Privacy Policy

Version 2026-10-06 · Effective 6 October 2026

This Privacy Policy explains how SystGrid Solutions Pvt Ltd ("SystGrid", "we", "us"), which operates the furl.io URL-shortening and link-analytics service (the "Service"), collects, uses, stores, shares and protects personal data. It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, the Information Technology Act, 2000 ("IT Act") and the rules made under it, and other applicable laws of India.

For the purposes of the DPDP Act, SystGrid is the Data Fiduciary for the personal data described in this policy.

1. Who this policy covers

Account holders: people who register for a furl.io account and create short links.
Link visitors: people who open a furl.io short link (for example https://furl.io/abc1234), whether or not they have an account.

2. Personal data we collect

2.1 Account holders

Account details: email address, a password (stored only as a one-way bcrypt hash; we never store or see your password), your plan, and whether you are an administrator.
Consent record: the version of these terms you accepted and when.
Email verification: one-time codes we email to confirm that you own your email address. We store codes only as a keyed cryptographic hash, they expire after 10 minutes, and we delete them within 24 hours.
Content you provide: destination URLs, custom short codes, link settings, Google Analytics 4 measurement IDs and API secrets, and webhook URLs.
Workspaces: the workspaces you create or join, their names, members and roles, and the custom domain names connected to them with their verification records.
Invitations: the email address of each person you invite to a workspace, the role offered and who sent it. We use it only to send the invitation email and to let that person join.
Credentials: API keys (we keep only a hash and a short prefix) and webhook signing secrets.
Session data: a session cookie that keeps you logged in.
Website analytics (only if you accept): see section 9.
Billing details (paid plans): your billing country, optional GSTIN, what you bought, amounts, taxes and payment references. Card, UPI and bank details are entered directly with our payment processor, Razorpay; we never receive or store them.
Technical data: IP addresses and request details in server logs whenever you use the Service.

2.2 Link visitors

When you open a short link, we automatically record:

your IP address;
the date and time of the click and the short link you opened;
your browser's User-Agent string, from which we derive device type, operating system and browser;
the referring page (the page that linked to the short link), where your browser sends it;
your approximate location (country, and where available city and coordinates), derived from your IP address.

We do not use cookies or similar technologies to identify link visitors, and we do not build profiles of visitors across links. Short-link redirects never load analytics scripts or set cookies.

3. How we use personal data

To provide the Service: redirecting short links, operating accounts and authenticating users.
To give link owners analytics about clicks on their links.
To deliver webhooks and, where a link owner has configured it, Google Analytics 4 events (see section 5).
To keep the Service secure: detecting and preventing fraud, phishing, malware, spam and abuse, enforcing our Terms of Use, and investigating incidents.
To comply with legal obligations, including the record-keeping and reporting obligations described in section 7, and to respond to lawful requests from government and law-enforcement agencies.
To communicate with you about your account, security, and changes to our terms.

We do not sell personal data, and we do not use it for advertising.

4. Legal grounds for processing

Consent: you give consent when you create an account by expressly accepting this policy and the Terms of Use. You may withdraw consent at any time by deleting your account (section 10). Withdrawal does not affect processing that happened before it.
Legitimate uses under section 7 of the DPDP Act: we process personal data without separate consent where the DPDP Act permits it, including to comply with any law in force in India, to comply with judgments, decrees and orders, and for the other legitimate uses the Act recognises. This includes keeping IP-address and log records, which the law requires of us (section 7).

Members of a workspace see the workspace's links, settings and analytics, and the email addresses and roles of its other members. Administrators and owners of a workspace also see its invitations.
Link owners see analytics about clicks on their own links: time, country, city, referring domain, device type, operating system and browser. Link owners are never shown visitors' IP addresses.
Webhook recipients: if a link owner configures a webhook, the same click details (without the IP address) are sent to the URL the link owner provides. That recipient is responsible for its own handling of the data.
Google (Google Analytics 4): only if a link owner configures GA4 for a link, we send Google a click event with the short code, referring domain, device type and country, together with a pseudonymous identifier derived from a one-way hash of the visitor's IP address and User-Agent. Raw IP addresses are not sent to Google. Google may process this data outside India under its own terms.
Resend, Inc. delivers our transactional emails, such as verification codes. To send an email, Resend processes your email address and the content of the message, and may keep delivery logs, possibly outside India, under its own terms.
Razorpay Software Private Limited processes payments for paid plans and add-ons, under its own privacy policy and the rules of the Reserve Bank of India.
Google LLC (Google Analytics 4): only for visitors to our public website pages who accept analytics cookies (section 9). Google may process this data outside India under its own terms.
Cloudflare, Inc. provides network security, DDoS protection and content delivery for furl.io. All traffic to the Service passes through Cloudflare's network, which may process IP addresses and request data at its points of presence inside or outside India in order to deliver and protect the Service.
Government and law-enforcement agencies, as described in section 7.
Professional advisers and successors: our auditors and legal advisers under confidentiality, or a successor entity in a merger, acquisition or restructuring, subject to this policy.

