Terms of Service

1. Introduction and acceptance

1.1 These Terms of Service (the "Terms") are a legal agreement between you and URLCrop. They govern your access to and use of the URLCrop websites, dashboard, short-link redirect service, QR code service, pages, analytics, APIs, SDKs, integrations and related services (together, the "Service").

1.2 You accept these Terms by creating an account, by clicking "I agree" (or similar) where we present these Terms, by paying for a plan, or by otherwise using the Service. If you do not agree, do not use the Service.

1.3 If you use the Service on behalf of a company, firm, trust, agency or other organization, you confirm that you have the authority to bind that organization to these Terms. "You" and "your" then refer to that organization as well as to you personally.

1.4 These Terms incorporate by reference our Privacy Policy, our Cancellation & No-Refund Policy, the plan descriptions and limits on our pricing page at urlcrop.com/pricing, and, where applicable, a signed Data Processing Agreement, an Enterprise Order Form and a Service Level Agreement. If an Enterprise Order Form conflicts with these Terms, the Order Form prevails for that customer.

1.5 Visitors who click a short link, scan a QR code or view a page created by one of our customers ("End Users") are not party to these Terms. Their rights are described in our Privacy Policy and in the policies of the customer who created the link, QR code or page.

2. Definitions

3. Eligibility and accounts

3.1 Account required; age. An Account is required to use any part of the Service, including the Free Plan. Every Link, QR Code and Page belongs to an Account: nothing can be created, saved, shortened, tracked or edited without signing in (with email and password, with Google, or with a magic link). You must be at least 18 years old to create an Account. The Service is not directed at, and may not be used by, anyone under 18. If we learn that an Account belongs to a person under 18 we will close it.

3.2 Verified email and accurate information. Each Account must have a verified email address. Signing in with Google or a magic link verifies your email automatically; with email and password you must click the link in our verification email. Until your email is verified you cannot create Links, QR Codes, Pages or Custom Domains or make purchases; you can sign in, verify your email and complete onboarding. Creation unlocks when you verify. We may delete Accounts whose email remains unverified 30 days after sign-up, together with their Links, after emailing a reminder. You must also provide, where we ask for it, a valid mobile number, billing address, billing country and (for Indian businesses) GSTIN, and keep this information up to date. Invoices are issued on the basis of the details you give us and may not be re-issued for details you failed to provide (see §5.5).

3.3 Credentials. You are responsible for keeping your password, two-factor codes, recovery codes, API keys and sessions secure. Anything done through your Account or API keys is treated as done by you until you tell us at support@urlcrop.com that they have been compromised. We may require two-factor authentication for certain roles or features.

3.4 Workspace Owners and members. Each Workspace has at least one Workspace Owner. Owners decide who joins the Workspace and with which role (Owner, Admin, Editor, Viewer and, on Agency plans, Client). Owners are responsible for the actions of every member they invite. If the only Owner of a Workspace becomes unreachable, we may transfer ownership to another verified Admin of that Workspace after reasonable attempts to contact the Owner.

3.5 Organizations. The person who creates an Organization confirms that they are authorised to accept these Terms, to make payments and to receive invoices for it. Disputes between members of an Organization about ownership or control are for you to resolve; we may freeze a Workspace while such a dispute is pending.

3.6 One person, one Account. Do not create Accounts for other people without their knowledge, do not share an Account between people, and do not create multiple Free Workspaces to avoid Plan limits.

4. The Service

4.1 What we provide. Subject to your Plan, the Service lets you create branded short Links, dynamic QR Codes and hosted Pages; measure clicks, scans, views and (on Business and higher plans) conversions and revenue; manage Custom Domains; use our public API, SDKs, webhooks and integrations; and operate partner and affiliate programs (Partners module, where available). Feature availability by Plan is set out on the pricing page.

4.2 Changes to the Service. We improve the Service continuously. We may add, change or remove features, and we may change the look, limits and technical operation of the Service. If a change materially reduces the core functionality you pay for, we will give you at least 30 days' notice by email or in-app so that you can cancel before your next renewal, as your sole remedy. Fees already paid are not refunded (§5.15).

4.3 Beta Features. Beta Features are provided for evaluation. They may be incomplete, may change or be withdrawn without notice, may have different limits, and are excluded from any service level commitment and from the warranties in §19. We may collect additional diagnostic data about your use of Beta Features. Use them at your own risk.

4.4 Documentation and support. Support channels and target response times depend on your Plan: Free — community forum; Starter — email within 48 hours; Pro — email within 24 hours; Business and Agency — priority email within 8 hours; Enterprise — dedicated support with a 99.95% service level agreement. Response targets are measured during our support hours and are targets, not guarantees, except where an Enterprise SLA says otherwise.

4.5 Free tools. The tools on urlcrop.com/tools (static QR generator, UPI QR, WhatsApp link, UTM builder) run entirely in your browser: they generate a static image or string on your device, send nothing to our servers and store nothing. They do not create short links, dynamic QR Codes or Pages and are not tracked. Saving, shortening, tracking or editing anything requires an Account (§3.1). These Terms, in particular §7 (Acceptable Use), apply to your use of the tools and of their output.

