Privacy policy

The controller responsible for processing personal data through its.gd is:

Dominic Müller
DOMU.STUDIO
Sole proprietor
Mainzer Straße 19
50678 Cologne
Germany

Email: contact@domu.studio
VAT ID: DE245024829

its.gd is a product operated by DOMU.STUDIO.

This Privacy Policy applies to:

• visitors to the its.gd website;
• users who create short links;
• registered users and dashboard users;
• users of paid plans;
• visitors who open, preview, or continue through its.gd short links;
• people who report suspicious or abusive links; and
• people who contact us.

This Privacy Policy does not apply to third-party websites reached through an its.gd short link. Those websites are operated independently and have their own privacy practices.

We use third-party providers to develop, operate, host, secure, communicate, analyze, and process payments for its.gd.

These include Lovable.dev for application and platform functionality, Lovable Cloud for hosting infrastructure and the service backend, Cloudflare for DNS, routing, performance and security, Stripe for payments, Lovable Email and Mailgun for transactional emails, Google Analytics for consent-based website analytics, and security or threat-intelligence providers used to assess destination URLs.

Depending on the service and context, these providers may act as processors, sub-processors, or independent controllers.

DOMU.STUDIO remains responsible for the purposes and means of processing for which it acts as controller.

When you visit its.gd, we may process technical data including:

• IP address;
• date and time of access;
• requested URL;
• referrer information;
• browser type and version;
• operating system;
• device type;
• language settings;
• approximate location derived from the IP address;
• server logs;
• security events; and
• cookie or consent preferences.

We use this information to deliver and secure the website, prevent abuse, diagnose errors, maintain service availability, comply with legal obligations, and understand general website usage where analytics consent has been provided.

The legal bases may include Article 6(1)(b) GDPR for providing requested services, Article 6(1)(f) GDPR for security and legitimate operational interests, Article 6(1)(c) GDPR for legal obligations, and Article 6(1)(a) GDPR where consent is required.

When you create or manage a short link, we may process:

• the submitted destination URL;
• the generated or selected slug;
• creation date and time;
• link status;
• account ID, where applicable;
• destination corrections and related history;
• safety-check results and risk signals;
• redirect-chain information;
• final landing domain;
• IP address and technical request data;
• rate-limit and abuse-prevention data; and
• other metadata required to operate and secure the link.

We use this information to create and operate short links, check destinations before activation, prevent phishing, malware, scams and other abuse, enforce destination-locking rules, provide preview and reporting functionality, enforce our Terms of Service, and protect visitors and third parties.

Legal bases may include Article 6(1)(b), Article 6(1)(f), and, where applicable, Article 6(1)(c) GDPR.

Safety is a core part of its.gd.

Before a short link is activated, its.gd performs automated checks on the submitted destination and related technical information.

These checks may include:

• URL structure and scheme validation;
• embedded-credential detection;
• raw IP, localhost and private-host detection;
• dangerous file-extension detection;
• suspicious double-extension detection;
• brand-impersonation indicators;
• homograph, punycode, mixed-script and emoji-domain indicators;
• abuse-related TLD indicators;
• chained-shortener detection;
• open-redirect indicators;
• encoded or opaque parameter indicators;
• DNS resolution;
• redirect-chain analysis;
• Google Safe Browsing lookups;
• URLhaus lookups; and
• internal abuse and security information.

Depending on the check, destination URLs, domains, redirect information or related technical metadata may be processed by our systems or relevant security providers.

These checks are designed to reduce risk. They cannot guarantee that a destination is permanently safe, lawful, accurate, available, or free from malicious content.

If a destination is classified as malicious, the short link may be refused or blocked. We may retain the destination, scan result and relevant technical information where necessary to prevent repeated abuse or protect the service.

Destinations classified as suspicious rather than malicious may be presented with a warning.

If you believe an automated decision concerning a destination is incorrect, you may contact us for human review.

Every its.gd short link passes through a safety interstitial before the visitor reaches the destination.

The interstitial may display:

• the requested its.gd link;
• the actual destination;
• the current safety status;
• detected risk signals;
• explanations of relevant warnings; and
• options to continue or stop.

Visitors are not automatically forwarded from the interstitial. They actively decide whether to continue.

Depending on the scan result, a link may be displayed as clean, suspicious, or unsafe.

The interstitial contains no advertising and no third-party advertising or tracking pixels.

We process the information necessary to provide this interstitial, operate the redirect service, prevent abuse and protect visitors.

Legal bases may include Article 6(1)(b), Article 6(1)(f), and Article 6(1)(c) GDPR.

