Privacy Policy

1. Data We Collect

We collect the following types of data:

Account data

• Name — provided during registration.
• Email address — used for authentication, communication, and account recovery.
• Domain information — domains you add and the redirect rules you configure.

Analytics data

• Click counts — number of times each redirect rule is triggered.
• Country of origin — derived from the visitor's IP address (the IP itself is not stored).
• Device type and browser — derived from the User-Agent header.
• Referrer URL — the page the visitor came from.

Payment data

• Credit card details and billing information are processed directly by Stripe. 99redirect does not store credit card numbers on its servers.

2. What We Do NOT Collect

The privacy of your domain visitors is important to us:

• IP addresses are not stored. For unique visitor analytics, we use a hash of the IP combined with a daily salt. The hash is irreversible and the salt is discarded daily, making it impossible to identify the visitor.
• No tracking cookies. We do not use tracking pixels, browser fingerprinting, or any cross-site tracking technology.
• We do not sell data. Your data is never sold, rented, or shared with third parties for advertising purposes.

3. How We Use Your Data

We use your data to:

• Provide the service — process redirects, issue SSL certificates, and forward emails.
• Analytics — display click statistics, countries, and devices in your dashboard.
• Billing — process payments and manage subscriptions via Stripe.
• Communication — send verification emails, password recovery, service notifications, and important updates.
• Security — detect and prevent fraudulent or abusive activity.

4. Third-Party Services

We use the following third-party services:

• Stripe — payment processing. Stripe has its own privacy policy and is PCI DSS Level 1 certified.
• Let's Encrypt — SSL certificate issuance for configured domains. Only the domain name is shared for certificate issuance.

We do not share your personal data with any other third-party services, except when required by law.

5. Data Retention

• Analytics data — retained according to your plan (7 days on Free, 90 days on Pro, 365 days on Business). After the retention period, data is automatically deleted.
• Account data — maintained while your account is active. When you delete your account, all data is removed within 30 days.
• Billing data — retained as required by legal and tax obligations (typically 5 years).

6. Your Rights

Under the GDPR and LGPD, you have the following rights:

• Access — request a copy of all data we hold about you.
• Export — export your data in a machine-readable format (JSON/CSV).
• Rectification — correct inaccurate or incomplete data.
• Deletion — request complete deletion of your data and account.
• Portability — receive your data in a structured format for transfer to another service.
• Objection — object to the processing of your data in certain circumstances.

You can exercise your rights to access, export, and deletion directly from your account settings. For other requests, please contact us through our contact page.

7. Cookies

99redirect only uses essential cookies required for the service to function:

• Authentication token — keeps your session active after login. Secure, httpOnly cookie.
• Language preference — stores your chosen interface language. First-party cookie, contains no personal data.

We do not use analytics, advertising, or third-party tracking cookies.

8. Security

We implement technical and organizational measures to protect your data:

• All communications are encrypted with TLS (HTTPS).
• Passwords are stored with bcrypt hash and unique per-user salt.
• API keys are shown only once and stored as hashes.
• Administrative access is restricted and protected by multi-factor authentication.
• Backups are encrypted at rest.

9. International Data Transfers

Our servers may be located in different regions to ensure low latency. In all cases, we apply the same protection measures described in this policy and comply with applicable legal requirements for international data transfers.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or through a notice on the service. We recommend that you review this policy regularly.

Contact

For privacy-related questions or to exercise your rights, please reach out through our contact page.