4.6 Third-party platforms. Parts of the Service run on or integrate with platforms we do not control (for example mobile operating systems, browsers, messaging apps, payment providers and e-commerce platforms). We are not responsible for changes to those platforms that affect how Links, QR Codes, Pages or integrations behave.

5. Plans, fees and billing

5.1 Prices. Current prices and entitlements are shown on urlcrop.com/pricing. Plans are priced in Indian Rupees (INR) for customers whose billing country is India and in US Dollars (USD) for all other customers. Annual Plans are billed once a year at the price of ten monthly periods.

5.2 Payment providers. We do not store card or bank details. Payments are collected by:

• Razorpay for billing country India (UPI AutoPay, cards, net banking and e-mandates, in INR); and
• PayPal for all other billing countries (PayPal balance, linked cards and, where supported, card checkout without a PayPal account, in USD).

You must also accept the terms of the payment provider you use. Your billing country is chosen at checkout and may be cross-checked against your IP location and the country of your payment instrument. We may ask for evidence of your billing country and may refuse, reverse or re-invoice a transaction where the details do not match.

5.3 Taxes. Prices for Indian customers are exclusive of Goods and Services Tax (GST), which is added at the applicable rate (CGST + SGST for Gujarat, IGST for other States and Union Territories). Prices for customers outside India are exclusive of any tax and are treated as an export of services under Indian GST law. You are responsible for any taxes, duties, withholding or levies imposed in your own country. If you are required to withhold tax, you must gross up the payment so that we receive the full invoiced amount, unless you provide valid documentation under an applicable tax treaty.

5.4 Auto-renewal. Paid Plans renew automatically at the end of each Billing Period at the then-current price for your Plan, using the payment method on file, until you cancel. You can cancel at any time in Billing settings; cancellation stops future renewals only and takes effect at the end of the current Billing Period (see §5.15, §22 and the Cancellation & No-Refund Policy).

5.5 Invoices. We issue an electronic invoice for every charge to the Organization's billing email. Indian invoices are GST tax invoices numbered sequentially per Indian financial year (for example UC/26-27/000001). If you want your GSTIN or legal name on an invoice you must add it in Billing settings before the charge; we cannot change a tax invoice after the end of the month in which it was issued except by issuing a credit note and a fresh invoice where the law allows.

5.6 Upgrades. An upgrade takes effect immediately. We charge the price difference for the remainder of the current Billing Period as a one-time order, and your next renewal is at the new Plan's price.

5.7 Downgrades. A downgrade is scheduled for the end of the current Billing Period. Until then you keep your current entitlements. After the downgrade, resources above the new Plan's limits (for example extra Links, Domains, QR Codes, Pages or seats) remain active but read-only: you cannot add more until you are under the new limits. No refund is given for the difference.

5.8 Failed payments (dunning). If a renewal payment fails:

Existing Links, QR Codes and Pages keep working and keep redirecting throughout. Paying the outstanding amount restores the Workspace to its Plan immediately.

5.9 Prepaid Packs and add-ons. Prepaid Packs (for example 100,000 events or 1,000,000 API calls) are one-time purchases, valid for 12 months from purchase, consumed only after the monthly Plan quota is exhausted, and non-refundable. Unused balance expires at the end of the 12 months. Add-ons (extra domains, seats, client workspaces, Partners module) are billed monthly with your Plan and follow the same renewal, upgrade and downgrade rules as the Plan.

5.10 Usage limits. Each Plan includes monthly quotas (new Links, Events, API requests) and total limits (QR Codes, Pages, Domains, seats). When a quota is reached, the behaviour described on the pricing page and in Documentation applies: you cannot create new Links until the next cycle, an upgrade or a Pack; over-quota Events are still counted in totals but their detailed analytics are not stored until the cycle resets or a Pack is bought. We do not charge overage automatically.

5.11 Price changes. We may change prices. For existing subscriptions, a price change takes effect at the first renewal that falls at least 30 days after we notify you by email. If you do not accept the new price you may cancel before the renewal.

5.12 Partner payout fee. Where you use the Partners module to pay commissions through the Service, a platform fee of 5% of the commission amount paid is charged and deducted or invoiced as set out in the Partner Program Terms (§15).

5.13 Enterprise. Enterprise Plans are sold under a signed Order Form, invoiced annually (bank transfer or PayPal invoice) with payment due within the period stated in the Order Form. Late payments may bear interest at 1.5% per month or the maximum rate permitted by law, whichever is lower. Where an Order Form conflicts with this §5, the Order Form prevails.

5.14 Billing errors. Tell us at support@urlcrop.com within 60 days of a charge if you believe our systems charged you twice for the same item or charged an amount that does not match your order. We investigate within 2 business days and, where a URLCrop system error is confirmed, correct it by reversing the erroneous charge to the original payment method and issuing a credit note and corrected invoice where applicable. This is a correction of a billing error, not a refund, and it creates no exception to §5.15. Charges you authorised (including renewals you did not cancel in time, upgrades, Prepaid Packs and add-ons) are not billing errors.

