The short version
- For click data your links collect, you are the controller and we are your processor.
- We process it only to provide the service, on your instructions.
- Sub-processors are listed below; we will announce changes in advance.
- Make access, correction, export or deletion requests through the contact page.
This summary is for convenience; the full text below is what applies.
This Data Processing Addendum (“DPA”) forms part of the terms of service between you (the customer) and TheBigBot LLC when GoTinyURL processes personal data on your behalf, mainly the click statistics your short links, bio pages and QR codes record about your audience. It is designed to meet Article 28 of the EU and UK GDPR and the service-provider requirements of US state privacy laws such as the CCPA.
Roles
- You are the controller of personal data in click statistics and in data collected by bio page forms.
- We are your processor (service provider) for that data, and an independent controller for your own account and billing data, which our privacy policy covers.
What we process for you
| Category | Data | Purpose |
|---|---|---|
| Visitors to your links and pages | IP address (used to derive country and city), device, browser, OS, language, referrer, time | Click statistics shown to you |
| People who submit your bio page forms | The fields you collect (for example email, phone, message) | Delivering submissions to you |
We do not use this data for our own purposes, sell it, or combine it with other customers’ data.
Our commitments
- Process the data only on your documented instructions, which are these terms and your settings in the app.
- Make sure people with access are bound by confidentiality.
- Keep appropriate technical and organisational security measures, including encryption in transit, hashed passwords, access controls and backups.
- Help you respond to data-subject requests and with data protection impact assessments where reasonable.
- Tell you without undue delay, and in any case within 72 hours of becoming aware, about a personal data breach affecting your data.
- Delete or return the data when you delete it or close your account, apart from backups that expire on their normal cycle.
- Make information available to show compliance with this DPA.
- Not “sell” or “share” the data as US state privacy laws define those terms.
Sub-processors
| Provider | Service | Location |
|---|---|---|
| Our server host | Hosting the GoTinyURL app and database | See privacy policy |
| Cloudflare, Inc. | Website hosting, security, bot protection | Global |
| Stripe, Inc. | Payments (account data only) | United States and others |
We will announce new sub-processors on this page at least 14 days before using them; you may object by contacting us.
International transfers
Where personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses (and the UK Addendum where relevant) apply and are incorporated by reference.
Your responsibilities
You must have a lawful basis for collecting data through your links and pages, give your audience the notices your local law requires, and use features such as retargeting pixels only with any consent the law requires.
Data requests
Account holders and website visitors can ask us to access, correct, export or delete their personal data, or to restrict or object to processing.
- Go to the contact page and choose Privacy or data request, or use the privacy email below.
- Tell us the email address on the account and what you would like.
- We may ask you to confirm the request from that email address.
- We respond within 30 days (45 days where US state law allows).
Visitors to a customer’s links: the customer controls that data. Contact the person or company who shared the link; if you cannot, contact us and we will pass the request on.
Contact us about this policy
TheBigBot LLC · Worldwide (online). Built for the United States first.. Use the contact page or email: