Information pursuant to Art. 13 and 14 GDPR · Version 2026-10 · valid from 1 October 2026
In brief: We store IP addresses of website and short-link visitors only in truncated form or as a keyed hash. The website does not set any cookies for statistics and does not embed any third-party advertising or analytics services. For short-link statistics, we act on behalf of our customers. If a customer has added retargeting pixels to their short link, they are loaded when the link is opened; if the customer has enabled the consent prompt, they are loaded only if you agree (section 9).
Inexdu GmbH
Spitalbergweg 87, 9020 Klagenfurt am Wörthersee, Austria
Telephone +43 4212 30300 · Email, also for data protection requests: support@shortboost.one
FN 497589z, Regional Court of Klagenfurt · VAT ID ATU73554646
We have not appointed a data protection officer because there is no obligation to do so under Art. 37 GDPR: our core activity does not consist of large-scale, regular and systematic monitoring of individuals; the click statistics use truncated IP addresses. The contact for data protection matters is our management, who can be reached at support@shortboost.one.
When you open a page, our server processes your IP address, the date and time, the requested address and your user agent, as technically necessary to deliver the page. Legal basis: legitimate interest in a functioning, secure website (Art. 6(1)(f) GDPR). In our application logs, the IP address appears only in truncated form (see section 11).
We use our own solution on our server to measure how often which pages are viewed. No cookies are set and no data is stored in your browser, and no third parties are involved. For each page view, we store: page, time, time spent on the page, referring page (external websites only), user agent and, derived from it, browser, operating system and device type, screen and window width, UTM parameters in the address and a hash of your truncated IP address (IPv4 without the last octet, IPv6 only the first 48 bits). We do not store your full IP address. If your browser sends “Do Not Track”, we do not measure. Legal basis: legitimate interest in improving our offering and measuring the success of our advertising (Art. 6(1)(f) GDPR). You can object at any time (section 18).
The website shortboost.one sets no cookies. Only when you sign in or register do we store technically necessary data in the browser (see section 4). The legal basis for this access to your terminal device is § 165 para. 3 TKG 2021 (strictly necessary for the service you requested).
Data: email address, name and company (voluntary), password (only as a bcrypt hash), the encrypted secret if two-factor sign-in is enabled, role in the team, invitations, your content (short links, destination addresses, domains, projects, categories, UTM templates, pixel IDs, countdowns, bubbles, pop-ups, branding and logo), API keys (only as a hash) with a log of their use, changes to your email address.
Sign-in and sessions: For each sign-in, we store a session with the device name, user agent and truncated IP address (IPv4 without the last octet, IPv6 only the first 48 bits), so that you can see under Settings → Profile where you are signed in and end sessions that are not yours. A session remains valid for no more than 90 days from its last use. We store sign-in and registration attempts and requests for a sign-in code with the email address and a keyed hash of your IP address (HMAC with a secret key, not reversible), never with the IP address itself, in order to detect and slow down attacks on passwords. In the browser, we store a technically necessary cookie for sign-in (HttpOnly, up to 90 days) and a short-lived access token.
Connections to AI programs: If you connect ShortBoost to an AI program (for example Claude by Anthropic), we store the connection (program name, who created it and when, permissions, last use) and a log of access, as for API keys. We transmit data that the program retrieves or creates via the connection to that program at your request; responsibility for the processing there lies with you or its provider, not with us. The connection only provides statistics in aggregated form, never individual clicks. Legal basis: contract (Art. 6(1)(b) GDPR). Storage period: 90 days for disconnected connections; log as for API keys (section 16).
Purpose and legal basis: provision of ShortBoost under the contract (Art. 6(1)(b) GDPR); for team members who do not themselves have a contract with us, our legitimate interest and that of our customer in collaborating within the account (Art. 6(1)(f) GDPR); account security (Art. 6(1)(f) and Art. 32 GDPR).
