Privacy Policy

This policy explains what data Zebra collects, why we collect it, and what we do with it. We comply with the EU General Data Protection Regulation (GDPR) and Danish data protection law.

What We Collect

Account Data

When you sign up, we store:

• Your email address
• Your password (encrypted — we never see or store it in plain text)
• OAuth provider info (if you sign in via a third-party account)
• When your account was created
• Language and locale preferences

Link Data

When you create links, we store:

• The destination URL
• The link code
• Custom domains you connect (if any)
• Any titles or metadata you add
• When the link was created or last updated

Analytics Data

When someone clicks one of your links, we collect privacy-focused analytics:

• When the click happened
• Browser type and version
• Operating system
• Device type (mobile, desktop, tablet)
• Approximate location (country, region, and city, plus approximate coordinates, derived from IP address)
• Referring website (if any)
• Which of your links was clicked — its short domain, path, and destination URL at the time of the click
• Whether the click came from a QR code scan, and which of your QR codes and signal values it carried (signals are labels you define yourself in QR Studio)
• Whether we classified the visitor as automated (a bot, crawler, or AI agent), and the agent's name when it identifies itself
• Technical delivery details: which of our edge datacenters served the redirect, how long it took, and whether it was served from cache
• A keyed hash of the visitor's network: we first shorten the IP address so it identifies a network block rather than a single connection, then hash the result with a secret key. The raw address is never stored.

About location accuracy: Location data is resolved automatically at the infrastructure level — the visitor's IP address is converted to an approximate geographic location by our edge provider as part of the request, then immediately shortened and hashed with a secret key. The raw IP address is never stored, never logged, and never seen by a human. It exists only in memory for the duration of a single request, then it's gone. What we retain is the keyed network hash and the location data derived from the address: country, region, city, and approximate coordinates.

Country-level data is generally reliable. City-level data is not — and you should treat it as a rough estimate rather than fact. Modern privacy technologies like Apple's iCloud Private Relay, VPNs, corporate proxies, and mobile carrier NAT routinely mask or relocate the apparent origin of web traffic. A visitor physically in one city may easily show up as being in another.

This is a deliberate trade-off. We chose not to use invasive techniques like browser fingerprinting or client-side geolocation prompts that could provide more precise results. We think respecting visitor privacy is more important than pinpoint accuracy. The analytics we provide are a directional tool for spotting broad geographic trends, not for drawing precise conclusions about where individual clicks came from.

What we show link owners: Link owners always see that a click happened and when. What they never see is where an individual visitor is. A city, region, or country is named in analytics only once enough different visitors share it, so a named place always describes a crowd, never a person. Below that, a click shows at most a broader area that enough visitors do share, or no location at all. QR codes work the same way: scans are attributed to a named code variant only once enough different people have scanned it.

This covers everything we derive from a click, including which QR codes and signal values appear in reports; those too are named only once enough different people share them. It cannot cover an identifier the owner attaches and hands out themselves. A link or a code given to one specific person is a read receipt by construction, because its own counts and timing are the product and are never hidden.

About device and browser data: Device type, browser, and OS are parsed from the visitor's user agent string. This is generally reliable but not perfect — some browsers report misleading user agent strings for compatibility, and browser vendors are increasingly reducing the information they expose. Treat device analytics as directionally useful.

Payment Data

Payments are handled by Stripe. On our end, we store:

• Your Stripe customer ID
• Subscription status and plan tier
• Subscription start and end dates
• Currency preference

We never see or store your credit card number. Stripe handles all payment details under PCI-DSS standards.

Technical Data

We automatically collect:

• Browser locale and time zone
• Theme preference (light or dark mode)
• Usage patterns for performance optimization

Why We Process Your Data

We have a legal basis for everything we do with your data:

• Contractual necessity: We need your data to provide the link management service you signed up for
• Legitimate interests: Improving performance, preventing abuse, and providing analytics
• Consent: For optional things like marketing emails (only if you opt in)
• Legal obligations: Tax, accounting, and regulatory compliance

How We Use Your Data

• Running and maintaining the link management service
• Authenticating you and managing your account
• Processing payments and managing subscriptions
• Providing analytics on how your links perform
• Sending transactional emails (verification, password resets, billing)
• Detecting and preventing abuse, fraud, and security issues
• Improving the service and user experience
• Meeting legal obligations

Who We Share Data With

Only the service providers we need to run the platform:

All of these providers offer EU-based data centers, are GDPR-compliant, and operate under appropriate safeguards including Standard Contractual Clauses (SCCs).

We never sell your data. We never share it with advertisers.

Operator access. A small number of Zebra operators can access production data, including click analytics at full detail, for site operations: debugging, abuse prevention, security, and support. This access is limited to what running the service requires.

How Long We Keep Your Data

After deletion, data may linger in backups for up to 30 days before it's permanently removed.

Your Rights Under GDPR

You have the right to:

• Access — get a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — delete your account and data
• Portability — export your data in a structured format
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interests
• Withdraw consent — for anything you opted into

You can exercise most of these directly in your account settings. Account deletion is available there too. For anything else, contact us through support.

You can also file a complaint with your local data protection authority. In Denmark, that's Datatilsynet.

Cookies

We use essential cookies only — no third-party trackers, no ad cookies:

• Authentication cookies — to keep you logged in
• Preference cookies — to remember your theme and locale

These are strictly necessary for the service to work and don't require consent under GDPR.

Security

We take reasonable measures to protect your data:

• Encryption in transit (TLS/HTTPS) and at rest
• Industry-standard password hashing
• Visitor IP addresses shortened and hashed with a secret key before storage; the raw address is never written down
• Access controls and authentication
• Regular security updates and monitoring
• Encrypted automated backups

No system is perfectly secure. Keep your login credentials safe.

International Data Transfers

If any of your data is processed outside the EU/EEA, those transfers are protected by:

• EU Commission-approved Standard Contractual Clauses (SCCs)
• Our providers' GDPR compliance commitments
• Appropriate technical and organizational safeguards

Children

This service isn't for anyone under 16. We don't knowingly collect data from children. If you think a child has given us personal data, let us know and we'll remove it.

Changes to This Policy

We may update this policy as our practices or legal requirements change. If we make material changes, we'll notify you by email or in-app notification. Continued use after a change means you accept the updated policy.

Data Controller

Zebra is operated from Denmark. We're responsible for your personal data. You can reach the data controller at privacy@zeblink.io.

Contact

For privacy questions, data requests, or to exercise your rights: contact us.

For data protection matters, you can also contact the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.