Privacy Policy

Privacy at a glance

This summary is for orientation. The full policy below is what applies.

1. Who we are and how to contact us

Data fiduciary / controller: QalbIT Infotech Pvt Ltd, CIN U72900GJ2022PTC132898, registered office at A-1113, Siddhi Vinayak Towers, Opp. S.G. Highway, Makarba, Ahmedabad, Gujarat 380051, India ("URLCrop", "we", "us").

2. Who this policy covers and our role

This policy covers personal data we process about:

What "processor" means for you as an End User. The customer whose link you clicked decides why your data is collected and for how long (within the limits of their plan). Their privacy notice applies to that collection. If you contact us about data a customer collected, we will help you and forward your request to the customer where appropriate. Our own, independent purposes are limited and described in §6.3.

3. What personal data we collect, why, and on what legal basis

GDPR legal bases are given as Article 6(1) letters: (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interests. DPDP bases are consent (Section 6) or a legitimate use under Section 7 (principally 7(a): data you voluntarily provided for a specified purpose; 7(d): compliance with a court order or law). Where we rely on legitimate interests, the interest is stated.

3.1 Website visitors

3.2 Account holders and customers

Providing identity, login and billing data is necessary to open a paid account; without it we cannot provide the Service. All other data is optional.

3.3 End Users: people who click links, scan QR codes or visit pages

This section describes the event we record when someone follows a short link or scans a QR code. It is the heart of the Service and we have designed it to collect as little as possible.

Where the click is processed. Clicks on crop.sh and on our own hostnames pass through Cloudflare's network (which protects us against attacks and adds a country code to the request) and are then handled by our redirect service on our servers in Mumbai, India. Clicks on a customer's own domain (for example go.brand.com) go directly to our servers in Mumbai and do not pass through Cloudflare.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

What we do not do. We do not set cookies on redirects. We do not fingerprint devices to recognise you across different customers' links. We do not combine click data from different customers to profile individuals. We do not sell or rent End User data. We do not use End User data for advertising.

Bot filtering. Clicks that match known crawlers, security scanners, link-preview fetchers (for example the fetch WhatsApp makes to show a preview), data-centre network lists or our behavioural heuristics are labelled as bot traffic and shown separately to customers. Bot events are kept with the same retention as other events so that customers can audit them.

Pages and forms. When you visit a page hosted by us (for example a link-in-bio page) we record a page view event with the same fields as above. If you fill in a form on a page (lead forms, Phase 2), the information you enter is collected for and delivered to the customer who owns the page; we store it on their behalf. Customers must display their own privacy notice on pages that collect form data.

Legal basis for End User data. As processor, we process this data on the instructions of the customer, who is responsible for having a legal basis under the GDPR and the DPDP Act. For our own independent purposes (security, fraud and abuse prevention, usage metering for billing, aggregate service statistics, legal compliance), our GDPR basis is Article 6(1)(f) legitimate interests in operating a safe and reliable service, and Article 6(1)(c) where the law requires. Under the DPDP Act we minimise this data so that what we retain is not reasonably capable of identifying you; where that is not the case, we process it as a legitimate use for security and legal compliance or on the basis of consent obtained by the customer.

3.4 Partners (affiliates and influencers — Phase 3)

The customer running the program is the controller for the program's terms; we are controller for payout processing, KYC and tax compliance.

3.5 API users and developers

API keys (stored hashed), key scopes, request logs (endpoint, timestamp, response code, IP address of the caller, request ID), rate-limit counters and webhook delivery logs (endpoint URL, status, retries). Purpose: provide, secure and meter the API; debug problems you report. Basis: GDPR (b), (f); DPDP 7(a).