Deletion: You can delete your account yourself in the dashboard under Settings → Profile → Delete account. It is deactivated immediately and permanently deleted after 30 days, together with its content, statistics, system emails and sign-in attempts relating to your address. We retain accounting data in accordance with section 16.
Data: plan and plan history, order data, the version of the Terms in force at the time of the order, together with the time of the order and your truncated IP address (the last part is removed), accounting records, invoices, Stripe customer number. We store the truncated IP address as evidence of the order and to protect against abuse: for 7 years for paid orders and for 90 days for unpaid orders (section 16). You enter your payment details, billing address and VAT ID directly with Stripe; we do not store any card or bank account details.
Payment service provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes the payment, calculates VAT (Stripe Tax), creates the invoices and provides the customer portal. Stripe acts as an independent controller for payment processing, in particular for fraud prevention and compliance with its regulatory obligations (Stripe's privacy policy).
Legal basis: contract (Art. 6(1)(b) GDPR); retention of accounting records under § 132 BAO (Art. 6(1)(c) GDPR); evidence of the order (Art. 6(1)(c) and (f) GDPR).
We send you emails that are necessary for the contract: confirmations, sign-in codes, security notices, contract confirmation, invoice notifications, renewal reminders, notices of blocks and plan changes. Legal basis: contract and legal obligations (Art. 6(1)(b) and (c) GDPR). We store sent system emails for 90 days so that we can trace delivery problems.
To send them we use the email server (SMTP) of easyname GmbH, Canettistraße 5/10, 1100 Vienna, Austria.
When you write to us or use the online functions “Withdraw from a contract” or “Cancel contracts here”, we process your name, your email address, the details of the contract, the content of your message or declaration and the time of receipt in order to handle your request and confirm receipt. Together with a withdrawal or cancellation declaration, we store your truncated IP address (the last part is removed) as evidence and to protect against abuse. Legal basis: contract and legal obligations (Art. 6(1)(b) and (c) GDPR) and our legitimate interest in being able to provide evidence and in preventing abusive declarations (Art. 6(1)(f) GDPR). We retain declarations of withdrawal and cancellation, together with the truncated IP address, as evidence for as long as the associated accounting records are retained (7 years, section 16).
Declarations made without signing in: If a cancellation is submitted without signing in, we also send the confirmation to the account's email address. If the cancellation was not made by the account holder, the account holder can undo it via the link in this email. We implement a Lifetime cancellation submitted without signing in only after we have confirmed it via the account's email address; until then, Lifetime continues unchanged. If a withdrawal is declared neither after signing in nor with an order number, we verify before the refund that it comes from the contracting party; for this purpose, we use the account data and the account's email address.
When you open a short link (for example shlk.one/… or a customer's custom domain), we redirect you to the destination and record the visit for the customer's statistics:
With the tracking frame, we count events (for example clicks on a bubble, time spent) without reference to you as an individual. With smart routing, we use country, device and browser language only to choose the destination.
If the customer has protected a link with a password, we set a technically necessary cookie once the correct password has been entered (for no longer than the number of hours chosen by the customer). We briefly count failed attempts in memory to slow down guessing.
The customer who owns the link is the controller; we act on their instructions (Art. 28 GDPR). The legal basis is generally the customer's legitimate interest in evaluating their links (Art. 6(1)(f) GDPR). Click data is deleted automatically after 25 months, earlier if the customer deletes links or their account.
Customers can add pixels from Meta, Google, TikTok or LinkedIn to their short links. When the pixels are loaded, your browser transmits data such as your IP address, user agent, the requested address and identifiers from cookies directly to the respective provider. This data does not pass through our servers and we do not receive it.
If the customer has added pixels to a link, they are loaded by default each time the link is opened, before we redirect you to the destination. Automated requests (bots) are not served any pixels.
