Privacy notice

This notice explains what Enrico Rossini collects when you use zaq.to, or when you open a link someone made with it, and what we do with it. We are the controller of this data under UK data protection law.

If you have an account

• Account details: your email address and, if you set them, a password (stored only as a salted hash) and passkeys (we hold only the public key; the private key never leaves your device).
• What you create: your links, their destinations, titles, tags, folders and QR settings, and any files you upload.
• Emails we send you: sign-in links, confirmations and account notices. We keep a record of each one — address, subject, content and whether it was delivered — so we can answer "did you send me that?".
• Billing: if you buy a paid plan, our payment provider handles your card. We never see or store the full card number; we keep your plan, its dates and a reference to the payment.

We use this to run your account and provide the service you signed up for (the lawful basis is our contract with you), and to keep the service secure (our legitimate interests).

If you open a zaq.to link

Every time a short link is opened we record a visit, so the person who made the link can see how it's doing. For each visit we store:

• the time;
• the country the visit came from, worked out from your IP address;
• the kind of device (phone, tablet or desktop), the operating system and the browser — the family only, not version numbers;
• the page you came from, if your browser sends one;
• whether the visit looks automated;
• a one-way, salted hash of your IP address, used to count unique visitors and spot abuse.

We do not store your IP address, we don't set cookies when you open a link, and we don't build a profile of you across links. The hash can't be turned back into an address and can only be compared with other hashes made by zaq.to.

To find the country, we look your address up in our own list of network ranges — blocks of addresses that belong to an internet provider, not to a person. If your network isn't on the list yet, we ask MaxMind, a geolocation service, which tells us the country and the range it belongs to. We keep only the country — never your city or anything more precise. The link's owner sees totals and breakdowns, never individual visits. The lawful basis is our legitimate interest, and theirs, in knowing how a link is used.

If you contact us

If you use the contact form, we receive your name, email address, the topic you chose and your message, and use them only to answer you (our legitimate interest in responding). They reach us as an email in our support inbox, and a copy is kept in our record of sent emails. If you're signed in, we also note which account it came from.

Cookies

We only set cookies that the site needs to work: one that keeps you signed in, and security cookies that stop other sites submitting forms in your name. There are no advertising or analytics cookies, so there's nothing to consent to.

Pages on zaq.to load their fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them. Google's privacy policy covers that.

Who else handles your data

We use a small number of providers to run the service, each under a contract that only lets them use the data to provide it to us:

• our hosting provider, which runs the servers and stores the database and files;
• our email delivery provider, which sends the emails described above;
• MaxMind, Inc. (United States), which receives a visitor's IP address when we need to look up its country, under MaxMind's privacy policy;
• our payment provider, if you buy a paid plan.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK's approved contract clauses. We don't sell personal data, and we only disclose it to others where the law requires it.

How long we keep it

• Account details and what you create: for as long as you have an account.
• Visit records: for as long as the link they belong to exists.
• Our record of emails we've sent: one year. The content of each email is deleted after 30 days; only the address, subject, time and whether it was delivered remain.
• Billing records: as long as tax law requires — six years in the UK.

You can delete your account from your account settings at any time. That erases, straight away, your sign-in details, your links' destinations and titles, every visit recorded on them, your files, folders and tags, and our record of emails sent to you. The short codes you used stay reserved, owned by no one, so that nobody else can take over a link you once printed or shared — but nothing about them points back to you.

Your rights

You can ask us for a copy of your data (much of it is downloadable from your account settings), and ask us to correct it, erase it, restrict how we use it, or hand it over in a portable format. You can also object to our using it on the basis of legitimate interests. Email info@zaq.to; we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Children

zaq.to isn't meant for anyone under 13, and we don't knowingly hold their data.

Changes

If we change what we collect or how we use it, we'll update this notice and the date at the top, and email account holders about anything significant.