3.6 Data we receive from other sources (Article 14 GDPR)

• Payment providers (Razorpay, PayPal): payment status, risk signals, the country of your payment instrument, dispute and chargeback notices.
• Identity providers: Google (if you sign in with Google) and, for Enterprise customers, your organisation's SSO provider via WorkOS: your name, email and group membership as released by your organisation.
• Integration partners you connect (for example Shopify, WooCommerce, Zapier): order IDs, order values, currency and customer identifiers needed for conversion attribution, as configured by the customer.
• Security and reputation sources: Google Web Risk, URLhaus, PhishTank and abuse reporters give us information about URLs (not about you) that we use to rate link safety.
• Public sources: the content of destination pages, used only to generate social previews and to scan for safety.

4. The _ucid cookie and conversion tracking (Convert, Phase 2)

Customers on Business and higher plans can measure which link or QR code led to a sale on their own website.

1. When you click a tracked link, the redirect may add ?ucid=<click_id> to the destination URL.
2. If the customer has installed our JavaScript snippet or our Shopify/WooCommerce app on their site, that site sets a first-party cookie named _ucid on the customer's domain containing the click ID. It expires after 90 days. The cookie does not contain your name, email or IP address, and it is not readable by other websites or by other URLCrop customers.
3. When you complete a lead form or purchase on that site, the customer's site or payment system sends the click ID together with an order ID and order value (and, if the customer configures it, a hashed email or customer ID) to our Conversions API. We join it to the click so the customer can see revenue per link.

Who is responsible. The customer is the controller of the _ucid cookie and of any consent needed for it; in the EU, UK and other jurisdictions with cookie-consent rules, the customer must obtain consent before the cookie is set, and our snippet supports a consent-gated mode. We act as the customer's processor. To opt out on a specific site, decline analytics cookies in that site's cookie banner or delete the _ucid cookie in your browser.

Retargeting pixels. Customers on Pro and higher plans may configure third-party advertising pixels (Meta, Google Ads, LinkedIn, TikTok, X) to fire on their links or pages. Those pixels are governed by the customer's and the advertising platform's privacy notices. We do not receive the data those pixels collect.

5. Cookies and similar technologies on our own properties

We use cookies and browser storage on urlcrop.com, app.urlcrop.com and status.urlcrop.com. We set no cookies of our own on crop.sh or customer-domain redirects. We use no advertising or cross-site tracking cookies on any of our properties.

Cloudflare's security cookies are set only if Cloudflare challenges a request it considers abusive; ordinary visitors following a crop.sh link do not receive one.

How to manage. Use the cookie banner (shown in the EU/EEA, UK and Switzerland) or Cookie preferences at the bottom of every page on urlcrop.com to accept or refuse analytics cookies at any time, wherever you are. The dashboard (app.urlcrop.com) sets no analytics cookies. Your browser also lets you block or delete cookies; blocking essential cookies will stop the dashboard from working. We honour the Global Privacy Control (GPC) signal by treating it as a refusal of analytics cookies.

6. How we use personal data

6.1 To provide the Service

Create and secure accounts; redirect links and resolve QR codes; host pages; compute analytics and attribution; enforce plan limits; send transactional emails (verification, invoices, security alerts, dunning reminders on day 1, 3 and 7 after a failed payment); provide support; process payments and payouts.

6.2 To keep the Service safe

Scan destination URLs at creation and on a schedule; show warning pages; disable abusive links; detect click fraud, bots and fake conversions; protect accounts against takeover; investigate abuse reports; verify billing country; screen against sanctions lists; keep audit and security logs.

6.3 Our independent purposes as controller for End User data

We use End User event data for our own purposes only to: (a) detect and prevent abuse, fraud and security threats; (b) meter usage for billing (counting events against plan quotas); (c) produce aggregated, non-identifying statistics about the Service (for example total scans per country); (d) comply with legal obligations and respond to lawful requests; and (e) debug and maintain the redirect and ingestion systems. We do not use End User data for marketing, profiling or advertising.

6.4 To improve the Service

Analyse how features are used (product analytics with consent where required); run surveys; test new features behind feature flags; monitor errors and performance. We prefer aggregated or pseudonymised data for this.

6.5 To communicate with you

Service announcements, security notices and changes to terms (which you cannot opt out of while you hold an account); and, with your consent or where permitted with opt-out, newsletters, product updates and offers (§15).

