Your data, clearly explained.

What information we use and how you can manage it.

Updated on 5 November 2026

This notice covers the YURL website, short URLs, personal pages on yurl.page and free tools. It explains how we process the data of account holders and people who visit or use these services.

Why we process data

• Accounts, sign-in, URLs, personal pages and support: to provide the requested service, under GDPR Article 6(1)(b). An email and password are needed for an account; additional profile details are optional.
• Security, abuse prevention and limited internal statistics on signups and creations: for our legitimate interest in protecting and maintaining the service, under GDPR Article 6(1)(f). You may object under the conditions set out in the GDPR.
• The newsletter with YURL news, tips and offers: only with your optional consent, under GDPR Article 6(1)(a). Refusing or withdrawing it does not limit your account or Free plan.
• Requests from authorities and legal obligations: where applicable, under GDPR Article 6(1)(c).

Reading this notice does not require a consent checkbox. Accepting the terms of use and choosing to receive the newsletter are separate decisions.

Tools without an account

The static QR generator and campaign URL builder process content in your browser. Entered URLs, text, logos and parameters are not sent to YURL, saved in the database or kept in persistent browser storage. Loading the website involves normal technical requests to the server. If you are already signed in, your session rules still apply.

We record the tool used, date and time, bot verification and generation outcomes, the page language (IT or EN) and estimated network country when available. To recognize usage from the same network, we store a protected identifier derived from the IP, not the plain IP address. These records are pseudonymous, not anonymous: the same code can appear in activities from a shared network. Free-tool events do not include an account ID. They support internal statistics and abuse prevention, not advertising. The planned retention is 30 days, with periodic deletion. These events do not contain the QR content, logo, URL or campaign parameters.

We use Cloudflare Turnstile to deter automated submissions during signup, login, password recovery requests, verification email resends, abuse reports and generation with our free tools. The widget loads when you submit the form or request a generation and processes technical browser and connection data. YURL sends Cloudflare the anti-bot token for verification: it does not add passwords, email addresses, report contents, QR contents or logos to that request. Turnstile privacy

Language and origin of creations

When you sign up or create a short URL, a personal page or an editable business card, we associate the page language (IT/EN), a pseudonymous network code derived from the IP and the estimated country of the connection with the activity and your account. We collect the same details on static QR and campaign tool events. We process the IP on our server using a local geographical database. A VPN or company network may affect the estimated country. Authorised administrators use these details for internal statistics and abuse prevention. Origin details are available for 30 days and are deleted periodically. IP Geolocation by DB-IP.

Digital business cards

Without an account, the contact details are encoded in the QR and vCard on your device. With an account, we store the fields you choose to complete. Drafts are private. Once published, anyone with the QR or address can read and download the details. You can unpublish or delete the card from your dashboard. Copies already saved to someone’s address book stay on their phone.

Your account

We store your email, a protected representation of your password, your verification status and information needed to keep you signed in. Your original password is not stored.

If you provide them, we also store your first name, last name and country in your private profile. You can edit or remove them from Account without changing your public page. The newsletter is optional and off by default: choose it during signup or in Account. We record your choice, its date and the version of the notice shown; withdraw it in Account and save your change, or email privacy@yurl.com. Essential sign-in and security communications remain separate.

URLs and statistics

We store the URLs you create, destinations, titles, expiry dates and renewals. Statistics count opens without storing visitor IP addresses or individual histories in the click counters. Data needed to prevent abuse is processed separately.

Your personal page

We store your page nickname, name, bio, photo and buttons. Drafts are private; published content is visible to anyone with the address. Photos are resized and metadata is removed. We count views and clicks in aggregate without identifying people. Deleting your account removes content and photos; the nickname remains reserved to prevent impersonation.

Cookies and communications

Read the cookie policy for details of necessary cookies, their lifetimes and bot checks. We do not use advertising or profiling cookies.

We use a necessary login cookie. Your session expires after 7 days of inactivity and renews while you use the site. We do not use advertising trackers. Your email is also used to confirm your account, recover your password and notify you when it changes. Email verification links expire after 24 hours; password recovery links after 30 minutes. Both can only be used once.

Technical emails are sent through Mailjet, which receives the recipient address and the content needed for the message. We disable open and click tracking for these emails. Reply or contact hello@yurl.com for support.

Export and deletion

Download your data or delete your account from the dashboard. Archived URLs remain in your archive until you delete them; their aliases may already belong to someone else. Some technical references and reports may be retained to prevent abuse and handle people’s rights.

Technical data and providers

Website requests involve processing IP addresses, timestamps, requested resources and technical browser information. Server and provider logs are separate from visit and click counters and support operation, diagnostics and security. Application rate limits use protected identifiers and time windows. Destination checks involve DNS queries to the server’s resolver, without downloading destination pages.

Recipients include authorised staff, hosting and infrastructure providers, Mailjet for technical emails and Cloudflare for Turnstile. Cloudflare processes signals such as IP and connection/browser characteristics: it acts on our behalf to protect the site and as a separate controller to improve its bot detection, as described in its notice. Authorities may receive data where required by law.

International providers’ services may involve processing outside the European Economic Area. Contact our privacy address for information about countries, providers and applicable safeguards. Cloudflare’s notice also describes its own processing.

How long we keep data

• Account, profile, URLs and pages: while the account is in use, until deletion; newsletter preferences and their history remain linked to the account. Deleted content is removed, while reserved aliases and nicknames may remain without content to prevent misuse.
• Pseudonymous tool events: 30 days. Reports: 90 days. Moderation records: 180 days. Deletion is performed by periodic cleanup.
• Sessions: 7 days of inactivity. Email verification tokens: 24 hours; password reset tokens: 30 minutes. Expired temporary credentials can no longer be used and are removed by periodic cleanup.
• Technical logs and backups are kept for the time needed to diagnose incidents and restore the service, with restricted access. Data needed for legal obligations or disputes is kept for the duration of those obligations or the dispute.

Your rights

You can request access, correction, deletion, restriction and portability where the GDPR provides for them, and object to processing based on legitimate interests. Newsletter consent can be withdrawn at any time without affecting the lawfulness of earlier processing. Send these requests to privacy@yurl.com; we may ask for proportionate information to verify your identity. You can complain to the Italian Data Protection Authority or the competent authority where you live or work. How to exercise rights and lodge a complaint.

Contact

For questions about your data, email us at privacy@yurl.com.