Skip to main content
Legal

Privacy policy

Effective October 1, 2026

1. Overview

Qorlivo ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our URL shortening platform at qorlivo.com and its subdomains ("Service").

By using the Service, you agree to the collection and use of information as described in this policy.

2. Information we collect

Account Information

When you create an account, we collect your name, email address, and authentication credentials. Sign-in is handled by Clerk. If you sign in via Google or GitHub (OAuth), we receive only the profile information you authorize.

Payment Information

Paid subscriptions are processed through Stripe. We do not store your full card details, only the last 4 digits, card brand, and expiry date that Stripe returns for display purposes.

Links & Custom Domains

We store the long URLs you shorten, any custom slugs you choose, and the custom domains you configure. This data is necessary to operate the redirect service.

Click Analytics

When someone clicks one of your short links, we log the following to provide analytics:

  • Timestamp of the click
  • Referrer URL (the page the visitor came from, if sent by the browser)
  • Device type (mobile, tablet, desktop)
  • Browser and operating system
  • Country and region (derived from IP address; the raw IP is not stored)

We do not store raw IP addresses beyond what is temporarily needed to resolve the geographic region. Click data is attributed to links, not to individuals.

Usage & Log Data

We automatically collect server logs including request timestamps, API endpoint accessed, HTTP status codes, and response times. This data is used for debugging, performance monitoring, and security.

Error Reports

When something breaks in the dashboard, an error report is sent to Sentry: the error, the page it happened on, and browser and device details. Session replay is turned off, so Sentry does not record what you see or type.

Advertising Measurement

We advertise Qorlivo on Meta (Facebook and Instagram). With your permission only, we tell Meta about visits to our marketing site, sign-ups, and new subscriptions so we can measure those ads. Section 4 explains when this happens, what Meta receives, and how to turn it off.

3. How we use your information

We use the information we collect to:

  • Provide, operate, and improve the Service
  • Authenticate your account and validate API key requests
  • Show you click analytics for your links in the dashboard
  • Send transactional emails (account verification, password reset, billing receipts)
  • Detect and prevent abuse, spam, and security incidents, including checking shortened URLs for malware and phishing and screening uploaded videos
  • Measure our own advertising on Meta, only when you allow it (see section 4)
  • Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information, and we do not use your data to train AI models. The only advertising company we share data with is Meta, for ad measurement, and only with your permission as described in section 4.

4. Cookies, advertising, and local storage

We use essential cookies to keep you signed in, and localStorage to remember your theme (light, dark, or system) and your answer to our cookie banner. Our Cookie Policy lists them.

Advertising measurement is off until you turn it on. It reaches Meta in three ways:

  • Meta Pixel on qorlivo.com: loads on our marketing pages (such as the home page, pricing, blog, and the page you see after checkout) only after you accept advertising cookies in the banner, or when you are signed in and your account setting allows ad measurement. It never runs on creator pages (bio pages, video, collection, embed, and share pages), on short-link redirects, or on custom domains. It sends Meta page views and, after checkout, a subscription event, along with your IP address, browser details, and Meta cookies.
  • Meta Pixel in the dashboard: loads only when your account setting allows ad measurement. It sends a sign-up event when you finish onboarding, with your IP address, browser details, and an event ID that contains your Qorlivo account ID.
  • Server events (Meta Conversions API): sent from our servers when you finish onboarding and when a paid subscription starts, only when your account setting allows ad measurement at the time of sending. They contain a hashed copy of your email address and of your Qorlivo account ID, the event name and time, and for subscriptions the plan price and currency.

The account setting is “Allow ad measurement” in Settings → Preferences. It is off for new accounts, and signing up does not turn it on. Visitors who are not signed in can change their banner choice with “Cookie preferences” in the footer. Turning measurement off stops new events from that point on; it does not delete data Meta already received, which Meta handles under Meta’s Privacy Policy.

If your browser sends a Do Not Track signal, the Meta Pixel does not load on qorlivo.com or in the dashboard, whatever your other choices. Server events follow your account setting only, so turn that setting off to stop them.

Our payment processor, Stripe, may set cookies on checkout pages. Stripe's use of data is governed by Stripe's Privacy Policy.

5. Data sharing and third parties

We share your information only with the following service providers, to operate the Service and, where you allow it, to measure our advertising:

  • Clerk: sign-in and account authentication
  • Convex: database and backend infrastructure
  • Vercel: hosting and edge infrastructure, including custom domain setup
  • Upstash Redis: rate limiting and caching for redirect performance
  • Stripe: payment processing and billing records
  • Resend: sending account, billing, and notification emails
  • Mux: video upload, processing, and playback for video links
  • Google Web Risk: checking URLs you shorten against lists of malware and phishing sites (only the URL is sent)
  • Cloudflare Turnstile: bot protection on the free link shortener and the contact form
  • Sightengine: screening uploaded videos for prohibited content, when screening is enabled
  • NameSilo: domain registration, when you buy a domain through Qorlivo (registrant contact details go to the registrar and registry, as registration requires)
  • Sentry: error monitoring for the dashboard, with session replay turned off
  • Meta: advertising measurement, only with your permission (see section 4)

Link icons in the dashboard load from Google’s and DuckDuckGo’s favicon services, which receive the domain of the link and your browser’s IP address.

We may also disclose information if required by law, subpoena, or court order, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Qorlivo, our users, or the public.

6. Data retention

Different records are kept for different reasons:

  • Account, links, and analytics: kept while your account is active. Individual click records are kept for 90 days, then combined into daily totals per link. When you ask to delete your account, deletion is scheduled 30 days later so you can cancel; then we delete your account, links, and analytics.
  • Security records: audit logs of account and workspace activity are kept for 90 days, to investigate abuse and security incidents.
  • Billing records: invoices and payment history are held by Stripe and kept as long as tax and accounting rules require, even after you delete your account.
  • Advertising records: we keep only the name and time of the last event sent to Meta for your account, to check delivery. Data Meta received is kept by Meta under its own policy; turning off ad measurement or deleting your account does not remove it from Meta.

Shortened links created on a free account may be removed after 12 months of inactivity.

7. Data security

We use industry-standard measures to protect your data, including HTTPS/TLS encryption in transit, encrypted storage at rest, and API key hashing. However, no system is completely secure. If you discover a vulnerability, please disclose it responsibly to security@qorlivo.com.

8. Your rights

Depending on your location, you may have rights under GDPR, CCPA, or other applicable privacy laws, including:

  • Access: Request a copy of the data we hold about you
  • Correction: Update inaccurate or incomplete information
  • Deletion: Request deletion of your account and associated data
  • Portability: Export your links and analytics data in a standard format
  • Opt-out: Turn off advertising measurement at any time (see section 4). California residents may opt out of the "sale" or "sharing" of personal information; we do not sell data, and we honor these requests by email

To exercise these rights, email privacy@qorlivo.com. We will respond within 30 days.

9. Children's privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it promptly. Contact us at privacy@qorlivo.com if you believe a child has submitted information to us.

10. International transfers

Qorlivo operates from the United States. If you are located outside the U.S., your data will be transferred to and processed in the U.S. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses or other lawful mechanisms for transfers from the European Economic Area.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy with a new effective date and, for material changes, notify registered users by email.

12. Contact

Questions about this Privacy Policy? Contact us at privacy@qorlivo.com.