Draft. The Elido legal entity is being finalised before public launch; this page will be re-issued under that entity. Until then, contact [email protected] for an executable version.
Privacy Policy
Last updated: 2026-11-11
1. Who we are
Elido is a URL-shortening service operated from the European Union. Data controller contact: [email protected]. The operating legal entity is being finalised before public launch; this page will be re-issued under that entity, and the postal address will be added here.
2. What we collect
Account data (email, name, password hash) when you sign up. Workspace content (links, tags, custom domains, QR codes) you create. Click events when someone follows your short link: timestamp, URL slug, the visitor's full IP address, user agent, referrer, destination, device class and browser, plus country, region, city and approximate latitude/longitude derived from the IP address. Billing data (plan, billing country, VAT ID where supplied) when you subscribe to a paid plan; card details are handled by the payment processor, not stored by us. On sign-up and login pages we also store first-party traffic-source cookies (see Cookies below).
3. What we don't collect
We don't fingerprint visitors with third-party trackers and we don't sell click streams to ad networks. Important: we currently DO store the visitor's full IP address with every click event, together with the country, region, city and approximate coordinates that we derive from it using an offline MaxMind GeoLite2 database. IP truncation or hashing is planned but not yet in place. We do not use customer link or click data to train AI models.
4. Where it lives
Our primary database, analytics store and backups are hosted in the EU (Hetzner, Germany/Finland). Our redirect network also runs in Hetzner Ashburn (US) and OVH Singapore. Those nodes receive visitor requests, so visitor IP addresses, user agents and referrers are processed there, and they may hold replicated or cached copies of link data. Per-workspace region selection (for example US East or Asia-Pacific) is not available yet; every workspace is served from the same infrastructure. Retention: click events are not currently deleted on a schedule and are kept until we remove them (for example after a verified erasure request); audit-log events are kept for 730 days by default, configurable per workspace; database backups are kept for 14 days by default. Backups are encrypted before upload to Backblaze B2.
5. Your rights (GDPR)
You can exercise your access, rectification, deletion, portability, restriction and objection rights by emailing [email protected]; there is no self-service privacy page in the dashboard yet. Our team logs each request and answers within 30 days. An access request returns a zip of CSV files (account, workspace memberships, owned workspaces, links, audit entries, sessions). An erasure request currently anonymises your account record (email and name), ends your sessions and removes your login identity; billing records are kept where the law requires. Click events recorded about visitors of short links (including IP addresses) are not yet included in exports or deleted automatically on an erasure request; send us the short link and we will handle such requests case by case. If you are a visitor, you can also contact the workspace owner who controls that link. You may also lodge a complaint with your national data protection authority; the EU list is at https://edpb.europa.eu/about-edpb/board/members_en.
6. Sub-processors
We use thirteen sub-processors, not all of them in the EU: Hetzner (compute + database hosting, DE/FI, plus US edge in Ashburn), OVHcloud (edge, SG), Backblaze (encrypted backups), Resend (transactional email, EU + US), Paddle (merchant of record for card payments outside Ukraine), Universal Bank JSC / monobank Plata (card acquiring, UA), Coinbase Commerce (crypto checkout, only if enabled, US), MaxMind (offline GeoLite2 dataset, no personal data shared), Cloudflare (Turnstile CAPTCHA on sign-up and login, DNS/proxy), Crisp (live chat), Anthropic (AI features, when you use them, US), WorkOS (enterprise SSO/SCIM, when configured, US), and Google Safe Browsing (URL reputation checks of destination URLs). The current list with purpose and location lives at /legal/subprocessors and triggers 30-day advance notice on changes.
7. Cookies
We set strictly-necessary cookies (ory_kratos_session, csrf_token_*, elido_workspace_id, elido_mfa_pending, elido_sso_state), preference cookies (elido_locale, elido_authed, elido_sidebar_collapsed, upgrade-banner and promo cookies), and first-party traffic-source cookies (sbjs_*, set by Sourcebuster on sign-up and login pages, up to 6 months, used to attribute sign-ups to a campaign). We do not set advertising cookies. The cookie notice on the marketing site is informational only and does not block any cookie; the sbjs_* cookies are set without a consent prompt. Marketing-site visitor analytics use a cookieless Plausible instance (when enabled), which stores no cookies. The full table is on the Cookie Policy page.
8. Live chat (Crisp)
When the live chat widget is enabled, Crisp (https://crisp.chat, EU sub-processor) loads its client script and opens a WebSocket connection to relay your messages to our support team. The Crisp script loads when a page loads (not only when you open the chat), so your browser contacts Crisp's servers and Crisp sets a session cookie (crisp-client/session/*) so it can resume a conversation across page loads. No message contents leave your browser until you send one. Authenticated dashboard users have their email and display name passed to Crisp so support can reply by email if you close the tab; anonymous marketing-site visitors stay anonymous unless they type their email into the form.
9. Browser extension - data scope
The Elido browser extension (Chrome MV3 + Firefox) stores your API token or OAuth2 access token in chrome.storage.sync, the per-browser-profile sync container - Google syncs the value across signed-in devices, but Elido never sees it. The extension fires zero telemetry and embeds no third-party scripts; the only network call it makes is to the API origin you configure (https://api.elido.app by default). When you complete the OAuth2 flow, the refresh token lives in chrome.storage.local instead of chrome.storage.sync - it stays on the local machine and never roams across the sync container, which limits exposure if a sync key is ever compromised on another device.
10. International transfers
Some sub-processors are based outside the EEA (Paddle, Coinbase Commerce, Anthropic, WorkOS and Google in the US, Resend with a US fall-back region, Cloudflare globally), and our own redirect nodes in the US and Singapore process visitor IP addresses. Each is covered by EU Standard Contractual Clauses (2021/914) Modules 2 and 3 and the relevant supplementary measures. Our DPA (see /legal/dpa) includes the SCCs and is available on request from [email protected].
11. Elido Assistant (AI)
When you use the in-app assistant, your messages and the workspace data it looks up to answer them are sent to Anthropic (United States), our sub-processor, to produce the reply. We show you this notice and ask you to acknowledge it before your first message; if the notice changes, we ask again. Conversations are kept until you delete them or the account is erased. Anonymised question topics help us improve help content: when the assistant cannot answer a question, we may store a short description of the topic with e-mail addresses, links, domains, numbers and secrets removed, together with your language, your plan and a one-way code that only lets us count how many different workspaces ask the same thing. We do not store topics for Enterprise or compliance-mode workspaces, and we delete them after 90 days. Our staff can read a conversation only with a written reason, and every access is logged.
12. Contact
Privacy questions: [email protected]. DPA requests: [email protected]. Abuse reports: [email protected]. Security disclosures: [email protected] (see /legal/security-policy). For postal correspondence, contact [email protected] first so we can route to the right registered address once the operating entity is announced.