6.6 To comply with the law

Tax and accounting (GST invoices, export documentation), responding to courts, regulators and law enforcement, enforcing our Terms of Service, and establishing or defending legal claims.

We do not sell personal data, and we do not share it with data brokers.

7. Who we share personal data with (sub-processors and other recipients)

7.1 Sub-processors

The vendors below process personal data on our behalf under written contracts that require confidentiality, security measures and data-protection terms (including Standard Contractual Clauses where data leaves the EU/UK). The current list is maintained at urlcrop.com/legal/sub-processors; customers can subscribe to change notifications there.

Not sub-processors. URLhaus (abuse.ch) and PhishTank are threat feeds we download; we send them nothing. GitHub (code and container images) and Bitwarden (internal credential vault) hold no customer personal data.

7.2 Other recipients

• The customer who created the link, QR code or page you used, who sees analytics about their audience (never raw IP addresses) and any form data you submitted to them.
• Integration providers you or the customer connect (Shopify, WooCommerce, Zapier, Make, n8n, Google Sheets, Slack, HubSpot). They receive what the integration needs and act under their own privacy notices.
• Professional advisers (lawyers, accountants, auditors) under confidentiality.
• Authorities: courts, regulators, law enforcement, the Data Protection Board of India, EU/UK supervisory authorities, and tax authorities, where the law requires or permits, and to protect the rights, safety or property of URLCrop, our customers or the public. We publish a summary of government requests on request.
• Security partners: when a link is confirmed as phishing or malware we may share the URL (not personal data) with Google Safe Browsing, URLhaus, PhishTank, hosting providers and registrars.
• A buyer or successor in a merger, acquisition or sale of assets, under this policy, with notice to you.

8. International transfers

Where your data lives. Personal data is stored at rest on our servers in India (Contabo, Mumbai). Backups are encrypted on those servers before being copied to off-site object storage (§9). Processing happens:

• on our servers in Mumbai, for every redirect, page view, dashboard action and API call;
• on Cloudflare's network, for requests to crop.sh and our own hostnames only: the request is received at the Cloudflare data centre nearest to the visitor (which may be in the EU, UK, US, Singapore, India or elsewhere), inspected for attacks, and forwarded to Mumbai within milliseconds; requests to customers' own domains do not pass through Cloudflare;
• in the countries of our other sub-processors listed in §7.1 (United States, European Union, United Kingdom, Singapore).

Transfers of EU and UK data to India and elsewhere. India does not have an adequacy decision from the European Commission or the UK Government. When we process personal data of people in the EU/UK, we rely on:

• the EU Standard Contractual Clauses (Commission Decision 2021/914, Modules 2 and 3) and the UK International Data Transfer Addendum, incorporated in our Data Processing Agreement with customers and in our contracts with sub-processors;
• transfer impact assessments of Indian law and of each sub-processor's country;
• supplementary measures: encryption in transit (TLS 1.2+) everywhere, encryption of backups before they leave our server, pseudonymisation of End User identifiers (hashed IP), strict access control and logging, and a policy of challenging disproportionate government requests.

You can request a copy of the relevant clauses at support@urlcrop.com.

Transfers of Indian data outside India. The DPDP Act permits transfer of personal data outside India except to countries restricted by the Central Government by notification. We comply with any such restriction and will update this policy and our sub-processor list accordingly. Enterprise customers can require that specified categories of data stay within India by contract.

9. Data residency statement

Nothing in this statement limits the in-transit processing on Cloudflare's network described in §8 for crop.sh and our own hostnames.

10. How long we keep personal data

We keep personal data only for as long as needed for the purposes in §6, then delete or anonymise it. The schedule below is applied automatically where possible.

If a legal hold, dispute or investigation requires longer retention, we keep only the data needed for it and delete it when the matter ends.