When someone opens an its.gd short link, we may process:

• the requested short link;
• date and time;
• IP address;
• browser and device information;
• operating system;
• approximate country or region;
• referrer information, if supplied by the browser;
• security and abuse signals;
• redirect outcome;
• warning or blocked-page events; and
• preview interactions where applicable.

We use this data to operate the redirect service, show safety information, detect and prevent abuse, diagnose technical problems, maintain security, comply with legal obligations and provide aggregated analytics where applicable.

Analytics provided to link owners are intended to be aggregated or statistical.

The interstitial and redirect flow do not contain third-party advertising pixels.

Legal bases may include Article 6(1)(b), Article 6(1)(f), and Article 6(1)(c) GDPR.

Where supported by a paid plan, a link owner may add campaign parameters such as utm_source or utm_campaign to a destination URL.

Existing campaign parameters are not overwritten.

When a visitor chooses to continue to the destination, these parameters become part of the destination request and are then processed by the destination website according to that website's own privacy practices.

its.gd provides public link previews, including through a preview URL or the "+" feature.

When a preview is opened, we may process and display information such as:

• the requested short link;
• destination URL or domain;
• safety and scan status;
• technical request information; and
• reporting options.

We provide previews to increase transparency, allow visitors to inspect destinations before visiting them, and help identify suspicious or unsafe links.

When you report a suspicious, unsafe, unlawful or abusive link, we may process:

• the reported link;
• report reason;
• additional information supplied by you;
• your email address, where voluntarily provided;
• date and time;
• IP address and technical metadata;
• review status;
• moderation notes; and
• actions taken.

We process this information to investigate abuse, protect users and third parties, enforce our Terms of Service, maintain service integrity, comply with legal obligations, and defend legal claims.

Legal bases may include Article 6(1)(f), Article 6(1)(c), and, for optional information supplied voluntarily, Article 6(1)(a) GDPR where applicable.

If you create an account, we may process:

• name or display name, where provided;
• email address;
• authentication identifiers;
• account ID;
• account settings;
• dashboard activity;
• links associated with the account;
• subscription and plan information;
• billing-related identifiers;
• communication preferences;
• security logs; and
• support history.

We use this data to create and administer accounts, authenticate users, provide dashboard functionality, manage links and subscriptions, send necessary communications, prevent abuse, enforce our Terms, and comply with legal obligations.

Legal bases may include Article 6(1)(b), Article 6(1)(f), and Article 6(1)(c) GDPR.

Payments for paid its.gd plans are processed through Stripe.

We may receive or process:

• Stripe customer identifiers;
• subscription status;
• plan information;
• billing email;
• billing address where required;
• tax or VAT information;
• payment status;
• invoice information;
• transaction identifiers;
• cancellation information; and
• refund, dispute or chargeback information.

Stripe may process additional payment information, including payment-method and card information. DOMU.STUDIO generally does not receive complete payment-card numbers.

Payment-related data is processed to provide paid services, administer subscriptions, issue invoices, handle cancellations and refunds, prevent fraud, and comply with tax, accounting and other legal obligations.

Legal bases may include Article 6(1)(b), Article 6(1)(c), and Article 6(1)(f) GDPR.

More information is available in Stripe's Privacy Policy and Data Processing Agreement.

We may send emails concerning:

• authentication and account access;
• payments and subscriptions;
• link management;
• analytics reports where applicable;
• security;
• abuse reports;
• support;
• cancellation;
• material service changes; and
• legal or policy notices.

We use Lovable Email, which uses Mailgun as an underlying email-delivery provider.

When emails are sent, the processed information may include the email address, recipient name where provided, message content, delivery information, bounce information and technical email metadata.

Essential service communications are sent where necessary to provide or administer the service.

Non-essential promotional or marketing communications are sent only where permitted by applicable law. Where consent is required, such communications are based on consent. Where the existing-customer exception under applicable German law applies, communications may be sent within its legal requirements.

Recipients may object to or unsubscribe from non-essential marketing communications at any time.

When you contact us, we may process your:

• name;
• email address;
• message;
• attachments or screenshots;
• related account or link information;
• communication history; and
• technical metadata.

We process this information to answer your request, provide support, investigate problems and protect our legal interests.

Legal bases may include Article 6(1)(b), Article 6(1)(f), and Article 6(1)(c) GDPR.

We use Google Analytics on the its.gd website to understand general website usage and improve the service.

Google Analytics is activated only after consent.

Google Analytics may process online and cookie identifiers, browser and device information, approximate location, page views, events, referrer information and interaction data.

You can refuse or withdraw consent through the available consent settings.

Google Analytics is not loaded on short-link safety interstitial or redirect pages.