5.15 No refunds. All Plans (monthly and annual), Prepaid Packs and add-ons are prepaid and strictly non-refundable. There is no refund guarantee and no pro-rata refund or credit for cancellation, downgrade, unused periods, non-usage, dissatisfaction, or suspension or termination of your Account for breach. Cancellation stops future renewals only; access continues until the end of the paid period. You must not dispute legitimate charges with your bank, card issuer or PayPal (§5.16). The Cancellation & No-Refund Policy is shown to you and accepted at checkout before every payment and forms part of these Terms.

5.16 Chargebacks. If you dispute a charge that was valid under these Terms, we will contest the dispute with evidence, may suspend paid features of the Organization while it is open (Links keep redirecting), may recover the disputed amount and the provider's dispute fees if the dispute is decided in our favour, and may refuse future payments from or terminate the Organization for repeated or abusive disputes.

6. Free Plan terms

6.1 The Free Plan is available only to registered Accounts with a verified email address (§3.1–3.2). It is provided at no charge, "as is", with the limits shown on the pricing page (currently 25 new Links per month, 3 dynamic QR Codes, 1 Page, 1,000 Events per month, 30-day analytics retention, crop.sh only, 1 seat, community support). Until the Account's email is verified, no Links can be created.

6.2 Badge. Pages and QR Code downloads created on the Free Plan carry a "Made with URLCrop" badge that you may not remove, hide or alter. Upgrading to any paid Plan removes the badge.

6.3 Inactivity. A Free Workspace is inactive when, for 12 consecutive months, no member has signed in and no Link, QR Code or Page has been created or edited in it. We may delete an inactive Free Workspace after sending at least 30 days' notice to the Workspace Owner's email address. Signing in once during the notice period keeps the Workspace. When an inactive Workspace is deleted, its Links stop redirecting and its data is deleted as described in §21.5. Free Workspaces whose Links are still receiving Events are not deleted under this clause without a further 30 days' notice.

6.4 No service levels. The Free Plan has no uptime commitment and no support response commitment.

6.5 Fair use and anti-abuse. The Free Plan exists for individuals and small teams to try the Service. We may restrict or close Free Workspaces that are created in bulk, used to evade limits, used mainly to send traffic to a single destination at volume, or operated by automated means.

7. Acceptable Use Policy

7.1 Why this matters. A short link service lives on the reputation of its domains. One abusive Link can get crop.sh and every customer's Custom Domain flagged by browsers, messaging apps and security vendors. We therefore enforce this policy strictly and, where necessary, before you are notified.

7.2 Prohibited content. You may not create Links, QR Codes or Pages that lead to, host, promote or facilitate:

• phishing, credential harvesting, fake login pages or impersonation of any brand, bank, government body, payment app or person;
• malware, spyware, ransomware, unwanted software downloads, browser hijackers or exploit kits;
• unsolicited bulk messaging (spam) by email, SMS, WhatsApp or any other channel, including "lead" lists sold or shared without consent;
• content that is illegal in India or in the country where you or your audience are located, including child sexual abuse material, terrorism, incitement to violence, hate speech, and content that violates the Information Technology Act, 2000 and rules made under it;
• fraud, scams, advance-fee schemes, fake job offers, fake lotteries, fake investment or cryptocurrency schemes, "tech support" scams, or UPI/payment requests that misrepresent the payee;
• counterfeit goods, unlicensed gambling, controlled substances, weapons, or regulated products sold in breach of applicable law;
• sexually explicit content involving minors, non-consensual intimate imagery, or sexual services;
• infringement of copyright, trademark, trade secret or other intellectual property rights;
• defamatory, harassing, threatening or privacy-invading content targeting a private individual;
• deceptive practices such as "cloaking" (showing one destination to our scanner and another to visitors), hidden redirects, auto-downloads, forced subscriptions, or pages that imitate system warnings.

7.3 Prohibited conduct. You may not:

• circumvent, disable or probe our safety scanning, interstitial warning page, blocklists, rate limits, Turnstile or other protective measures;
• use the Service for cookie stuffing, click injection, click flooding, affiliate or partner fraud, self-referrals, fake conversions, or any scheme to earn commissions or inflate metrics dishonestly;
• register slugs, Custom Domains or Page names that impersonate a brand, product, government body, bank or person, or that are confusingly similar to them, without authorisation;
• scrape, crawl, harvest or enumerate Links, QR Codes, Pages, analytics or other data from the Service except through the public API within its limits;
• resell, sublicense or share Workspace access or API keys with third parties outside your Organization, except as expressly allowed by an Agency or Enterprise Plan;
• create Links in bulk by automated means on the Free Plan, create multiple Free Workspaces to evade limits, or use the Service primarily as a redirector for traffic you do not control;
• interfere with the Service, attempt unauthorised access to any part of it or to other customers' data, or test its security without written permission from support@urlcrop.com;
• use the Service to send traffic to destinations that violate the terms of the platform where the Link is shared (for example destinations banned by WhatsApp, Instagram, Google Ads or app stores);
• reverse engineer, decompile or copy the Service, except where open-source licences for our SDKs expressly permit it;
• use the Service in any way that breaches applicable law, including sanctions and export control law (§25).