11. How we protect personal data

• Encryption in transit: TLS 1.2 or higher for all connections, including custom domains (certificates issued automatically by Let's Encrypt) and our own hostnames (Cloudflare Universal SSL with strict encryption to our servers).
• Encryption of backups and secrets: backups are encrypted on our server with keys we control before they are copied off-site; passwords are hashed with a modern algorithm; API keys are stored hashed; secrets are kept out of the code base, held in a managed vault and rotated at least every 90 days.
• Tenant isolation: every record carries a workspace ID and the database enforces row-level security so one customer cannot read another's data.
• Access control: role-based access in the product (Owner, Admin, Editor, Viewer, Client); least-privilege, named accounts and mandatory two-factor authentication for our staff; our internal admin console is reachable only through Cloudflare Access; server access is key-only from approved addresses; production access is logged and reviewed.
• Account security for you: two-factor authentication (authenticator app), session management, sign-in alerts, SSO and SCIM for Enterprise.
• Hardened servers: firewalled hosts, automatic security updates, intrusion prevention, isolated containers; the redirect service runs separately from the dashboard and API.
• Monitoring: centralised logs, error tracking, uptime monitoring and alerting; automated dependency and vulnerability scanning; independent penetration testing before launch and annually.
• Resilience: continuous database archiving with a recovery point objective of 15 minutes; off-site encrypted backups (database 15 days, files up to 6 months); documented incident response and disaster recovery, tested regularly.
• Data minimisation by design: hashed IP addresses with daily salts, no cookies on redirects, parsed user agents rather than raw strings, offline geolocation.
• Compliance roadmap: SOC 2 Type I targeted within 12 months of launch.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify the relevant authority and affected customers or individuals as required by the GDPR (72 hours to the supervisory authority) and the DPDP Act and rules (to the Data Protection Board of India and affected Data Principals). Our public security page is at urlcrop.com/security; report vulnerabilities to support@urlcrop.com.

12. Your rights

12.1 If you are in the EU, EEA or UK (GDPR / UK GDPR)

Timeline: we respond within one month of receiving a verifiable request; this may be extended by two further months for complex or numerous requests, in which case we will tell you why within the first month.

12.2 If you are in India (DPDP Act, 2023)

Timeline: we acknowledge grievances within 24 hours and aim to resolve them within 15 days, and in any case within the period prescribed by the DPDP Rules. Data access requests are completed within 30 days unless the Rules prescribe a shorter period. When you ask us to delete your account, we wait 30 days so you can cancel. When that period ends we erase or pseudonymise your personal data within 7 days, except records we must keep by law (such as invoices, kept for 8 years with personal details pseudonymised).

12.3 Everyone else

We extend the rights of access, correction, deletion, portability and objection to marketing to all users regardless of location, subject to local law.

12.4 How to exercise your rights

1. Account holders: go to Settings → Privacy → Data requests in app.urlcrop.com. You can download your data (JSON and CSV), request erasure, manage marketing consent and cookie preferences, and set a nominee. Workspace Owners can export the whole workspace from Workspace → Settings → Export.
2. End Users and others: email support@urlcrop.com with the short link or page you used (if you have it), the approximate date, and what you would like us to do. Because End User click data is stored only as a daily-rotated hash, we usually cannot identify which events relate to you; we will explain what we can and cannot do, and we will forward your request to the customer who owns the link where they are the controller.
3. Identity verification: we may ask you to confirm your email address, sign in, or provide information that lets us match you to our records. We do not ask for government ID unless the law requires it.
4. Authorised agents: you may act through someone else if you give them written authority; we will verify it.
5. No fee for a first request. We may charge a reasonable fee or decline requests that are manifestly unfounded, repetitive or excessive, and we will tell you why.

13. Children

The Service is intended for people aged 18 and over. We do not knowingly collect personal data from children, and we do not offer accounts to anyone under 18. Customers may not direct links, QR codes or pages at children in a way that requires verifiable parental consent under the DPDP Act or the GDPR without obtaining that consent themselves. If you believe a child has provided us with personal data, contact support@urlcrop.com and we will delete it. We do not track children's behaviour or serve them targeted advertising.