Consent prompt: The customer can choose, for each link, to have us ask you first. In that case, before the redirect you will see a short prompt in the customer's branding. It names the customer and the pixel providers and points out that data will also be transferred to the USA in the process. If you choose “Agree”, the pixels are loaded; if you choose “Continue without”, we redirect you without pixels; the link works in both cases. We store your choice in a technically necessary cookie “sbpx_” with an identifier for the customer (value “ja” or “nein”), only for the short link's domain and for 6 months, so that we do not ask you again for other links of this customer on this domain. The cookie contains no information about you personally; we do not store your choice on our server. Withdrawal: You can withdraw your consent at any time with effect for the future by deleting the cookie in your browser (for example via the stored site data for the short-link domain). On your next visit, we will ask again, and you can choose “Continue without”. To have data that has already been transmitted to a pixel provider deleted, please contact the customer or the provider.
The controller for the pixels is the customer who owns the link, where applicable jointly with the pixel provider. The customer is responsible for ensuring a legal basis (in the EU generally your consent, for example under § 165 para. 3 TKG 2021 or § 25 TDDDG and Art. 6(1)(a) GDPR) and for informing you, also under the law of countries outside Europe, and decides whether to enable the consent prompt. The legal basis for the cookie “sbpx_” is § 165 para. 3 TKG 2021 (strictly necessary to respect your choice). We only provide the technology and act as the customer's processor. Information from the providers: Meta, Google, TikTok, LinkedIn.
We check the destination addresses of all short links when they are created and daily against our blocklist, Google Web Risk and URLhaus from abuse.ch. In doing so, we transmit only the destination address to Google and abuse.ch, not any visitor data. If a destination address contains personal data (for example a name in the address), this data is transmitted as well. Legal basis: our legitimate interest and that of visitors in being protected from phishing and malware, and our obligations as a hosting service (Art. 6(1)(c) and (f) GDPR).
Via shortboost.one/missbrauch, we process the reported link, the reason and explanation, your name and email address, your statement that you are reporting in good faith, and your IP address in order to limit mass reporting. We store the IP address only in truncated form (the last part is removed) and as a keyed hash (HMAC with a secret key), never in full. We use the details to review the report, to notify you of its receipt and of our decision, and to ask follow-up questions. Legal basis: Art. 16 DSA (Art. 6(1)(c) GDPR) and our legitimate interest in a secure service (Art. 6(1)(f) GDPR). We disclose your name to the affected customer only if this is necessary for the review or you agree. We delete completed reports after 24 months.
Our applications log requests with the time, address and truncated IP address in order to detect errors and attacks. Sessions contain the IP address only in truncated form, sign-in attempts only as a keyed hash (section 4). We log actions taken by our support staff in customer accounts with the support staff member's truncated IP address. Legal basis: legitimate interest in the security of ShortBoost (Art. 6(1)(f) and Art. 32 GDPR). The upstream proxy (Traefik) logs requests without IP addresses. The logs of the server containers are rotated by size (at most 3 × 10 MB per service) and are therefore usually overwritten after a few days. For further storage periods, see section 16.
Our protective measures include encrypted transmission (HTTPS), separation of customer data at database level, encrypted storage of secrets, optional two-factor sign-in for customers, two-factor sign-in for all admin access, server access only with a key and daily encrypted backups. Details are in Annex 1 to the AVV.
We back up the database daily and weekly, encrypt the backup with AES-256 before uploading it and store it on our server and in Google Drive (Google Workspace). Only Inexdu GmbH has the key; Google cannot read the contents. Legal basis: legitimate interest and the obligation to ensure that data can be restored (Art. 6(1)(f) and Art. 32(1)(c) GDPR). Deleted data disappears from the backups when they expire (section 16).
