Draft. The Elido legal entity is being finalised before public launch; this page will be re-issued under that entity. Until then, contact [email protected] for an executable version.
Privacy Policy
Last updated: 2026-05-15
1. Who we are
Elido is a URL-shortening service operated from the European Union. Data controller contact: [email protected]. The operating legal entity is being finalised before public launch; this page will be re-issued under that entity, and the postal address will be added here.
2. What we collect
Account data (email, name, password hash) when you sign up. Workspace content (links, tags, custom domains, QR codes) you create. Click events (URL slug, IP-derived country, device class, browser, referrer, UTM parameters) when someone follows your short link. Billing data (plan, billing country, VAT ID where supplied) when you subscribe to a paid plan.
3. What we don't collect
We don't fingerprint visitors with third-party trackers. We don't sell click streams to ad networks. We don't store the visitor's full IP after the redirect - only the country derived from it, using an offline MaxMind GeoLite2 database. We do not use customer link or click data to train AI models, and contractually never will.
4. Where it lives
All operational data is stored in EU data centres: Hetzner Frankfurt (primary origin, database and high-availability replicas), Hetzner Ashburn (read-only edge cache for North America), OVH Singapore (read-only edge cache for APAC). Click events land in our analytics store with retention scaled to your plan tier - see the Pricing page for the per-plan window. Backups are encrypted at rest and stored with Backblaze EU (Amsterdam). We do not back up to non-EU regions.
5. Your rights (GDPR)
Access, rectification, deletion, portability, restriction, and objection rights are available through the dashboard (Settings → Privacy) or by emailing [email protected]. We respond within 30 days. You may also lodge a complaint with your national data protection authority; the EU list is at https://edpb.europa.eu/about-edpb/board/members_en.
6. Sub-processors
We use a short list of mostly-EU sub-processors: Hetzner (compute + database hosting, DE/FI), OVHcloud (edge POP, SG), Backblaze (encrypted backups, NL), Resend (transactional email delivery, EU + US), Universal Bank JSC / monobank Plata (card acquiring, UA/EU), Coinbase Commerce (optional crypto checkout, US), MaxMind (offline GeoLite2 dataset, US), and Cloudflare (Turnstile CAPTCHA on signup and on-demand TLS for customer custom domains, global with EU regional routing). The current list with purpose and location lives at /legal/subprocessors and triggers 30-day advance notice on changes.
7. Cookies
We set a small set of strictly-necessary cookies (ory_kratos_session, csrf_token_*, elido_workspace_id, elido_mfa_pending) plus one preferences cookie (elido_locale). No advertising or analytics cookies are set - visitor analytics are server-side only, computed from request logs at the edge. The full table is on the Cookie Policy page.
8. Live chat (Crisp)
When the live chat widget is enabled, Crisp (https://crisp.chat, EU sub-processor) loads its client script and opens a WebSocket connection to relay your messages to our support team. Crisp drops a session cookie (crisp-client/session/*) so it can resume an in-progress conversation across page loads. The chat is opt-in by interaction - no message contents leave your browser until you send one. Authenticated dashboard users have their email and display name passed to Crisp so support can reply by email if you close the tab; anonymous marketing-site visitors stay anonymous unless they type their email into the form.
9. Browser extension - data scope
The Elido browser extension (Chrome MV3 + Firefox) stores your API token or OAuth2 access token in chrome.storage.sync, the per-browser-profile sync container - Google syncs the value across signed-in devices, but Elido never sees it. The extension fires zero telemetry and embeds no third-party scripts; the only network call it makes is to the API origin you configure (https://api.elido.app by default, or your self-hosted endpoint). When you complete the OAuth2 flow, the refresh token lives in chrome.storage.local instead of chrome.storage.sync - it stays on the local machine and never roams across the sync container, which limits exposure if a sync key is ever compromised on another device.
10. International transfers
Some sub-processors are based outside the EEA (Coinbase Commerce in the US, Resend with a US fall-back region, Cloudflare globally). Each is covered by EU Standard Contractual Clauses (2021/914) Modules 2 and 3 and the relevant supplementary measures. Our DPA at /legal/dpa is pre-signed with the SCCs included; counter-signed copies are issued to Business and Enterprise customers on request.
11. Contact
Privacy questions: [email protected]. DPA requests: [email protected]. Abuse reports: [email protected]. Security disclosures: [email protected] (see /legal/security-policy). For postal correspondence, contact [email protected] first so we can route to the right registered address once the operating entity is announced.