Privacy notice

1. The short version

We collect three kinds of data: what you give us to run an account, what we record when someone clicks one of your links, and the ordinary technical logs any web service keeps. We do not set a cross-site cookie on the people who click your links, we do not build profiles of them, and we do not sell data to anyone.

2. Data about you, our customer

What: your name, email address, organisation name, and the password hash for your account. If you buy a paid plan, your billing country and the subscription and receipt records our merchant of record, Dodo Payments, sends us. Dodo Payments collects your payment details and billing address itself; we never see or store your full card number.

Why: to give you an account, to bill you, to provide support, and to tell you about material changes to the service. The lawful basis is performance of our contract with you, and our legitimate interest in running and securing the service.

How long: while your account is open, and for seven years after it closes for anything needed to satisfy Indian tax and company law. Support correspondence is kept for two years.

If you ask for access: the request form keeps the name, email address, organisation, website, intended uses, link volume, whether you have a domain of your own, and the notes you type, with how many times you asked and when. The email address is stored encrypted, beside a keyed digest that lets a second request from it be recognised without reading it. Your network address is never stored: only a keyed digest of it, enough to see many requests arriving from one network, which cannot be turned back into the address without a secret key the database does not hold. Brevily's staff who handle new customers read the request; a copy is emailed to the support address and, where staff alerts are on, a summary (your name, organisation, uses and volume, never your email address) is posted to the staff's own chat. Staff record whether you were invited or declined, with an optional note. A declined request is not answered by email. The request is kept until a person decides it, then for 180 days after the decision; if you are invited, the account you then open is covered by the rest of this section. The lawful basis is the legitimate interest in answering you and in keeping the form from being flooded.

If you report a link: the report keeps the link, the reason you chose, your note, your email address if you give one, and your network address (for an IPv6 address, its network part only), and is given a reference you can quote. Your email address and your network address are stored encrypted. Your network address is never shown to anyone: only its keyed digest is compared, to accept one open report per address on a link and to count how many different addresses reported it. Where the form's bot check is on, Cloudflare Turnstile sees your network address and your browser before the report is sent, under Cloudflare's own terms. Brevily's staff who review abuse read the report, with your email address shown to them masked; the support address is emailed the link, the reason and your note, never your email address. The organisation that owns the link is never shown who reported it: it is told that the link was reported and the reason chosen, never your note, your email address, your network address or anything else about you. If you gave an email address, it is used once, to tell you the outcome when the report is closed, and never the reviewer's reasons. A report stays with the record of the link it names, as the record of how that link was handled; write to privacy@brevily.com to have your email address removed from it. The lawful basis is the legitimate interest in keeping the service from being used to hurt people.

Analytics, only with your consent: where it is switched on, this website loads Google Analytics and Microsoft Clarity only after you accept them in its banner, and the console only after you turn usage analytics on under Your account; a shared report page asks its viewer the same way. Each is told the path of the pages you open, never a search, a name or a link; Clarity also records how a page is used, with every text and field masked before it leaves your browser. The Cookies page lists what each sets and how to withdraw. Nothing is loaded for staff, and no customer's click data goes near either.

3. Data about people who click your links

When someone follows one of your short links we record the time, the destination it was sent to, the country the request came from, the device type, operating system and browser family, the browser's user-agent string, the referring site where the browser sends one, whether the link was reached from its QR code, and a random visitor identifier, used to count unique visitors and to keep an A/B test's choice per visitor. We also record a coarse location, the region and the city, as the platform in front of our redirect service reads it from the network address. That identifier is kept in one signed, first-party cookie on the short link's own domain, __Host-sv, for up to a year. Where the link's owner sends clicks to their own webhook or to Google Analytics, a pseudonymous identifier derived from it, different for each of our customers, goes with each click. Known crawlers are recorded as such and counted apart from people. We record the IP address in encrypted form for abuse investigation; it is never used for analytics or shown to you.

What we do not do: we do not set a cookie that follows anyone across sites, we do not build advertising profiles, and we do not resolve a visitor to a named individual. A cross-site cookie is set only when the link's owner adds a retargeting pixel to a link; then the ad platform they chose sets it, under its own terms.

