Privacy Policy

SME Digital ("SME Digital", "we", "us") operates Verra Links and acts as the data controller for personal data processed through the service. For any privacy question or request, contact info@smedigital.biz. Our payment provider, Paddle.com, acts as Merchant of Record and as an independent controller of the payment data it collects at checkout (see section 7).

We process only the data described below.

• Original (destination) URLs you submit for shortening.
• Shortened URLs and any custom alias you choose.
• IP-derived security data: we store a one-way hashed fingerprint of the creator's IP address, not the raw IP, for rate limiting and abuse prevention.
• A random session identifier generated in your browser when you create a link.
• Click events on short links, including the time of each click.
• Referral source (the referring website, where the browser sends it).
• Browser/device information in the form of the user-agent string sent with a click.
• Account data if you register: your email address, authentication identifiers and login timestamps.
• Subscription data for Verra Links Pro: your plan, subscription status, billing period and the customer/subscription references returned by our payment provider. We never receive or store your card number.
• Email addresses you voluntarily submit to unlock link analytics or to join our newsletter, together with the source of that submission and the related short code.
• Abuse reports you submit, including the reported short code, the reason, your description and an optional contact email.

We do not ask for payment card details, and we do not use advertising or cross-site tracking cookies.

• To operate the service — store your destination URL and redirect visitors who open the short link. Legal basis: performance of a contract with you (or our legitimate interest in providing the free tool).
• To provide analytics — show click counts, daily click trends and top referral sources for a short link. Legal basis: performance of a contract, and our legitimate interest in giving link owners meaningful statistics.
• To create and manage accounts and Verra Links Pro subscriptions, including granting plan features and handling cancellations. Legal basis: performance of a contract with you.
• To protect the service and its users — screen destinations against malicious-URL checks and an internal blocklist, apply rate limits, and detect automated abuse. Legal basis: our legitimate interest in security and fraud prevention.
• To respond to abuse reports and to suspend or block links that break our rules. Legal basis: legitimate interest, and compliance with legal obligations where applicable.
• To meet accounting, tax and other legal obligations relating to sales. Legal basis: legal obligation.
• To send you the Verra Links newsletter, if you asked for it. Legal basis: your consent, which you can withdraw at any time.

Analytics are aggregate and link-level, not person-level. When a short link is opened we record a click row containing the timestamp, the referrer and the user-agent string. We do not build user profiles, do not attempt to identify individual visitors, and do not sell or share click data. Anyone with the short code can view that link's statistics after providing an email address, so do not use short links for confidential destinations.

Every submitted destination is validated and screened before a short link is created. We hash the creator's IP address and store that hash alongside a session identifier so we can enforce rate limits and record abuse events (for example, a blocked malicious URL or a blocklist hit). These records are used only for security, moderation and fraud prevention.

• Links and their click history are retained for as long as the short link remains active, so that the redirect and its analytics keep working.
• Suspended or blocked links are retained so the short code cannot be reused and so we have a record of the enforcement action.
• Abuse events and abuse reports are retained for moderation and security history.
• Account and subscription records are retained for the life of the account, and for as long afterwards as tax and accounting law requires.
• Email addresses are retained until you ask us to delete them or unsubscribe.

When data is no longer needed for these purposes it is deleted or anonymised. We protect data with appropriate technical and organisational measures, including encryption in transit, access controls and row-level database security.

Verra Links Pro is sold through Paddle.com, which acts as the Merchant of Record for all our orders. When you subscribe, Paddle collects and processes your payment and billing data — including your name, email address, billing address, country, tax identifiers and payment card details — directly, in order to take payment, calculate tax, issue invoices, manage your subscription and handle refunds and chargebacks. We never receive or store your card details.

Paddle shares with us the information we need to provision your subscription: your email address, the plan purchased, the subscription status and billing period, and Paddle's customer and subscription references. Paddle's own privacy notice governs its processing.

We share personal data only with the following categories of recipient:

• Paddle.com — Merchant of Record for the sale of Verra Links Pro: payments, subscription management, tax compliance, invoicing and refunds.
• Lovable — application hosting and delivery of the website and its server functions.
• Supabase — managed database hosting for links, click events, accounts, subscriptions, abuse records and email addresses.
• Cloudflare Turnstile — invisible bot challenge on the link-creation form.
• Google Safe Browsing — malicious-URL screening of submitted destinations.
• Google Fonts — web font delivery.
• Professional advisers (legal and accounting) and competent authorities, where we are required or permitted by law.

Our service providers process data on our behalf as part of delivering the service. We do not sell personal data. Some of these providers are located outside your country; where data leaves the UK/EEA we rely on adequacy decisions or Standard Contractual Clauses.

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you, to object to or restrict certain processing, and to withdraw consent for marketing email at any time. Contact us and we will act on your request, normally within one month. Because short links can be created without an account, we may ask you for the short code or the email address involved so we can locate the right records. If you are in the UK or EEA you also have the right to complain to your local data protection supervisory authority.

We use only essential cookies and equivalent browser storage: a session identifier for link creation, your sign-in session if you have an account, and the bot-protection cookie set by Cloudflare Turnstile. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser, though signing in will then not work.

Verra Links is not directed at children under 13, and we do not knowingly collect their data.

We may update this policy as the service changes. The "last updated" date above always reflects the current version.

Privacy questions and requests: info@smedigital.biz. To report a harmful short link, use our abuse report form.