Privacy Policy

1. Scope and operator

URLVIS is an online service offering short links, custom domains, QR codes, click analytics, and link security features. The service is operated by Tugay AKIN, an independent natural person established in Türkiye. In this policy, “URLVIS”, “we”, or the “Operator” refer to this natural person.

This policy applies to the website at https://urlvis.com, the dashboard, the redirect infrastructure, the support assistant, and the services connected to them. Actions carried out by third parties such as Whop on their own pages are additionally subject to that provider’s privacy terms.

2. Data we process

2.1 Account and subscription data

The email address, the account name derived from the email address, the preferred language, the plan and account status, and the user and membership identifiers transmitted by Whop may be processed. Your password is stored only as a scrypt-derived hash, never in plain text; the one-time links sent by email are used for address verification, team invitations, and password resets.

2.2 Domain, link, and security data

The domains you connect, short link slugs, destination addresses, link titles, expiration times, scan times, risk scores, risk categories, and filter rationales are processed. The QR code is generated from the short address you provide, on your device or within the service.

2.3 Click analytics

Clicks are aggregated by day, approximate country, device type, and the referring site’s domain. ONLY the domain of the referring address is stored (for example, “google.com”); the full address is not stored, because it may contain a search query or an internal page path. URLVIS does not store raw IP addresses in the application database. However, infrastructure providers such as Vercel may temporarily process IP addresses as part of security and access logs for their own retention periods.

2.4 Session, security, and communication data

The strictly necessary urlvis_session cookie is used to maintain your session. Sign-in link records, rate-limit counters, and technical error information may be processed temporarily to prevent abuse. Messages you write to the support assistant are transmitted to Groq to generate a response; you should not enter confidential or special categories of personal data in this field.

2.5 Payment data

Payment card details are collected by Whop; URLVIS does not see or store them. Limited records such as your email, Whop user/membership identifiers, and subscription status may be transmitted to URLVIS.

3. Purposes of processing and legal bases

• Formation and performance of the contract: creating your account, providing sign-in, redirecting links, connecting your domain, generating QR codes, displaying analytics data, and enforcing subscription entitlements.
• Legitimate interest: keeping the service secure, preventing abuse, scanning risky destinations, debugging, and improving the service; these operations are carried out only to an extent that does not harm users’ fundamental rights.
• Legal obligation and establishment of rights: responding to requests arising from legislation, and documenting disputes and security incidents.
• Explicit consent: only if there is a separate operation for which legislation requires explicit consent, it is requested separately before that operation. Operations that are not necessary for the service are not made subject to explicit consent.

4. Service providers and data transfers

To provide the service, we may use the following categories of recipients:

• Neon: storage of account, domain, link, and analytics data on Postgres.
• Vercel: hosting of the application, SSL, domain setup, technical access logs, and cookie-free visitor measurement (page view counts; no identifying cookies are placed, no fingerprinting is performed, no visitor profiles are created).
• Upstash: redirect cache, queues, rate limiting, and short-lived sign-in records.
• Resend: sending sign-in links and service emails.
• Groq: risk analysis of destination page content and answering support assistant messages.
• Google (Safe Browsing): for security scanning, the destination URL is checked against Google Safe Browsing threat lists.
• Whop: payment, subscription, billing, and related customer support processes.
• Security/RDAP providers: checking the reputation and registration details of the destination domain.

Some of these providers are established abroad or process data on infrastructure located abroad. Transfers are carried out on whichever basis applies under Article 9 of the Turkish Personal Data Protection Law (KVKK): an adequacy decision, appropriate safeguards (for example, standard contractual clauses), or the exceptional transfer grounds provided by law. If a provider or transfer method changes, this text is updated.

Data may be transferred to legally authorized public institutions, courts, or law enforcement only when there is a valid legal request, and only to the extent necessary. Personal data is not sold for advertising purposes.

5. Retention periods

• Sign-in link: approximately 15 minutes after it is created.
• Session cookie: at most 30 days, or until you sign out.
• Visibility of click analytics in the dashboard: 7 days on the Free plan, 730 days on the Pro plan, 1,095 days on the Business plan.
• Account, domain, and link data: for as long as the account is active and the data is needed to provide the service.
• Dispute and legal records: for the period required by the applicable legislation or statute of limitations.

When a deletion request is received, data not subject to an ongoing legal obligation is deleted from active systems within a reasonable time or anonymized. Backups are overwritten in the providers’ normal backup cycles. Whop’s and other providers’ own records are subject to their own retention policies.

6. Cookies

URLVIS uses only the technical cookies necessary to keep your account signed in and to maintain security. No advertising, behavioral marketing, or third-party advertising pixels are currently used. If such use is added, prior notice will be given and, where required, a preference mechanism will be offered.

7. Security

Communication is protected with TLS, session cookies are signed, and httpOnly, secure, and sameSite controls are applied in production. Measures such as access restriction, signed webhooks, rate limiting, and link risk scanning are used. No internet service can guarantee absolute security; if you have a security concern, contact us immediately.

8. Your rights and choices

Under Article 11 of the Turkish Personal Data Protection Law (KVKK), you have the right to learn whether your data is processed; to request information about processing and transfers; to have inaccurate data corrected; to request deletion or destruction when the conditions are met; to object to a result produced by automated analysis; and to request compensation for damage caused by unlawful processing.

You can use the export tools in the dashboard to export your account data, and delete your account and all of its data yourself from the settings page; for other requests, you can write to [email protected] from your registered email account. We may ask for additional information to verify your identity and your connection to the account. Requests are concluded within 30 days at the latest.

9. Children’s privacy

URLVIS is intended for businesses and professional users; it is not offered to persons under 18. If you believe a child’s data has been processed unknowingly, contact us to have it deleted.

10. Changes and contact

This policy may be updated when the product or legislation changes. Where appropriate, material changes are announced via the account email or the dashboard before they take effect. The current date is shown at the top of the page.

Data controller: Tugay AKIN
Service name: URLVIS
Contact: [email protected]
Website: https://urlvis.com

11. Language of this policy

The English version of this policy is authoritative. The translations in other languages are provided for information; in the event of any contradiction, the English text prevails.