code, we collect:

• Click timestamp
• Device type and operating system (derived from User-Agent)
• Referrer URL
• Country and region (derived from truncated IP address)
• Visitor and session identifiers (via cookies; see below)

2.5 Log Data

Our servers automatically record standard web logs when you interact with the Service, including your IP address, browser type, pages visited, and error information. Log data is used for security monitoring and debugging.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Process payments and manage subscriptions
• Send transactional emails (account confirmations, invoices, password resets)
• Provide click analytics and reporting to you as the link owner
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Communicate service updates and material changes to these policies

4. Analytics Cookies

When a visitor clicks a Codelloy smart link or scans a Codelloy QR code, the following cookies may be set to enable analytics:

Both cookies are httpOnly and use sameSite=lax. They are set only when a user visits a smart link or scans a QR code, not when browsing this marketing website.

These cookies are not used for advertising or cross-site tracking. As a Codelloy customer, you are responsible for disclosing the use of these cookies to your end users in accordance with applicable laws (e.g., GDPR, ePrivacy Directive, CCPA).

5. IP Address Handling

IP addresses are truncated (the last octet is zeroed, e.g. 203.0.113.0) before storage. Full IP addresses are never persisted. Truncated IP data is used only for geographic attribution in analytics reports.

6. Codelloy Pages (Hosted Content and Comments)

Codelloy Pages lets an organisation upload an HTML file and publish it as a page we host on a separate domain. Publishing and visiting those pages involves the additional processing described below.

6.1 Page content and where it is stored

Uploaded page files are stored on Hetzner Object Storage in the European Union (Helsinki region), under a data processing agreement. The publishing organisation controls what its pages contain; if a page includes personal data, that organisation is the controller for it. The lawful basis for hosting is performance of our contract with the publishing organisation (Art. 6(1)(b) GDPR).

6.2 Comments left by visitors

Visitors can leave comments on a published page without creating an account. When you post a comment we store:

• The display name you choose and the text of your comment. Both are shown publicly on the page to anyone who can view it. Please do not enter your real name, contact details, or any other personal information you do not want to be public.
• A salted hash of your IP address — a SHA-256 hash computed with a secret salt, not the address itself. We do not store your IP address in a readable form, and the hash cannot be used to look up your location or your identity. It lets us recognise repeat activity from the same source in order to detect and block spam and abuse. The lawful basis is our legitimate interest (Art. 6(1)(f) GDPR) in keeping published pages usable and free of automated abuse.

This is consistent with Section 5 above: we do not persist full IP addresses. A salted hash is a derived pseudonym, not a stored address.

6.3 View analytics

Each published page is reached through a Codelloy short link, so visits are recorded as click analytics in the same way as any other Codelloy link — including the truncated-IP geographic attribution described in Sections 4 and 5. The publishing organisation can see aggregate view statistics for its own pages. Pages themselves are served without cookies.

6.4 Retention

Comments and their associated salted IP hashes are retained for as long as the page they belong to exists. They are deleted when the publishing organisation deletes the comment or the page, and that deletion is permanent. View analytics follow the retention period for analytics click data set out in Section 7.

6.5 Your rights as a commenter

The rights described in Section 10 apply to comment data as well. Because commenting does not create an account, you cannot exercise them through a dashboard — instead, contact us at privacy@codelloy.com with enough detail to identify the comment (the page address, the display name used, and roughly when it was posted) and we will act on your request. You can also ask the organisation that published the page to remove the comment directly.

7. Data Retention

We retain different categories of data for different periods:

• Analytics click data: retained for 730 days (2 years) from the date of collection
• Account data: retained for the duration of your account, plus up to 90 days after account closure to allow for recovery requests
• Billing records: retained for 7 years as required for tax and accounting compliance
• Server logs: retained for up to 90 days
• Hosted page content, comments, and comment IP hashes: retained for as long as the page exists; deleted permanently when the page or comment is deleted (see Section 6)

8. Third-Party Services

We use third-party services to operate the platform. Each third-party service has its own privacy practices:

9. Data Sharing and Disclosure

We do not sell your personal data. We may share information in the following circumstances:

• Service providers: with the third-party services listed above, under contractual data processing agreements
• Legal compliance: if required by law, court order, or governmental authority
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction
• Protection of rights: to investigate, prevent, or take action regarding illegal activities, fraud, or threats to security

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request that inaccurate data be corrected
• Deletion: request erasure of your personal data (subject to legal retention requirements)
• Portability: receive your data in a structured, machine-readable format
• Objection: object to certain processing activities
• Restriction: request that we restrict processing of your data in certain circumstances

To exercise any of these rights, contact us at privacy@codelloy.com. We will respond within 30 days.

11. Data Security

We implement industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. However, no transmission over the internet or electronic storage method is 100% secure, and we cannot guarantee absolute security.

12. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice in the Service before the changes take effect.

Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance of the changes.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: