Privacy Policy

This Privacy Policy explains how URLO.si processes information when you create a short URL, visit a short link, generate a QR code or contact us. Our aim is to limit personal data collection while protecting the service from abuse. We seek to follow principles of transparency, data minimization and security when processing visitor information.

1. Data controller and contact

The person or organization operating URLO.si is responsible for deciding why and how the personal information described in this policy is processed. The operator's published contact details appear in the Operator and contact section. You can use the listed privacy email address for questions or rights requests.

2. Information used to provide short links

When you submit an address, URLO.si stores the original URL, a generated short code, the selected shortening domain, timestamps and aggregate usage counts. A URL can itself contain personal information, so avoid putting confidential identifiers or sensitive details in submitted links. The optional QR code represents your short link and is generated in the browser; URLO.si does not need to save a separate QR image.

3. Abuse protection and daily limits

To enforce daily creation limits and discourage abuse, URLO.si briefly processes the IP address associated with each submission. The PHP application stores only keyed, pseudonymous quota and rate-limit identifiers—not visitors' raw IP addresses, IP histories or individual activity profiles. The quota identifier is needed for the current UTC day; expired records are cleared by housekeeping. Cloudflare and the web host may independently process connection information for security and delivery. Essential anti-abuse measures do not depend on your optional cookie choices.

4. Reports and communications

If you submit an abuse report or contact URLO.si, we process the details you provide, including the reported URL and any message or contact information. This is used to investigate, respond to and document service-safety issues. Please avoid sending sensitive personal information unless necessary.

5. Analytics and public statistics

The homepage may display aggregate totals, such as links created and redirects; these counters do not identify visitors. If enabled, Google Analytics is blocked until you choose to allow optional analytics in our cookie banner. Rejecting analytics prevents the Google Analytics tag from loading and sending measurement requests from URLO.si. You may change your choice using Cookie settings in the footer. Google can process information when you expressly enable its analytics technology.

6. Cookies, preferences and advertising

A necessary, first-party PHP session is used for form security and administrator access. Optional cookie choices are remembered in your browser for up to six months, and the site's appearance preference may also be stored locally. First-party text or image ads can be shown without tracking cookies; optional ad-network scripts may use additional technologies when permitted and configured. Read our Use of Cookies page for further detail and available choices.

7. Hosting, security providers and destinations

URLO.si uses web hosting and may use Cloudflare for DDoS protection, security challenges and traffic filtering. These providers may process connection information, including IP addresses, independently of URLO.si's MySQL records. When you follow a shortened link, you leave URLO.si for a separate website with its own privacy practices. Third-party providers may process data outside your country, subject to applicable safeguards.

8. Purposes and legal bases

The operator may rely on service provision where necessary to fulfil the requested shortening service; legitimate interests, subject to a balancing assessment, for security, abuse prevention and operational integrity; and consent for optional storage or tracking where required. The lawful basis depends on the purpose and circumstances, and applicable law may require additional safeguards or consent.

9. Retention and security

Short links and associated aggregate statistics remain until removed under the published link-retention policy. The application deletes expired daily quota identifiers after the relevant UTC day and rate-limit identifiers older than 24 hours, using periodic cleanup and a recommended scheduled cPanel job. No raw visitor IP history is kept in the application's MySQL database. Hosting and Cloudflare may retain separate access/security logs according to their policies. The operator restricts administrative access and maintains appropriate security safeguards.

10. Your rights

If the EU General Data Protection Regulation (GDPR) applies to your personal data, you may have the right to request access, correction, deletion, restriction of use or portability, and to object to certain processing. Where processing relies on consent, you can withdraw that consent. You may also complain to an EU data protection supervisory authority. Some rights depend on the legal basis and circumstances. Contact the site operator using the privacy contact details provided below. We will consider requests under applicable law.

11. Updates to this notice

We may update this notice when the service, its providers or legal requirements change. The Last updated date at the top identifies the published version.