7.4 How we enforce. To protect our customers, End Users and domain reputation, we may at any time and without prior notice:

• scan every destination URL at creation and re-scan it on a schedule, using Google Web Risk, URLhaus, PhishTank and our own heuristics, and treat destinations whose risk is unknown as not safe for new or untrusted Workspaces;
• show an interstitial warning page before redirecting to a destination we rate as risky or unverified;
• disable, hold for review or delete a Link, QR Code, Page or Custom Domain, or block a destination domain across the Service;
• throttle, suspend or restrict a Workspace, an Account or an API key;
• remove Customer Content, including images and text on Pages;
• terminate your Account or Organization for serious or repeated breaches;
• preserve and disclose records to law enforcement, regulators, courts, security vendors and affected third parties where we are required to by law or where we reasonably believe disclosure is necessary to prevent harm;
• charge you our reasonable costs of handling abuse that you caused, where permitted by law.

7.5 Reporting and appeals. Anyone can report a Link, QR Code or Page at urlcrop.com/report or by emailing support@urlcrop.com. If one of your Links or Pages is disabled or shown behind a warning page, you can request a human review from the item's detail page in the dashboard or by replying to the notice we send. We aim to review appeals within one business day. Our Grievance Officer for the purposes of the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is Abidhusain Chidi, reachable at support@urlcrop.com and at our registered address; complaints are acknowledged within 24 hours and resolved within 15 days of receipt, or any shorter period required by law.

7.6 Shared responsibility. You are responsible for the destinations of your Links and the content of your Pages, even when a destination changes after you created the Link. Check your destinations and keep your own websites secure. We may require additional verification (for example phone verification or a short waiting period) before new Workspaces can create Links to unknown domains.

8. Customer Content and licence to operate the Service

8.1 Your ownership. You keep all rights in your Customer Content. We claim no ownership of it.

8.2 Licence to us. You grant URLCrop a worldwide, non-exclusive, royalty-free licence to host, store, cache, copy, scan, analyse, display, transmit, reformat and distribute your Customer Content only as needed to provide, secure, support and improve the Service, to comply with law and to enforce these Terms. This includes caching Links on our servers, generating social previews and QR images, rendering Pages, scanning destinations and producing analytics. The licence ends when your Customer Content is deleted from the Service, except for copies in backups (deleted on their normal schedule) and records we must keep by law.

8.3 Your warranties. You warrant that you own or have the rights needed to use and share your Customer Content, that it complies with §7, and that it does not infringe anyone's rights or any law.

8.4 Public content. Links, QR Codes and Pages are public by design: anyone with the URL can access them. Do not put confidential information in slugs, titles, descriptions, Page content or destination URLs. Password protection on Links is a convenience feature, not a security control for sensitive data.

8.5 Public analytics and reports. If you create a shareable public report link, the analytics in that report are visible to anyone with the link until you disable it.

8.6 Aggregated data. We may create and use aggregated or de-identified data derived from the use of the Service (for example "QR scans in India rose 20% during Diwali") for operating, benchmarking, improving and marketing the Service, provided it does not identify you, your Organization or any individual.

9. Link lifetime and redirect continuity

9.1 Our commitment. We design the redirect service to run independently of our billing and control systems. Links never stop redirecting because of quota or payment state. Reaching a Plan limit, a failed renewal, a past-due status or a drop to Free limits affects only your ability to create new items and use dashboard features (§5.8, §5.10).

9.2 What stops a Link. A Link stops redirecting only when:

• you disable or delete it, set an expiry date or click limit that has been reached, or delete the Workspace;
• we disable it under §7 (Acceptable Use) or because the destination fails our safety checks;
• the Custom Domain it uses is removed, stops pointing to us, or is suspended under §10;
• a Free Workspace is deleted for inactivity under §6.3;
• your Account or Organization is terminated under §21, after the grace period in §9.3; or
• we are required to stop it by law or court order.

9.3 Grace period after termination. When you close your Account or Organization, or when we terminate it for reasons other than breach, your Links keep redirecting for 30 days after the termination date so that you can update printed materials and shared posts. During this period you can export your data (§21.4). After 30 days, Links stop redirecting and return an informational "link retired" page. For terminations due to breach of §7, we may stop Links immediately.

9.4 Slug reuse. Automatically generated short codes are never reused. Custom slugs on shared domains such as crop.sh stay reserved for at least 30 days after the Link is renamed or permanently deleted, and may then be released to other customers. Slugs on your Custom Domain are yours while the domain is connected.

9.5 Expired and limited Links. When a Link reaches its expiry date or click limit, visitors are shown an expiry page or redirected to the fallback URL you set.

9.6 Service interruptions. §9.1–9.3 describe how the Service is designed to behave; they are not an uptime guarantee. Uptime commitments exist only under an Enterprise SLA (§22).

10. Custom Domains

10.1 Your domain, your responsibility. You may connect domains you own or are authorised to use. You warrant that you have the right to use the domain, that it is not registered or used in bad faith, and that connecting it does not infringe anyone's rights.

