Privacy Policy

This Privacy Policy describes how EZY ("we," "our," or "us"), an online software service operated from Portugal, collects, uses, stores, and protects personal data when you interact with our website, applications, redirection services, and dashboard features.

For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), EZY acts as the Data Controller for personal data relating to registered account owners, billing contacts, and website visitors.

Use of our Service is governed by our Terms of Service. Unlike general contractual terms, this Privacy Policy is an informational notice describing how your data is processed under various lawful bases established by GDPR.

We adhere to the GDPR principle of data minimization and only collect personal data necessary to provide, secure, and maintain our URL shortening, QR code, and link management tools. We distinguish clearly between Account Data, Link Configuration Data, and Visitor Telemetry Data:

2.1 Account and Profile Data (Account Owners)

When you register or maintain an Account, we collect:

• Account Credentials: Email address, unique user ID (UID), and chosen username.
• Authentication Security: Handled securely via Firebase Authentication. We never receive, process, or store plaintext passwords.
• Optional Profile Details: Display name and custom profile avatar.
• Preferences: Interface and marketing communication preferences.
• Security & Session Logs: Timestamps of recent logins, active session IDs, and security audit logs to protect your account against unauthorized takeover.

2.2 Link and QR Configuration Data

When you create resources on EZY, we store:

• Target Destination URLs: The original web destinations you configure your Short Links to forward to.
• Custom Aliases & Metadata: Custom slugs (e.g. ezy.pt/my-brand), link titles, and custom domain bindings.
• Routing Configuration: Passcode protection: securely salted password/passcode hashes, expiration dates, click quotas, and smart device/geographic routing rules.
• QR Code Styling: Foreground/background hex colors, dot shape parameters, and uploaded vector logo asset paths.

Destination URLs are submitted by Users. Users are responsible for ensuring that destination URLs do not inadvertently expose confidential personal data in query strings.

2.3 Visitor Link Telemetry and Analytics Data

When an internet user clicks an EZY Short Link or scans an EZY QR Code, our redirect edge servers collect ephemeral technical metadata from the incoming HTTP request headers to route the link and record aggregate performance metrics for the link creator:

• Timestamp: Exact date and time of the click or scan.
• Referrer Header: The referring website or application that initiated the visit (if provided by the visitor's browser).
• User-Agent Metadata: Parsed to identify device category (mobile, desktop, tablet), operating system, and browser engine.
• Approximate Geolocation: Derived on the fly from incoming IP routing headers at the country level. Full IP addresses of link visitors are not stored in persistent analytics records.

In accordance with Article 6 of the GDPR, we only process your personal data when we have an established lawful basis:

• Performance of a Contract (Article 6(1)(b) GDPR): Necessary to create your account, provide URL shortening, generate QR codes, execute link redirects, deliver analytics dashboards, and fulfill paid subscription features as agreed under our Terms of Service.
• Compliance with Legal Obligations (Article 6(1)(c) GDPR): Necessary to maintain statutory billing, VAT, and fiscal records under Portuguese and European commercial law, and to comply with lawful requests from judicial or regulatory authorities.
• Legitimate Interests (Article 6(1)(f) GDPR): Necessary to protect platform security, prevent phishing and malware distribution, maintain rate limiting and DDoS defenses, investigate abuse, and ensure the continuous stability and performance of our infrastructure. We balance these interests against your fundamental rights and freedoms.
• Consent (Article 6(1)(a) GDPR): Relied upon for non-essential optional communications, such as opt-in marketing newsletters. When processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

We do not sell, rent, or trade personal data to third parties. We share data only with vetted third-party service providers and infrastructure operators necessary to provide, secure, and maintain the Service:

• Cloud Database and Authentication: Providers that deliver user authentication, secure cloud database storage, and media asset storage for user avatars and QR code logos.
• Payment Processing and Invoicing: Payment gateways and billing platforms that process subscription transactions and customer portal requests. EZY does not store full payment card numbers or card security codes (CVC/CVV) on its own systems.
• Edge Network and Routing Infrastructure: Global edge compute networks providing custom domain SSL provisioning, fast URL redirection, and DDoS mitigation.
• Operational Support Notifications: Internal communication and webhook services that alert our engineering and support personnel when tickets are filed through our dashboard helpdesk.

All data processors are bound by strict contractual data processing agreements requiring compliance with GDPR Article 28 and industry-standard security safeguards.

EZY is operated from Portugal. Because we utilize enterprise cloud hosting, distributed database, and payment processing infrastructure, certain personal data may be processed on servers located outside the European Economic Area (EEA), including in the United States.

Whenever personal data is transferred outside the EEA, we ensure that adequate safeguards are in place pursuant to Chapter V of the GDPR. These safeguards include the European Commission Standard Contractual Clauses (SCCs) and adherence to the EU-U.S. Data Privacy Framework where certified by our processors.

6.1 Payment Processing

When you purchase a subscription on EZY, all card details are submitted directly to Stripe over encrypted connections. EZY does not store full payment card numbers or card security codes (CVC/CVV) on its own systems. Payment card information is processed by Stripe.

6.2 Billing Records

EZY maintains billing records necessary for accounting, subscription lifecycle management, and tax compliance. This includes your Stripe Customer ID, Subscription ID, plan tier, transaction dates, amount paid, and invoice identifiers.