The legal basis for consent-based analytics is Article 6(1)(a) GDPR. Device access or storage may additionally require consent under applicable German telecommunications and data-protection law.

Google may process information outside the European Economic Area. Appropriate transfer mechanisms are used where required.

its.gd may use cookies, local storage and similar technologies.

Essential technologies

Essential technologies may be required for:

• authentication and sessions;
• account security;
• CSRF protection;
• consent preferences;
• checkout;
• fraud and abuse prevention;
• rate limiting; and
• service stability.

Where such technologies are strictly necessary to provide a service requested by the user, consent may not be required under applicable law.

Analytics technologies

Analytics technologies are used only where legally permitted and, where required, after consent.

Payment technologies

Stripe may use cookies or similar technologies as part of checkout, payment processing and fraud prevention. Stripe's own privacy and cookie information applies where Stripe determines the relevant processing independently.

Lovable Cloud

We use Lovable Cloud to host and operate the service, including the application backend and the database.

This infrastructure may process application data, databases, website files, logs, IP addresses, account information, link information, security data and backups.

Cloudflare

We use Cloudflare for services including DNS, security, routing, performance and protection against abusive or malicious traffic.

Cloudflare may process IP addresses, HTTP request information, DNS information, device/browser data, security events, traffic metadata and cache-related information.

Legal bases may include Article 6(1)(b) GDPR for service delivery and Article 6(1)(f) GDPR for security, reliability, performance and abuse prevention.

Google Safe Browsing

We use Google Safe Browsing as part of our destination safety checks.

Destination URLs, domains or related technical information are checked against Google Safe Browsing systems.

URLhaus / abuse.ch

We use URLhaus by abuse.ch to identify known malicious or malware-related URLs.

Destination URLs, domains or related technical information are checked against URLhaus systems.

These services are used to protect visitors, prevent abuse and reduce the risk of malicious short links.

Depending on the functionality used, personal data may be processed by or disclosed to providers including:

• Lovable.dev — application/platform functionality and connected integrations.
• Lovable Cloud — managed hosting and server infrastructure.
• Cloudflare — DNS, routing, performance, security and abuse protection.
• Lovable Email / Mailgun — transactional and service-related email delivery.
• Google Analytics — consent-based website analytics.
• Google Safe Browsing — destination safety checks.
• URLhaus / abuse.ch — malware and threat-intelligence checks.
• Stripe — payments, subscriptions, billing, invoices and fraud prevention.

We enter into data-processing agreements where required.

Some service providers or their sub-processors may process personal data outside Germany or the European Economic Area.

Where required, international transfers are protected through mechanisms such as:

• adequacy decisions;
• the EU-U.S. Data Privacy Framework where applicable;
• Standard Contractual Clauses;
• supplementary safeguards;
• data-processing agreements; and
• technical and organizational security measures.

International processing may nevertheless involve additional risks where foreign authorities can access data under local law.

Depending on the processing activity, we rely primarily on:

Article 6(1)(a) GDPR — Consent
For optional analytics, non-essential technologies and other processing requiring permission.

Article 6(1)(b) GDPR — Contract or pre-contractual measures
For creating and operating links, accounts, subscriptions, payments, dashboards and other requested services.

Article 6(1)(c) GDPR — Legal obligation
For tax, accounting, regulatory, consumer-protection and other statutory obligations.

Article 6(1)(f) GDPR — Legitimate interests
For security, abuse and fraud prevention, service reliability, debugging, moderation, trust and safety, legal defense and appropriate service administration.

Where we rely on legitimate interests, we consider those interests against the rights and freedoms of affected individuals.

We retain personal data only for as long as necessary for the relevant purpose or as required or permitted by law.

Our intended retention periods include:

• Server logs: generally 14 days, unless longer retention is necessary for security, abuse investigations or legal reasons.
• Account data: while the account exists and for a reasonable period afterwards where required for administration, security or legal obligations.
• Active link data: while the link remains active.
• Deleted or expired link data: generally deleted or anonymized after 30 days unless continued retention is necessary for security, abuse prevention, billing, legal defense or legal obligations.
• Safety data: retained as necessary to operate safety status, moderation and abuse-prevention systems.
• Abuse reports: generally up to 24 months after closure unless longer retention is necessary for recurring abuse, legal defense or legal obligations.
• Payment and invoice records: according to applicable statutory tax and accounting retention periods.
• Support communications: for as long as reasonably necessary to handle the matter and protect legal interests.
• Analytics information: according to the configured analytics retention settings and applicable consent choices.

We may anonymize or aggregate information so that it no longer relates to an identifiable person. Such information may be retained for longer.

We use appropriate technical and organizational measures designed to protect personal data.