10.2 DNS control. To connect a domain you must create the DNS record we specify: a CNAME record pointing to cname.urlcrop.com for a subdomain, or an A record pointing to the server address shown in the dashboard for a root domain, and, where we ask for it, a TXT record proving control. The record must point directly to our servers ("DNS only") and must not be proxied through another network. Traffic to your Custom Domain reaches our servers directly. You must keep the record in place; if you change, remove or proxy it, Links on that domain stop working and we are not responsible.

10.3 SSL certificates. Once your Custom Domain is verified, we obtain and renew TLS certificates for it automatically from Let's Encrypt (Internet Security Research Group); the certificate is issued on the first HTTPS visit after verification. You authorise us to request certificates for the hostnames you connect and acknowledge that the hostname is shared with the certificate authority and recorded in public certificate transparency logs, as with every HTTPS certificate. Certificates are held on our servers and are not exportable.

10.4 Domain reputation. We monitor the reputation of connected domains. We may refuse to connect, or may disconnect, a domain that is listed by security vendors, that is used in breach of §7, that was previously used for abuse, or whose registration details do not match your Organization. A domain disconnected for abuse may be permanently blocked across the Service.

10.5 Limits. The number of Custom Domains you may connect depends on your Plan. Domains above your limit after a downgrade remain active but read-only (§5.7). The Free Plan supports crop.sh only.

10.6 Shared domains. crop.sh and any other shared domains we offer belong to us. You have no right to any particular slug on a shared domain except while your Link exists (§9.4). We may reclaim slugs that impersonate brands or that are reserved words.

10.7 Transfer or expiry of your domain. If you sell, transfer or let a connected domain expire, you must disconnect it from the Service first. We are not responsible for Links that redirect to a new owner's content.

11. API and SDK terms

11.1 Access. The public API (api.urlcrop.com) and SDKs are available on Pro and higher Plans, with daily request limits by Plan (currently Pro 50,000, Business 200,000, Agency 500,000 requests per day; Enterprise custom) and additional per-minute burst limits documented in our API documentation. Requests over the limit receive HTTP 429 responses.

11.2 API keys. API keys are issued per Workspace with scopes. Keep them secret, store them server-side, rotate them regularly and revoke them if exposed. You are responsible for all usage under your keys. Do not embed secret keys in client-side code, mobile apps or public repositories. Public (browser) snippets use publishable identifiers only.

11.3 Fair use. Do not use the API to mirror or bulk-export the Service's data except your own Workspace data, to circumvent Plan limits, to build a competing shortener using our infrastructure, or in a way that degrades the Service for others. We may throttle or suspend keys that cause unreasonable load.

11.4 No reverse engineering. Except where an open-source licence applies to a particular SDK, you may not reverse engineer, decompile, modify or create derivative works of the Service or SDKs, or remove notices in them. SDK source code we publish is licensed under the open-source licence stated in its repository.

11.5 API changes. We version the API. We may add fields and endpoints at any time. We will give at least 90 days' notice before removing or changing a documented, stable endpoint in a backward-incompatible way, except where needed for security or legal reasons.

11.6 Webhooks. Outbound webhooks are signed. You are responsible for verifying signatures, for the security and availability of your endpoints and for handling retries idempotently. We may disable webhooks whose endpoints repeatedly fail.

11.7 Integrations you build. If you build an application for other URLCrop customers using the API, you must display your own privacy policy, must not misrepresent your relationship with URLCrop, and must comply with any marketplace or developer terms we publish.

12. Third-party services

12.1 Payment providers. Payments are processed by Razorpay (India) and PayPal (international) under their own terms and privacy policies. We are not responsible for their availability, fees, holds or decisions. Partner payouts use RazorpayX, PayPal Payouts or Wise and may be subject to their onboarding and compliance requirements.

12.2 Integrations and marketplace apps. Integrations with third-party products (for example Shopify, WooCommerce, Zapier, Make, n8n, Google Sheets, Slack, HubSpot, messaging apps and ad networks) depend on those products' APIs and terms. Connecting an integration authorises us to exchange data with that product as described in Documentation. We are not responsible for third-party products, their changes, outages or data handling.

12.3 Destinations. We do not control the websites, apps or files that Links, QR Codes and Pages point to. A Link's presence on crop.sh or a Custom Domain is not an endorsement by us. End Users follow Links at their own risk.

12.4 Open-source software. The Service includes open-source components licensed under their own terms, which are listed in Documentation where required.

13. Intellectual property

13.1 The Service, including its software, design, text, graphics, logos, the names "URLCrop" and "crop.sh", domain names, documentation and all improvements, is owned by URLCrop or its licensors and protected by Indian and international intellectual property laws. These Terms grant you a limited, non-exclusive, non-transferable, revocable right to use the Service according to your Plan. No other rights are granted.

13.2 You may not use our trademarks, logos or domain names except to describe truthfully that you use the Service, or as permitted by our brand guidelines (published at urlcrop.com/brand). The "Made with URLCrop" badge on Free Plan output is a required attribution and is licensed only for that use.

