Privacy policy

This policy explains how URL Flow (“we”, “us”), a product of Flowpera.com, handles information when you use our website and services. It covers both people who hold an account with us and visitors who simply open a short link someone shared.

Who we are

URL Flow is a link shortening service operated by Flowpera.com. For the purposes of data protection law we are the controller of the personal data described in this policy. You can reach us at any time through the contact page.

What we collect

We collect four kinds of information, and nothing beyond them.

• Account information. When you register we collect your name, email address, phone number, and a password. The password is stored only as a secure one-way hash — we cannot read it, and neither can anyone who obtained a copy of our database.
• Link and visit analytics. When someone opens a short link we record technical details about that visit: a hashed (irreversible) form of the IP address, the approximate country, device type, browser, operating system, and the referring page. We do not store raw IP addresses, and we do not attempt to identify individual visitors.
• Payout details. When you request a withdrawal we collect the payment details needed to send the money — for example a PayPal email, a mobile wallet number, or bank account details. These are used only to process that payout.
• Messages you send us. If you write to us through the contact form we keep your message, your email address, and our reply, so there is a record of what was asked and what we agreed.

How we use it

• To operate your account, your links, your statistics, and your balance.
• To calculate earnings, which depend on the visitor's country.
• To detect and prevent fraudulent, automated, or incentivised traffic.
• To review and pay withdrawal requests.
• To send transactional email such as address verification, password resets, payout status updates, and article review decisions.
• To answer your support messages.
• To keep the service secure, available, and free of abuse.

We do not use your data to build advertising profiles about you, and we do not send marketing email you did not ask for.

Legal bases

If you are in a region covered by the UK/EU GDPR or a comparable law, we rely on the following legal bases:

• Contract — running your account, crediting earnings, and paying withdrawals are all necessary to provide the service you signed up for.
• Legitimate interests — fraud detection, security, and aggregate service statistics, balanced against your rights.
• Consent — personalised advertising cookies, where consent is required in your region. You can withdraw it at any time.
• Legal obligation — retaining records we are required to keep, and responding to lawful requests.

Cookies and advertising

We use strictly necessary cookies to keep you signed in and to protect forms against abuse. These cannot be switched off without breaking the service.

We also display advertising on our content pages, including Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and/or other sites on the Internet. You can opt out of personalised advertising through Google Ads Settings, or opt out of third-party vendors' use of cookies for personalised advertising at aboutads.info. Our cookie policy lists each category in detail.

Who we share with

We do not sell your personal information. We share data only with the service providers needed to run URL Flow, and only the minimum each one requires:

• Hosting and database providers that store the application and its data.
• Email delivery providers that send transactional messages.
• Advertising networks that serve ads on our content pages.
• Payment providers used to send your withdrawals.

We also disclose information where we are legally required to, or where it is necessary to investigate fraud or protect the rights and safety of our users.

International transfers

URL Flow is operated internationally and our providers may process data in countries other than your own, including outside the UK and European Economic Area. Where that happens we rely on appropriate safeguards, such as standard contractual clauses or an adequacy decision covering the destination country.

How long we keep it

• Account data — for as long as your account is open, and for a short period afterwards to handle disputes and legal obligations.
• Visit analytics — individual visit records are kept only as long as needed for fraud checks and statistics, after which they remain only in aggregate form that cannot be traced back to a visitor.
• Payout records — retained as financial records for as long as applicable law requires.
• Support messages — kept while they are useful for context, then deleted.

Security

Passwords are stored as salted hashes, connections to the site are encrypted in transit, and access to production data is limited to the people who need it to operate the service. No system is perfectly secure, so we also ask you to do your part: use a password you don't reuse elsewhere, and tell us immediately if you think someone else has access to your account.

Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent you previously gave. If you are a California resident, you also have the right to know what we collect and to request deletion, and the right not to be discriminated against for exercising those rights — noting again that we do not sell personal information.

To exercise any of these, write to us through the contact page from the email address on your account. We will confirm the request before acting on it, and respond within the timeframe your local law requires. If you believe we have handled your data badly, you also have the right to complain to your local data protection authority.

Children

URL Flow is not directed at children under 16 and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

We may update this policy as the service changes or the law does. The “last updated” date at the top always reflects the current version, and we will highlight significant changes on this page rather than changing them quietly.

Contact

For any privacy question or request, reach us through the contact page. A person reads and answers every message.

Still have a question about this document? Reach the team through the contact page and we'll answer it directly.