These may include:

• HTTPS encryption;
• access controls;
• authentication;
• restricted administrative access;
• logging and monitoring;
• backups;
• firewall and abuse-prevention systems;
• Cloudflare security services;
• secure Stripe payment processing;
• data minimization; and
• periodic review of security-relevant settings.

No internet service can guarantee absolute security.

If you believe your account or information has been compromised, contact us at contact@domu.studio.

its.gd uses automated systems to identify potentially suspicious, unsafe or abusive destinations.

These checks can influence whether a short link is activated, displayed with a warning, blocked or referred for review.

Their purpose is to protect visitors, users, third parties and the integrity of the service.

If you believe a destination has been incorrectly blocked or restricted, you may request human review by contacting contact@domu.studio.

We do not use automated decision-making that produces legal effects concerning an individual or similarly significantly affects an individual within the meaning of Article 22 GDPR, unless otherwise disclosed or legally permitted.

its.gd is not intended for children.

We do not knowingly collect personal data from children below the age at which they may lawfully use relevant online services without parental authorization.

If you believe a child has provided personal information to us, contact us so that we can review the situation.

Subject to the requirements and limitations of applicable law, you may have the right to:

• obtain information about and access your personal data;
• correct inaccurate data;
• request erasure;
• request restriction of processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time with effect for the future; and
• lodge a complaint with a data-protection supervisory authority.

To exercise your rights, contact contact@domu.studio.

We may need to verify your identity before fulfilling certain requests.

Where personal data is processed under Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.

If you object, we will stop the relevant processing unless compelling legitimate grounds exist that override your interests, rights and freedoms, or processing remains necessary for the establishment, exercise or defense of legal claims.

You may object to direct marketing at any time.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

This includes consent for optional analytics or non-essential technologies.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You have the right to lodge a complaint with a competent data-protection supervisory authority.

For North Rhine-Westphalia, the relevant authority is generally:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44
40102 Düsseldorf
Germany

Website: www.ldi.nrw.de

its.gd links can lead to websites operated by third parties.

We do not control these websites and are not responsible for their privacy practices, cookies, tracking, security, content or legal compliance.

Before providing personal information to a destination website, you should review its privacy information.

URLs can themselves contain personal information.

You should therefore avoid placing personal or sensitive information in destination URLs, query parameters, short-link slugs, reports or support requests unless necessary and legally permitted.

In particular, avoid submitting information such as:

• health, genetic or biometric data;
• political or religious information;
• trade-union membership;
• information about sexual orientation;
• criminal-offense information;
• government identifiers;
• payment-card information outside Stripe;
• passwords;
• authentication tokens; or
• private document links that are not intended to be shared.

If personal information is contained in a URL, it may be processed by its.gd and relevant technical or security providers.

Short links are designed to be shared and may become publicly accessible.

If a slug or destination contains personal information, that information may become visible to people who receive or access the link, use its preview functionality, or review an abuse report.

Do not include personal information in public slugs or destination URLs unless you have a lawful basis and understand the implications.

If its.gd is permanently shut down or materially discontinued, we may process account and contact information to notify affected users where possible.

Free links may be created without an account or email address. We therefore may not be able to notify their creators individually before such links are disabled or deleted.

For registered or paid users, we may use the email address associated with the account to provide important contractual, subscription, shutdown, operational or legal notices.

Where the service is discontinued, data may be deleted, anonymized or retained as necessary for legal, accounting, tax, security, abuse-prevention or documentation purposes.

If its.gd, DOMU.STUDIO or relevant business assets are sold, transferred, merged, reorganized or transferred to a legal successor, information necessary to operate the service may be transferred as part of that transaction where legally permitted.

This may include account information, subscriptions, links, slugs, destination URLs, safety information, analytics, abuse reports, support records and relevant technical or contractual records.

Where required by law, affected users will be informed about such a transfer.

We may preserve or disclose personal data where required or permitted by law, including to courts, law-enforcement authorities, regulators, tax authorities, legal advisers, payment providers, infrastructure providers, or affected third parties where necessary to prevent abuse or harm.

Information may also be preserved or disclosed where necessary to investigate abuse, prevent fraud, enforce our Terms of Service, protect users or third parties, establish or defend legal claims, or comply with legal obligations.

We may update this Privacy Policy when the service, providers, legal requirements or processing activities change.

The current version will be published on its.gd together with its "Last updated" date.

Where required by law, we will provide additional notice of material changes.

For privacy questions, requests, objections, consent withdrawals or other data-protection matters, contact:

DOMU.STUDIO
Dominic Müller
Mainzer Straße 19
50678 Cologne
Germany

Email: contact@domu.studio