13.3 If you believe content hosted on the Service infringes your copyright or trademark, write to support@urlcrop.com with the URL, proof of your rights, the material you want removed and your contact details. We act on valid notices and may forward them to the customer concerned.

14. Feedback

If you send us ideas, suggestions, bug reports or other feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use it for any purpose without obligation to you. We will not identify you as the source without your permission.

15. Partners module

The Partners module (affiliate and influencer programs, commissions and payouts) is governed by separate Partner Program Terms that apply to Customers who run programs and to the partners who join them. Those terms cover commission rules, holding periods, fraud holds, KYC and tax requirements (including PAN verification and tax deduction for Indian partners), minimum payouts and the 5% platform fee. Until the Partner Program Terms are published, the Partners module is not available for general use.

16. Confidentiality

16.1 "Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or that a reasonable person would understand to be confidential, including your Customer Content and analytics, your Organization's billing details, and our unpublished product plans, pricing and security information. It excludes information that is public, independently developed, or lawfully received from a third party.

16.2 Each party will use the other's Confidential Information only to perform under these Terms, will protect it with at least reasonable care, and will disclose it only to employees, advisers and sub-processors who need it and are bound by confidentiality obligations. A party may disclose Confidential Information if required by law, after giving reasonable notice where lawful.

16.3 These obligations last for the term of the agreement and 3 years after it ends, and indefinitely for trade secrets and personal data.

17. Privacy

Our Privacy Policy explains what personal data we collect from account holders, End Users and website visitors, why, how long we keep it, and the rights of individuals under the GDPR and India's Digital Personal Data Protection Act, 2023. By using the Service you acknowledge that policy.

18. Data processing

18.1 Roles. For personal data in Customer Content and in the analytics and attribution you configure about your End Users, you are the controller (or "data fiduciary" under the DPDP Act) and URLCrop is your processor ("data processor"). For account, billing, security, abuse-prevention and service-operation data, URLCrop is an independent controller. The Privacy Policy explains this split.

18.2 Data Processing Agreement. Our Data Processing Agreement (DPA), including EU Standard Contractual Clauses and a UK Addendum where relevant, is incorporated into these Terms for all Customers and can be countersigned on request by Customers on Business, Agency and Enterprise Plans. Request it at support@urlcrop.com.

18.3 Sub-processors. Our current list of sub-processors and their locations is published at urlcrop.com/legal/sub-processors and in the Privacy Policy. We give at least 30 days' notice of new sub-processors by email to Workspace Owners who have subscribed to notices; you may object on reasonable data-protection grounds, in which case we will work with you in good faith and, failing a solution, you may terminate the affected service with effect from the end of the current Billing Period; fees already paid are not refunded (§5.15).

18.4 Your obligations as controller. You must have a lawful basis for the personal data you collect through Links, QR Codes, Pages, forms, pixels, the _ucid cookie and the Conversions API; provide your own privacy notice to your audience; obtain consent where the law requires it (for example for the _ucid cookie and retargeting pixels in the EU/UK); and respond to your End Users' rights requests. We will assist you as described in the DPA.

18.5 Data residency. Customer account data, Customer Content, files (invoices, QR assets, exports) and analytics are stored at rest in India on our servers in a Contabo data centre in Mumbai. Backups are encrypted on our servers before they are copied to off-site storage. Requests to crop.sh and to our own hostnames pass through Cloudflare's network for protection against attacks before reaching our servers; requests to your Custom Domain reach our servers directly. Some sub-processors operate outside India as listed in the Privacy Policy.

19. Warranties and disclaimers

19.1 Our warranty. We warrant that the paid Service will perform materially as described in the Documentation and that we will provide it with reasonable skill and care. Your sole remedy for breach of this warranty is for us to use reasonable efforts to correct the non-conformity or, if we cannot do so within a reasonable time, for you to terminate the affected Plan with effect from the end of the current Billing Period; fees already paid are not refunded (§5.15).

19.2 Disclaimer. Except as stated in §19.1 and to the fullest extent permitted by law, the Service, Beta Features, free tools, Free Plan, SDKs and Documentation are provided "as is" and "as available", without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy of analytics, or uninterrupted or error-free operation.

19.3 Analytics and attribution. Click, scan, view and conversion counts are affected by browsers, privacy tools, bots, ad blockers, caching and the configuration of your own websites and integrations. We filter known bots and apply reasonable methodology but do not warrant that analytics or attribution are complete or exact. Do not rely on them as the sole basis for payments to third parties without your own verification.

19.4 Safety scanning. Our link safety systems reduce, but cannot eliminate, the risk that a Link leads to a harmful destination. We do not warrant that any destination is safe, and we are not responsible for destinations you or others create.

19.5 Third parties. We make no warranty about third-party services, platforms, destinations or integrations.

20. Limitation of liability

20.1 Exclusion of certain damages. To the fullest extent permitted by law, neither party will be liable to the other for any indirect, incidental, special, consequential, exemplary or punitive damages, or for loss of profits, revenue, business, goodwill, data or anticipated savings, however caused and under any theory of liability, even if advised of the possibility.

