Privacy Policy
Last updated: October 02, 2026
ProtonURL ("we", "us", "our") respects and protects your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use ProtonURL (the "Service"), and the rights you have in relation to that data.
Please read this Policy carefully before using the Service. By using the Service you confirm that you have read and agree to this Policy. We may update this Policy from time to time; material changes will be communicated in advance via email or in-app notice.
1. Data Controller
The data controller for this Service is:
2. Information We Collect
2.1 Information You Provide
- Account information: email address, display name, and password (hashed) when you register.
- Payment information: transaction amount and payment status. We do not store complete card numbers — card data is processed by our payment provider (see Section 5).
- Communication records: emails, support tickets, and feedback you send to us.
- Third-party login: if you sign in via Google OAuth, we receive basic profile information authorized by you.
2.2 Information We Collect Automatically
- Device & network: IP address, device model, operating system, browser type, timezone.
- Usage behavior: page visits, feature usage, operation logs, session duration.
- Log data: request timestamps, error logs, performance data.
3. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Providing and maintaining the Service | Contract performance |
| Billing and payment processing | Contract performance |
| Customer support | Contract performance / Legitimate interest |
| Service notifications (billing, security, policy updates) | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Product optimization and analytics | Legitimate interest |
| Legal compliance | Legal obligation |
We may aggregate or de-identify data for statistical analysis. Such data cannot be traced back to any specific individual.
4. Cookies and Tracking Technologies
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Maintain login, core functionality | No |
| Functional | Language preferences, personalized settings | Yes |
| Analytics | Anonymous usage statistics, product optimization | Yes |
You can adjust your preferences via your browser settings or our cookie management tool.
5. Sharing and Disclosure of Personal Information
We do not sell your personal information, including "selling" as defined under applicable laws such as the CCPA. We only share your information in the following circumstances:
- Service providers: cloud computing, payment processing, customer support, and analytics vendors, bound by confidentiality agreements. Payment card data is processed exclusively by our PCI-DSS compliant payment processor Waffo Pancake and is never stored on our servers.
- Legal and regulatory requirements: as required by law, court order, or legitimate authority.
- Business transactions: in the event of a merger, acquisition, or similar corporate transaction, with protection obligations extended in advance.
- With your consent: for any other purpose, only with your explicit prior consent.
6. Data Security Measures
- Transport encryption: TLS / HTTPS.
- Storage security: passwords and sensitive data are hashed or encrypted.
- Access control: least-privilege principle; staff sign confidentiality agreements.
- Regular security audits and vulnerability scanning.
In the event of a security incident affecting your rights, we will notify you and relevant regulators within 72 hours of discovery, as required by law. Please keep your account credentials secure and do not share them with others.
7. Data Retention
| Data Type | Retention Period | Disposal on Expiry |
|---|---|---|
| Account information | During active subscription; 90 days after account deletion | Secure deletion or anonymization |
| Transaction records | As required by law (typically 7 years) | Archived or deleted |
| Support records | 3 years | Secure deletion |
| Security audit logs | 12 months | Secure deletion |
| Encrypted link content | Until read once or expired | Permanent deletion |
| Link metadata | 30 days after creation | Automatic purge |
8. Your Data Rights
To exercise any of the following rights, contact us at . We will process your request within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal data |
| Right to rectification | Correct inaccurate or incomplete information |
| Right to erasure | Request deletion of your data under certain conditions |
| Right to restrict processing | Pause data processing under certain conditions |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests or marketing |
| Right to withdraw consent | Withdraw consent for processing based on consent |
If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority.
9. Marketing Communications & Opt-Out
We may send marketing communications about our Service via email or in-app notifications, only with your consent where required by law. You can unsubscribe at any time: click the "unsubscribe" link in any marketing email, disable marketing notifications in your account settings, or contact us. Opting out does not affect service-necessary notifications such as billing and security alerts.
10. International Data Transfers
Our servers and partners may be located internationally. When data is transferred across borders, we protect it through: Standard Contractual Clauses (SCC) in data processing agreements; transfers only to recipients providing equivalent protection levels; and other mechanisms such as adequacy decisions or BCRs where applicable.
11. Children's Privacy
This Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from individuals below this age. If you believe a child has provided us with data, please contact us immediately and we will promptly delete it.
12. Third-Party Links and Services
This Service may contain links to third-party websites or integrate with third-party services. This Policy applies only to information we directly collect. We are not responsible for the data practices of third parties; we recommend reviewing their policies before using their services.
13. Changes to This Policy
We may update this Policy at any time. Material changes will be announced at least 15 days in advance via in-service notice or email to your registered address, and the "Last updated" date at the top of this page will be revised. Your continued use after the effective date constitutes acceptance of the revised Policy.
14. Contact Us
- Privacy contact:
- Customer support:
- Company: ProtonURL
- Service hours: Monday to Friday, 09:00–18:00 UTC+8
This Privacy Policy is for informational purposes only and does not constitute legal advice. We strongly recommend having a qualified legal professional familiar with your target market review this Policy before publishing.