Who is responsible
Applied Gravity Limited, Hong Kong, runs CTAurl and is responsible for the personal data described here. This policy follows the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Send privacy questions and requests to support@ctaurl.com.
Two groups of people
Account holders sign up and create links or QR codes. Visitors tap a CTAurl link or scan a CTAurl QR code. Visitors usually have no relationship with us, so we keep what we learn about them to what we need to redirect and count the request.
What we collect from account holders
- Account details: name, email address and sign-in data, handled through our sign-in provider. We do not store your password ourselves.
- Billing details: billing name, address and payment status. Our payment provider handles card numbers; we never see or store a full card number.
- Your content: links, destinations, back-halves, tags, QR codes, QR logos and settings.
- Messages you send us and our replies.
- Technical data used to keep accounts secure, such as sign-in times.
What we record when a link is tapped or a code is scanned
To redirect a request, our server sees the time, the link, the IP address, the browser's user agent, the referring page if the browser sends one, and the language setting.
On links using the standard privacy setting, the click record keeps: the time, the link and its domain, whether it was a link or a QR scan, country and city, the referrer's host name (not the full address), device type, operating system and browser family, the platform (for example social or messaging), and the utm_source, utm_medium and utm_campaign tags in the destination. It also keeps the back-half used and, for a QR scan, which design variant of the code was scanned.
The click record does not keep the IP address, the full referring address or the raw user agent. On links set to minimal or off, the record keeps only the time and whether it was a link or a QR scan.
A QR code set to ask for location shows a consent page first. Only a visitor who agrees shares their position, to within about 40 metres. That position is kept with the click record and deleted with it after about 90 days. A visitor who does not agree goes on to the destination without sharing it.
Tapping a link does not set a cookie, and we do not put a script on your destination page.
Why we use it
- To run the service: create and redirect links, show you counts and run your account.
- To bill you for a paid plan.
- To keep the service safe: detect phishing, malware, spam and abuse, and protect our domains.
- To answer your messages and tell you about changes to the service or these policies.
- To meet legal obligations, such as tax records or a valid order from a court or authority.
We use personal data only for these purposes or a directly related one, and we ask first before using it for anything new.
Direct marketing
We send marketing emails only if you agree, and every one has a free way to opt out. We do not sell or give your personal data to anyone for their marketing.
Who we share it with
We share personal data with the service providers who help run CTAurl, and they may use it only to provide their service to us: Cloudflare (hosting, redirects and click counting), Clerk (sign-in), Stripe (payments), Resend (email) and Google (the app fetches the site icons of destination websites from Google, and loads Google Fonts).
We also share it with authorities when the law requires it or when we must report abuse such as phishing, and with a buyer if the business is ever transferred. That buyer must keep this policy's protections. We do not sell personal data.
Transfers outside Hong Kong
Our providers store or process data in data centres outside Hong Kong. We choose providers that protect data to a standard comparable to Hong Kong law and bind them by contract.
How long we keep it
- Detailed click records, including any position a visitor agreed to share: about 90 days, after which they are deleted.
- Account details: while your account is open, and up to 12 months after it closes, unless the law requires longer.
- Billing records: 7 years, as Hong Kong tax rules require.
- Abuse reports and evidence: as long as needed to deal with the abuse and any legal claim.
How we protect it
Data is encrypted in transit. A dedicated sign-in provider handles sign-in. Access to production data is limited to the people and providers who need it to run the service. If a breach is likely to cause real harm, we will tell affected users and, where appropriate, the Office of the Privacy Commissioner for Personal Data without undue delay.
Your rights
You can ask whether we hold your personal data, ask for a copy and ask us to correct it. Write to support@ctaurl.com; we reply within 40 days and may need to confirm your identity first. You can also ask us to delete your account and data, or to stop marketing to you.
If you are a visitor and want to know about a click record, send us the link and the time you tapped it, and we will check what we hold. If you are not satisfied, you can complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).
Children
CTAurl is not meant for children under 18, and we do not knowingly collect their personal data. If you think a child has given us data, tell us and we will delete it.
Cookies
The app uses a small number of essential cookies; this website and link redirects use none. The Cookie Policy lists them.
Changes to this policy
If we make a change that matters, we will email account owners before it takes effect and update the date on this page.