20.2 Cap. To the fullest extent permitted by law, URLCrop's total aggregate liability to you for all claims arising out of or relating to the Service or these Terms in any 12-month period will not exceed the greater of (a) the total fees you paid to URLCrop in the 12 months immediately before the event giving rise to the claim, and (b) ₹5,000 (or US$60 for customers billed in USD).

20.3 Exceptions. The exclusions and cap in §20.1 and §20.2 do not apply to: (a) liability that cannot be excluded or limited by applicable law, including for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation; (b) your payment obligations; (c) your indemnity obligations under §21; (d) either party's breach of §16 (Confidentiality) or misuse of the other party's intellectual property, which are capped at five times the amount in §20.2(a); or (e) a party's wilful misconduct or gross negligence.

20.4 Free Plan and Beta Features. For the Free Plan, free tools and Beta Features, our liability is limited to the amount in §20.2(b), subject to §20.3(a).

20.5 Basis of the bargain. You acknowledge that the fees reflect this allocation of risk and that we would not provide the Service at these prices without it.

21. Indemnity

21.1 By you. You will defend, indemnify and hold harmless URLCrop, its directors, employees and contractors from and against all claims, damages, fines, penalties, costs and expenses (including reasonable legal fees) arising from: (a) your Customer Content or destinations; (b) your breach of §7 (Acceptable Use) or §10 (Custom Domains); (c) your breach of applicable law, including data protection, consumer, advertising, messaging (such as TRAI regulations or anti-spam laws) or tax law; (d) your partner, affiliate or influencer programs and payments to partners; or (e) the use of the Service by your members, partners or End Users through your Workspace.

21.2 By us. We will defend you against third-party claims that the Service, as provided by us and used in accordance with these Terms, infringes a third party's copyright or trademark enforceable in India, the EU, the UK or the United States, and pay resulting damages awarded or agreed in settlement. We may, at our option, modify the Service, obtain a licence, or terminate the affected Plan with effect from the end of the current Billing Period. This indemnity does not cover claims arising from your Customer Content, Custom Domains, combinations with products not supplied by us, Beta Features, or use after we told you to stop.

21.3 Procedure. The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defence and settlement (provided no settlement imposes obligations on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party's expense.

22. Term, suspension and termination

22.1 Term. These Terms apply from the moment you first use the Service and continue until your Account and Organization are terminated.

22.2 Termination by you. You may stop using the Service and delete your Account or Organization at any time from the dashboard. Deleting an Organization cancels all subscriptions (no further renewals are charged) and starts the data export and grace period in §22.4 and §9.3. Fees already paid are not refunded (§5.15).

22.3 Suspension and termination by us. We may suspend or terminate your Account, Workspace or Organization, or restrict features, if: (a) you breach §7 or §10, in which case we may act immediately; (b) you breach any other provision of these Terms and do not cure it within 14 days of notice, where cure is possible; (c) you fail to pay amounts due after the dunning period in §5.8 — but note that non-payment alone leads to Free limits, not termination, unless the Workspace is also inactive or in breach; (d) we are required to by law, a court or a regulator; (e) you become insolvent, or (f) your continued use poses a security or legal risk to us, other customers or End Users. We will give notice where practical; for abuse, legal demands or security incidents we may act first and notify afterwards.

22.4 Data export window. For 30 days after termination (other than termination for breach of §7, where we may shorten this period), you can export your Links, QR Codes, Pages, analytics (within your Plan's retention) and account data in standard formats (CSV and JSON) from the dashboard or by asking support@urlcrop.com.

22.5 Deletion. After the 30-day window we delete your Customer Content and personal data from live systems within a further 30 days and from backups as they roll off their normal retention (database backups 15 days; file backups up to 6 months), except: (a) invoices, payments and other financial records, which we must keep for 8 years under Indian tax and company law, with personal fields pseudonymised where erasure is requested; (b) records needed to enforce these Terms, resolve disputes or comply with legal obligations; (c) abuse and security records; and (d) aggregated data under §8.6.

22.6 Survival. Sections that by their nature should survive termination do so, including §5 (amounts owed), §8.6, §9.3–9.4, §13, §14, §16, §19, §20, §21, §22.4–22.6, §24 and §29.

23. Service levels and status

23.1 Enterprise SLA. Uptime commitments, service credits and support response times for Enterprise customers are set out in the Enterprise Service Level Agreement attached to the Order Form (API availability target 99.95%). Service credits are the sole remedy for SLA breaches.

23.2 Other Plans. For Free, Starter, Pro, Business and Agency Plans we publish our internal availability targets (redirect availability 99.9%, API availability 99.9%) and our live status at status.urlcrop.com, but these targets are not contractual commitments and no credits are payable.

23.3 Maintenance. We may perform scheduled maintenance with notice on the status page and emergency maintenance without notice. We design redirects to continue during control-plane maintenance.

24. Modifications to these Terms

24.1 We may update these Terms. For material changes we will give at least 30 days' notice by email to the Workspace Owner and by notice in the dashboard before the change takes effect. Changes that are not material (clarifications, typos, new features that do not reduce your rights), or that are required by law or to address a security or abuse issue, may take effect immediately.

