/// Privacy policy

Who we are

Toifel is a link shortener with click analytics, run by the business named at the bottom of this page. In this policy, "we" means that business and "you" means anyone who uses Toifel or clicks a Toifel link.

We follow India's Digital Personal Data Protection Act, 2023. For personal data covered by it, we are the data fiduciary.

What we collect from account holders

• Your name, email address and password. Passwords are stored only as a one-way hash.
• Two-factor authentication settings, if you turn them on.
• Your workspaces, team members and invitations.
• The links you create: destination URLs, short codes, tags, expiry dates and any QR logo you upload.
• Billing details you give us for tax invoices: legal name, state, and optionally a GSTIN and address.
• Payments and subscriptions, as reported to us by Razorpay. We never see or store your card, UPI or bank details.

What we collect when someone clicks a link

When a visitor opens a Toifel short link, we record the time, the country, the device type, the browser, the operating system and the referring website (domain only).

We never store the visitor's IP address. We use it for a moment to look up the country, then keep only a one-way hash of the IP address and browser, salted with a value that changes every day. This lets us count unique visitors without being able to identify anyone. Short links set no cookies.

Why we use it

• To run the service: redirect links, show you analytics, and keep your account secure.
• To bill you and issue GST tax invoices and credit notes.
• To send you emails about your account: verification, invitations, usage limits, plan changes, failed payments, tax invoices and credit notes, imports and exports, and links we disable for abuse. We do not send marketing email.
• To stop abuse: we check link destinations against Google Safe Browsing and act on abuse reports.

Who we share it with

We do not sell personal data. We share it only with the services that help us run Toifel:

• DigitalOcean, which hosts our servers in Bengaluru, India.
• Razorpay, which processes payments.
• Brevo, which sends our emails.
• Cloudflare Turnstile, which checks that sign-up and abuse report forms are filled in by a person.
• Google Safe Browsing, which receives link destination URLs (not visitor data) to check them for phishing and malware.

Cookies

The dashboard uses a session cookie to keep you signed in and a security cookie to protect forms. The website may remember your light or dark mode choice. We use no advertising or third-party tracking cookies.

How long we keep it

• Individual click records: 30 days.
• Daily click totals: 30 days on Free, 1 year on Pro and 3 years on Business.
• Account and link data: until you delete them. A deleted workspace can be restored for 30 days, then its links, clicks, statistics and API keys are permanently erased.
• Payments, invoices and credit notes: for as long as Indian tax law requires, even after you delete your account.
• Abuse reports, including any email address you give us: as long as we need them to handle the report and protect the service.

Your rights

You can see and correct your details in your account settings, export your links and statistics on paid plans, and delete your account or workspace at any time. You can also email us to ask for a copy of your data, a correction or erasure, or to raise a complaint. We reply within 30 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Security

All traffic is encrypted with HTTPS. Passwords and API keys are stored only as hashes. Access to production systems is limited to the people who run Toifel.

Changes to this policy

If we change this policy in a way that matters, we will email account holders before the change takes effect.