14. Automated decision-making

Link safety scoring. Every destination URL is scored automatically when a link is created and re-scored on a schedule, using Google Web Risk, the URLhaus and PhishTank feeds, and our own rules (for example newly registered domains, long redirect chains, look-alike brand names, and the history of the workspace). Depending on the score, the link may redirect normally, show a warning page to visitors before redirecting, be held for review, or be disabled. Destinations with unknown risk are not treated as safe for new or untrusted workspaces.

• Who is affected: the customer who created the link (their link may be delayed or unavailable) and, indirectly, visitors (who see a warning page).
• Effect: this is a decision about a URL, not about a person. It does not produce legal effects or similarly significant effects on individuals; it does not affect anyone's access to credit, employment, housing, health or public services.
• Human review: customers can request a review from the link's page in the dashboard or by replying to the notification; a member of our trust and safety team reviews the decision, usually within one business day, and can override it. Visitors who believe a warning is wrong can report it from the warning page.

Fraud and bot filtering. We automatically label events as bot or suspected fraud (for analytics and, in the Partners module, commission holds). Labels affect counts and commission timing, not individuals' rights, and partners can dispute holds through the customer running the program.

Billing checks. Mismatches between billing country, IP country and payment instrument country are flagged for human review; no automated refusal is made on that basis alone.

We do not use automated decision-making to profile End Users or to make decisions that produce legal or similarly significant effects on them.

15. Marketing communications

• Transactional messages (verification codes, invoices, payment failures, security alerts, legal notices, service changes) are part of the Service and cannot be switched off while you have an account.
• Marketing messages (newsletters, product tips, offers, webinars) are sent only if you opt in at sign-up or later, or, where local law allows it for existing customers, with a clear opt-out in every message. In the EU, UK and India we ask for consent first.
• Opt out at any time via the unsubscribe link in any marketing email (one click, no sign-in needed), in Account → Notifications, or by emailing unsubscribe@urlcrop.com or support@urlcrop.com. Unsubscribe links and the one-click option take effect immediately; email requests are processed within 10 days.
• Usage alerts (a message when a workspace reaches 80% and 100% of a plan limit) are service notices sent to workspace Owners and Admins. They are on by default and you can turn them off in Account → Notifications.
• We do not track opens or clicks. Our emails contain no tracking pixels and no click-tracking links.
• Bounces and complaints. If an email bounces permanently or you mark one as spam, we keep a keyed hash of your address (not the address itself) so we stop sending marketing and usage email to it: 3 years after a complaint and 1 year after a permanent bounce.
• SMS and WhatsApp are used only for one-time passwords and security alerts, never for marketing, unless you separately opt in.
• Status page notifications are sent only to people who subscribe at status.urlcrop.com and can be unsubscribed there.

16. Third-party links and destinations

Short links, QR codes and pages created on URLCrop lead to websites, apps and files that we do not own or control. Once you leave crop.sh, a custom domain or a URLCrop-hosted page, the privacy policy of the destination applies. We scan destinations for safety but we do not review their privacy practices, and the existence of a short link is not an endorsement. The same applies to links from our own website to third-party sites, and to integrations you choose to connect.

17. Changes to this policy

We will update this policy when our practices, our sub-processors or the law change. The "Last updated" date at the top shows the current version, and a change history is published at urlcrop.com/legal/privacy/history. For material changes (for example a new purpose, a new category of data, or a transfer to a new country) we will notify account holders by email and in the dashboard at least 30 days before the change takes effect, and we will seek fresh consent where the law requires it. Continued use of the Service after the effective date means the updated policy applies; where consent is the legal basis, nothing happens until you have given it.

18. Contact and grievance redressal

If you are not satisfied with our response, you may complain to the Data Protection Board of India (for DPDP matters), to your EU/EEA supervisory authority, or to the UK Information Commissioner's Office, as applicable.

QalbIT Infotech Pvt Ltd. Questions about this document: business@urlcrop.com.