24.2 If you do not agree with a material change, you may cancel before it takes effect; fees already paid are not refunded (§5.15). Continuing to use the Service after the effective date means you accept the updated Terms. The current version and its effective date are always available at urlcrop.com/legal/terms, with a change history.

25. Export control and sanctions

25.1 You confirm that you are not located in, organised under the laws of, or ordinarily resident in a country or territory subject to comprehensive sanctions by India, the United Nations, the United States, the European Union or the United Kingdom, and that you are not listed on, or owned or controlled by anyone listed on, any sanctions list maintained by those authorities (including the UN Security Council Consolidated List, the US OFAC SDN List and the EU and UK consolidated lists).

25.2 You will not use the Service for any purpose prohibited by applicable export control or sanctions laws, and you will not permit anyone in a sanctioned territory or on a sanctions list to use your Workspace. We may suspend or terminate the Service, and may refuse payments or payouts, where we reasonably believe a sanctions or export control law would otherwise be breached. Payment providers may apply their own restrictions.

26. Force majeure

Neither party is liable for failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, government action, strikes, failure of the internet or of telecommunications, power outages, denial-of-service attacks, or failure of third-party providers that could not reasonably have been prevented. The affected party must notify the other and resume performance as soon as practicable. If force majeure continues for more than 60 days, either party may terminate the affected Plan with effect from the end of the current Billing Period; fees already paid are not refunded (§5.15).

27. Notices

27.1 To you. We send notices to the email address of the Workspace Owner or Organization billing contact on file, and may also show notices in the dashboard. Notices are deemed received 24 hours after sending unless we receive a bounce. Keep your email address current.

27.2 To us. Legal notices to URLCrop must be sent by email to support@urlcrop.com and by registered post or courier to QalbIT Infotech Pvt Ltd, Attn: Legal, A-1113, Siddhi Vinayak Towers, Opp. S.G. Highway, Makarba, Ahmedabad, Gujarat 380051, India. Legal notices are deemed received on the date of delivery of the physical copy. Support requests, billing questions, privacy requests and security reports should go to support@urlcrop.com, support@urlcrop.com and support@urlcrop.com respectively and are not legal notices.

28. Assignment

You may not assign or transfer these Terms or any Workspace, Organization or Plan without our prior written consent, except to a successor of your whole business who accepts these Terms in writing. We may assign these Terms to an affiliate or to a successor in a merger, acquisition, corporate reorganisation or sale of assets, and will notify you if we do. Any attempted assignment in breach of this section is void.

29. Governing law and dispute resolution

29.1 Governing law. These Terms, and any dispute or claim arising out of or in connection with them or the Service (including non-contractual disputes), are governed by the laws of India, without regard to conflict-of-law rules.

29.2 Informal resolution first. Before starting any formal proceeding, you agree to contact us at support@urlcrop.com describing the dispute, and both parties will try in good faith to resolve it within 30 days.

29.3 Jurisdiction. Subject to §29.4 and §29.5, the courts at Ahmedabad, Gujarat, India have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service.

29.4 Arbitration. Reserved.

29.5 Consumers in the EU, UK and elsewhere. If you are an individual using the Service for purposes outside your trade, business or profession and you live in the European Union, the United Kingdom or another jurisdiction whose consumer protection laws give you mandatory rights, nothing in these Terms limits those rights. You may bring proceedings in the courts of the country where you live, and you may benefit from mandatory consumer protection provisions of that country's law. EU consumers may also use the European Commission's online dispute resolution platform. Nothing in these Terms affects your statutory rights as a consumer under India's Consumer Protection Act, 2019, where applicable.

29.6 Time limit. To the extent permitted by law, any claim must be brought within 2 years of the date the claim arose.

29.7 Injunctive relief. Either party may seek injunctive or other equitable relief in any competent court to protect its intellectual property, Confidential Information or the security of the Service.

30. General

30.1 Entire agreement. These Terms, together with the documents incorporated in §1.4, are the entire agreement between you and URLCrop about the Service and replace all prior agreements, proposals and representations, written or oral. Terms in your purchase orders or vendor forms do not apply unless we sign them.

30.2 Severability. If any provision is held invalid or unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions remain in force.

30.3 No waiver. A party's failure to enforce a provision is not a waiver of its right to do so later.

30.4 Independent parties. The parties are independent contractors. These Terms do not create a partnership, joint venture, agency or employment relationship.

30.5 Third-party rights. Except as stated in §21, no third party has rights under these Terms.

30.6 Language. These Terms are written in English. Translations are provided for convenience; the English version prevails.

30.7 Interpretation. Headings are for convenience. "Including" means "including without limitation". References to law include amendments and replacements.

30.8 Electronic agreement. You agree that these Terms, notices and invoices may be delivered and accepted electronically, including under the Information Technology Act, 2000, and that electronic records have the same force as signed paper documents.

31. Contact

QalbIT Infotech Pvt Ltd. Questions about this document: business@urlcrop.com.