6.3 Refund Processing

In the rare event that an exceptional refund is approved due to an unresolvable technical fault, we process transaction reversal data through our payment processor (Stripe). To report a technical or billing issue, please contact us via our Support Center or email billing@ezy.pt.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy, maintain your account, or comply with legal requirements:

7.1 Inactive Accounts

As detailed in our Terms of Service, if an Account remains completely inactive for twenty-four (24) consecutive months, EZY may delete the Account and its associated records to conserve resources, subject to legal record-keeping requirements.

7.2 Pro Subscription Expiry

When a Pro subscription expires or is cancelled, your existing Short Links remain active and functional. The account reverts to Free tier limits. Pro-only analytics beyond the Free 7-day retention window are restricted or pruned in accordance with Free plan limits.

8.1 Deleting Individual Links and QR Codes

You can delete individual Short Links and QR codes at any time from your dashboard. When you confirm deletion:

• The link redirection mapping is immediately removed from our edge routing systems.
• The associated analytics subcollections (click logs, location records, and user agent distributions) are permanently deleted from our active database.

8.2 Account Deletion ("Delete Account" Button)

You can permanently delete your entire Account at any time in Profile Settings via the "Delete Account" button. When initiated:

• All Short Links, custom aliases, and QR codes associated with your account are deleted.
• All click logs and analytics subcollections are permanently purged.
• Your user record in Firestore and your authentication profile in Firebase Authentication are deleted.
• Your email is removed from all optional marketing distribution lists.

Routine database backups overwrite automatically within standard backup cycles. Tax and billing records are retained as required by applicable Portuguese commercial and fiscal legislation.

EZY uses minimal client-side cookies and browser storage strictly necessary for authentication, security, and functional preferences. We do not use advertising cookies, cross-site trackers, or third-party behavioral advertising cookies.

When visitors click Short Links, EZY does not place tracking cookies on their devices. Visitor telemetry is derived purely from standard HTTP request headers at the moment of redirection.

Under the General Data Protection Regulation (GDPR), users within the European Economic Area (EEA) have comprehensive rights regarding their personal data:

10.1 How to Exercise Your Rights

You can manage and export much of your data directly through your profile settings. To submit a formal data protection request, email us at legal@ezy.pt.

10.2 Response Timeline and Identity Verification

We handle requests without undue delay and normally within one (1) month of receipt. That period may be extended by up to two (2) further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt, together with the reasons for the delay.

To safeguard personal data against unauthorized disclosure, we may need to verify your identity by requesting confirmation from your registered account email address before fulfilling your request.

10.3 Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority. In Portugal, the national data protection supervisory authority is:

You may also lodge a complaint with the supervisory authority in the EU Member State where you reside, work, or where the alleged infringement took place.

We only send marketing newsletters or product promotion emails where you have opted in or where permitted under applicable law. You can unsubscribe at any time by:

• Clicking the "unsubscribe" link included at the bottom of any marketing email; or
• Updating your communication preferences in your profile settings.

Opting out of marketing communications does not affect strictly necessary administrative, security, or transactional emails (such as password resets, billing receipts, or essential service updates).

We implement technical and organizational security measures appropriate to the risk of processing personal data, including:

• Enforced Transport Layer Security (TLS/HTTPS) for all data in transit across our web endpoints;
• Industry-standard encryption and managed access controls provided by Google Cloud and Firebase;
• Cryptographic authentication tokens and salted password hashing handled by Firebase Authentication;
• Application rate limiting, client cooldown guards, and honeypot protections against automated bot attacks; and
• Separation of operational support webhooks and billing processing systems.

In the event of a personal data breach, we will assess the risk to individuals and fulfill statutory breach notification obligations under Articles 33 and 34 of the GDPR, notifying the supervisory authority and affected users where legally required.

Please note that no method of transmission over the internet or electronic storage is completely infallible. Users are responsible for safeguarding their login credentials and devices.

The Service is not intended for individuals under 13 years of age. We do not knowingly collect personal data from or offer the Service to individuals under 13.

If you believe an individual under 13 has provided us with personal data, please contact us at legal@ezy.pt so we can promptly investigate and delete the data.

EZY does not use automated decision-making or profiling mechanisms that produce legal effects or similarly significant effects concerning you under Article 22 of the GDPR.

Link click telemetry and scan statistics provide aggregate metrics to link owners and do not involve behavioral tracking, cross-site profiling, or automated legal evaluation of individuals.

EZY operates as a technical link forwarding intermediary. When a visitor clicks a Short Link, they are forwarded to an external target destination chosen by the link creator.

EZY does not control and is not responsible for the privacy policies, tracking technologies, cookies, or content of external destination websites. We strongly encourage visitors to review the privacy notices of any websites they visit.

16.1 Lawful Disclosures and Abuse Investigation

We may disclose personal data to law enforcement, judicial bodies, or regulatory authorities only where strictly required by binding legal process, court orders, or applicable law, or where reasonably necessary to detect and prevent fraud, investigate malicious security attacks, or enforce our Terms of Service.

16.2 Business Transfers

If EZY undergoes a business reorganization, merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity subject to equivalent confidentiality commitments and applicable data protection legislation. Users will be informed of any material change in control where legally required.

We may update this Privacy Policy from time to time to reflect evolving legal requirements, feature updates, or changes to our technical infrastructure. Any modifications will be posted on this page with an updated "Last Updated" timestamp.

For substantial changes that meaningfully affect how we handle your personal data, we will provide prominent notice (such as an in-dashboard alert or notification email) where appropriate.

If you have questions, comments, or data rights requests concerning this Privacy Policy:

• Privacy Inquiries & Data Rights: legal@ezy.pt
• Customer Support Desk: Support Center
• General Contact: support@ezy.pt
• Billing Questions: billing@ezy.pt