6. Where data is stored

All personal data that the Service stores is kept on servers located in India (Mumbai, Maharashtra). Data in transit may pass through Cloudflare's network, through our email delivery provider when we send you email, and, where a link owner configures them, through third-party webhook and Google Analytics endpoints, as described in section 5.

7. Record keeping and cooperation with authorities

IP addresses and logs. We record and keep, on our servers in India, the IP addresses and related records described in section 2. This includes the logs that service providers must maintain under the directions issued by the Indian Computer Emergency Response Team (CERT-In) under section 70B of the IT Act.
Lawful requests. We will always cooperate with authorised Indian government, security and law-enforcement agencies on valid, lawful requests. This includes requests made under the IT Act (including sections 69, 69A, 69B, 70B and 79 and the rules and directions under it), the Bharatiya Nagarik Suraksha Sanhita, 2023, and orders of competent courts. In response to such requests we may preserve and disclose account information, link data, click records, IP addresses and logs.
Incident reporting. We report cyber-security incidents to CERT-In, and personal data breaches to the Data Protection Board of India and affected Data Principals, as the law requires.

8. How long we keep data

Data	Retention
Account details, links and settings	Until you delete the link or your account.
Email verification codes	Expire after 10 minutes; deleted within 24 hours.
Workspace invitations	Until accepted or withdrawn; an invitation can only be used for 7 days.
Billing and payment records	8 years from the end of the financial year of the transaction, as required by Indian tax laws, even if you delete your account.
Website analytics (Google Analytics)	Under the retention period configured in our Google Analytics property; the `_ga` cookies in your browser expire after up to 2 years or when you withdraw consent.
Click records (IP address, User-Agent, referrer, location, time)	Up to 3 years from the click, then deleted automatically.
Web server logs (including IP addresses)	180 days, as required by CERT-In directions.
Webhook delivery logs	Until the link or account is deleted.
Administrator audit records	Kept for accountability and legal compliance.
Records subject to a legal hold or lawful request	As long as the law or the request requires.

When you delete your account, we delete your account details and every workspace that only you belong to, with its links, API keys and webhook logs, immediately, and schedule the click records for those links for deletion. Links you created in a team workspace belong to that team and stay with it. If you own a team workspace that has other members, you need to transfer its ownership or delete it before you can delete your account. We may keep data beyond these periods only where the law requires it.

9. Website analytics and cookies

We use Google Analytics 4 to understand how people use the public pages of furl.io (the home page, documentation, legal pages, and the sign-in and registration pages).

Off by default. Google Analytics loads only after you click Accept analytics in the cookie banner. If you click Reject, or ignore the banner, it never loads and no analytics cookies are set.
Never in your dashboard or on short links. Signed-in pages (your dashboard and the admin area) and short-link redirects are never reported to Google Analytics.
What is collected if you accept: the pages you view, the referring page, and technical information such as device type, browser, approximate location (derived by Google from your IP address) and a pseudonymous identifier stored in the cookies _ga and _ga_<ID>.
Change your mind at any time with Cookie settings in the footer of every page. Withdrawing consent stops further collection and deletes the analytics cookies from your browser.

The only other cookie we set is the strictly necessary furl_session cookie that keeps you signed in. We also store your consent choice in your browser's local storage; it is never sent to us.

10. Your rights

Under the DPDP Act you have the right to:

Access a summary of your personal data and of how we process it.
Correct, complete or update your personal data.
Erase your personal data. Account holders can delete their account at any time from Dashboard → Settings → Delete account.
Withdraw consent, with effect from the time of withdrawal.
Grievance redressal: have your complaints about our processing addressed.
Nominate another person to exercise your rights in the event of your death or incapacity.

Link visitors and account holders may exercise these rights by writing to the Grievance Officer (section 13). Some rights are subject to our legal obligations, for example the record-keeping in section 7. If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India after using our grievance process.

11. Children

The Service is not intended for persons under 18 years of age, and they may not create an account. If we learn that we have collected an account holder's personal data from a person under 18 without verifiable parental consent, we will delete it.

12. Security

We protect personal data with reasonable security safeguards, including:

encryption in transit (TLS) between your browser, Cloudflare and our servers;
one-way hashing of passwords and API keys;
signed webhooks;
strict access controls, with databases reachable only from inside our servers;
an append-only audit trail of administrator actions;
firewalling that admits web traffic only from our security provider.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by law.

13. Grievance Officer and contact

In accordance with the IT Act, the rules made under it, and the DPDP Act, the details of the Grievance Officer are:

Grievance Officer: Grievance Officer, SystGrid Solutions Pvt Ltd
Email: [email protected]
Address: Office No. 603, Grace Chamber, Andheri - Kurla Road, Amrut Nagar, Gundavali, Andheri East, Mumbai, Maharashtra 400093, India

We acknowledge grievances within 24 hours and aim to resolve them within 15 days of receipt.

For any other privacy or legal questions, contact [email protected].

SystGrid Solutions Pvt Ltd · CIN: U74999MH2022PTC384896 · Registered office: Office No. 603, Grace Chamber, Andheri - Kurla Road, Amrut Nagar, Gundavali, Andheri East, Mumbai, Maharashtra 400093, India.

14. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new version date and, where the changes are material, notify account holders by email or in the Service and, where the law requires it, ask for fresh consent.