Why: so that you get click analytics, and so that we can detect and stop abuse of the service. For the analytics, we act as a processor on your behalf; you are the controller of your links' click data and our Data processing terms apply. For abuse detection we act as a controller on our own legitimate interest in keeping the service from being used to hurt people.

How long: raw click records for as long as your plan shows them, as listed on the pricing page, and never less than seven days, because the daily counts are built from them; what a plan no longer shows is hidden at once and deleted 30 days later. Aggregated daily counts for longer, because they carry no identifier. The encrypted IP address is deleted after 90 days, or with its click record if that goes first.

4. Destinations you link to

We check a destination when a link is created or its destination changes, and again every 30 days while links to it are clicked, with Google Web Risk and our own heuristics. In between, we request the destination only to see where its redirects end, daily in its first week and then weekly while it is clicked; when it starts landing somewhere new, that is checked at once. We do not read the page itself. Google receives the destination URL and, when it changes, the address it lands on, never your identity or your visitors'. We store the result of the check and the host name it lands on. A destination found to be phishing or malware is flagged, which stops every link to it, in every account, and a person reviews every request to lift a flag.

5. Technical logs

Our hosting providers keep ordinary request logs containing IP address, user agent, path and timestamp, for security, debugging and capacity planning. They are kept for at most 30 days and then deleted.

6. Who we share data with

Paid plans are sold by Dodo Payments as merchant of record. It collects your payment details and billing address under its own privacy notice, charges the tax that applies, and tells us what we need to run your subscription.

Beyond that we use a small number of processors, each bound by contract to use the data only as we instruct:

• our cloud infrastructure and content-delivery providers, for hosting and for serving redirects at the edge;
• our transactional email provider, for account and billing email;
• Google Web Risk, which receives the destination URLs we check, not your identity;
• Telegram, which carries the staff's own alerts, including the summary of a request for access described in section 2, never an email address;
• Google Analytics and Microsoft Clarity, for this website's and the console's own usage numbers, only after you accept or turn it on, and only what section 2 describes.

Click data goes nowhere else unless you send it: the webhooks and Google Analytics 4 forwarding you set up receive the clicks you choose, and the exports and scheduled reports you ask for go where you send them.

We will disclose data to a public authority where we are legally obliged to. We will not do so on an informal request. If we receive an order that covers your data, and the law allows us to tell you, we will.

We do not sell personal data, and we do not share it for advertising.

7. Where data is held

Redirects are served from edge locations worldwide, which means a click may be processed in the region it came from before the record reaches our primary database. Where data leaves India or the European Economic Area, we rely on the transfer mechanisms our providers offer, including standard contractual clauses.

8. Your rights

Depending on where you live you have some or all of these rights: to know what we hold, to get a copy, to correct it, to have it deleted, to restrict or object to processing, and to withdraw consent where consent is the basis. You also have the right to nominate someone to exercise these rights on your behalf if you die or become incapacitated, as provided by the DPDP Act.

Write to privacy@brevily.com and we will respond within 30 days. We may ask you to verify your identity first.

If you are unhappy with our answer you may complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EEA.

9. Grievance officer

Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, our grievance officer is:

• Name: Abhinav A V
• Email: privacy@brevily.com
• Address: as published in the footer of this site

We acknowledge a grievance within 24 hours and resolve it within 15 days.

10. Security

Passwords are stored hashed, never in plain text. Secrets are encrypted at rest. Personal identifiers that need to be searchable are stored encrypted alongside a keyed digest, so a stolen table cannot be reversed against a list of common values. Access to production data is limited to the people who need it and is logged. Report a vulnerability to security@brevily.com; we will not pursue anyone who reports one in good faith and gives us reasonable time to fix it.

11. Children

Brevily is not for children. We do not knowingly process the personal data of anyone under 18. Tell us at privacy@brevily.com if you believe we have, and we will delete it.

12. Changes

We will post any change here and update the date at the top. If a change materially affects how we use your data we will email you before it takes effect.