If you use ShortBoost via BusinessBoost One, sign-in and account assignment are handled via BusinessBoost One. If you choose a preview image from the BusinessBoost One media library or upload one, the image is stored there; we store only the address. BusinessBoost One is a product of Inexdu GmbH; the platform is operated by the platform operator of BusinessBoost One, which is based in the USA (see sections 14 and 15). Legal basis: contract (Art. 6(1)(b) GDPR).
| Recipients | Purpose | Location |
|---|---|---|
| Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Server (database, applications, redirects) | Cyprus; servers in the Frankfurt am Main data centre, Germany |
| easyname GmbH, Canettistraße 5/10, 1100 Vienna | Sending system emails (SMTP) | Austria |
| Stripe Payments Europe, Limited (independent controller for payment processing) | Payment, tax, invoices, customer portal | Ireland; Stripe, Inc. in the USA |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 (Google Workspace, Google Drive), with Google LLC as a further service provider | encrypted backups | Ireland / USA |
| Google Ireland Limited / Google LLC (Web Risk) | Checking destination addresses (the address only) | Ireland / USA |
| abuse.ch (URLhaus), Bern University of Applied Sciences | Checking destination addresses (the address only) | Switzerland |
| Platform operator of BusinessBoost One | only for accounts via BusinessBoost One: sign-in, media library | USA |
| Pixel providers (Meta, Google, TikTok, LinkedIn) | only if a customer uses pixels and they are loaded (section 9) | Ireland / USA |
We transmit data to authorities and courts only if we are legally obliged to do so. Tax advisers and auditors receive accounting data to the extent necessary.
Google LLC and Stripe, Inc. are certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In addition, standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) have been agreed with Google; these apply if the adequacy decision lapses. The transfer to the platform operator of BusinessBoost One is based on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). An adequacy decision exists for Switzerland (abuse.ch). Transfers to pixel providers (section 9) take place directly from your browser; the customer who owns the link is responsible for them. You can obtain a copy of the safeguards by sending a request to support@shortboost.one.
Unless stated otherwise, our system automatically deletes data once a day in accordance with the following periods.
| Data | Period |
|---|---|
| Account and content | until deletion of the account, then 30 days of deactivation, then permanently deleted |
| Clicks on short links | 25 months (or earlier, together with the link or account) |
| Cookie “sbpx_” storing your choice in the consent prompt before pixels are loaded (only in your browser) | 6 months or until you delete it in the browser |
| Events in the tracking frame (not linked to any individual) | 400 days |
| Page views of the website | 25 months |
| Sign-in and registration attempts (with a keyed hash of the IP address) | 90 days |
| Sessions (with truncated IP address) | while valid (at most 90 days from last use), then a further 90 days |
| Sign-in codes, confirmation, password and undo links | 30 days after expiry or use |
| Email address changes | 12 months |
| API key usage log | 90 days |
| AI connections (disconnected) | 90 days |
| system emails sent | 90 days |
| completed abuse reports | 24 months after completion |
| Log of support actions | 24 months |
| Logs of the server containers | rotated by size (at most 3 × 10 MB per service), usually overwritten after a few days |
| unpaid (abandoned) orders, together with the truncated IP address | 90 days |
| Order, accounting and invoice data, withdrawal and cancellation declarations, each together with truncated IP address | 7 years from the end of the calendar year (§ 132 BAO), longer only while proceedings are pending |
| Backups on the server | daily: 14 days, weekly: 8 weeks |
| Backups in Google Drive | daily: 30 days, weekly: 8 weeks |
We make an automated decision within the meaning of Art. 22 GDPR only in abuse prevention: if the daily check reports a destination address as dangerous, we block the link automatically; a link of this kind is not saved when it is created (section 10). The decision is based solely on the destination address, not on you as a person. The decision is necessary for the performance of the contract (Art. 22(2)(a) GDPR), because this is the only way we can offer a secure service. You can request that a human review the decision, express your point of view and contest the decision (clause 12.5 of the Terms). No profiling takes place.
Write to support@shortboost.one. We reply within one month. If we have doubts about your identity, we will ask you for further information.
You can lodge a complaint with a supervisory authority, in Austria with the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at, or with the authority of your place of residence.
To create an account, we need your email address; for a purchase, we need the payment and billing details requested by Stripe. Without these details, we cannot conclude a contract. All other details are voluntary. Processing when short links and the website are opened is technically linked to opening them.
We update this privacy policy when our processing or the legal situation changes. We notify customers of material changes by email.
Version 2026-10, valid from 1 October 2026