Privacy Policy

1. Who we are

gotly is a link shortener with QR codes, click analytics, lead forms, link-in-bio pages and an API. It is run by:

• ModelCam Technologies LLC, 16192 Coastal Highway, Lewes, Delaware, USA, for customers everywhere except India; and
• ModelCam Technologies Pvt Ltd, 704 Kotibhaskar Business Court, Kothrud, Pune, Maharashtra 411038, India, for customers in India.

For your account data, the company you contract with is the data controller (GDPR) or data fiduciary (India's Digital Personal Data Protection Act, 2023, "DPDP Act"). For leads that our customers collect, the customer is in charge and we are their processor (see section 5).

2. The short version

• We do not store the raw IP address of people who open short links.
• We do not show ads on links and we do not use ad trackers.
• We only use essential cookies.
• We do not sell personal data.
• Leads collected through a customer's form belong to that customer. We hold them on the customer's behalf.
• No AI model processes customer data.

3. What we collect

If you have a gotly account

• Account data: your email address and name. If you sign in with Google, we also receive your Google profile picture. We use Google for sign-in only and do not access anything else in your Google account.
• Workspace data: workspace name and settings, team members and their roles, custom domains, API keys (stored in a form we cannot read back) and preferences such as your timezone.
• Your content: short links and their destination URLs, titles, tags, QR code designs, lead form wording and link-in-bio pages.
• Billing data: the billing name, address, phone number and GSTIN (India) you give at checkout, your plan, invoices and payment status. Card and bank details go straight to PayU or Stripe. We do not see or store full card numbers.
• Sign-in and security records: when you sign in, we record the IP address and time of the sign-in request and of your session, to protect your account and to slow down misuse.
• Messages to us: what you send when you email us or ask for support.

If you open a gotly short link

We record the limited click details described in section 4.

If you fill in a lead form

The customer who owns the form receives what you enter (see section 5).

If you report a link

When you use our report page, we keep the link you report, your message, the email address you give us and the IP address the report came from, so we can follow up and stop false or automated reports.

4. Click analytics: what we record when someone opens a link

When someone opens a gotly short link, we record:

• a hashed visitor ID that changes every day, so a customer can count unique visitors without anyone being able to follow a person across days;
• country, worked out from the IP address using an offline IP-to-country database from DB-IP, on our own server, without calling any third party;
• device type and operating system;
• the app or referring site the click came from;
• the time of the click.

We do not store the raw IP address of link visitors. The IP address is used for the country lookup and the daily hash, then discarded.

These click analytics are shown to the customer who owns the link. The customer is responsible for how they use them.

5. Lead forms: our role and the customer's role

Customers can put a lead form in front of a link. A form can ask for a visitor's name, mobile number and email, and optional fields the customer adds, such as company or an answer to a question.

• The customer (the workspace owner) is the data controller or data fiduciary for these leads. They decide why the data is collected and what happens to it.
• gotly is their processor. We store and show the leads to the customer, and handle them only on the customer's instructions.

Each form shows the customer's own notice and an optional marketing consent box. We record exactly what notice and consent wording was shown to the visitor, and whether the box was ticked, so the customer has a record.

Leads are kept until the customer deletes them, or until the customer's workspace is deleted.

To stop spam, we also keep the IP address of each form submission in a short-lived counter for up to 24 hours. It is not stored with the lead.

If you filled in a lead form and want to access, correct or delete your details, please contact the business named on the form. If you cannot reach them, write to us at [email protected] and we will pass your request on.

Customers can ask for our data processing agreement (DPA) at [email protected].

6. Why we use data, and our lawful bases

Under the DPDP Act, we process your personal data with your consent, given when you sign up and agree to this notice, or for other legitimate uses the Act allows, such as meeting legal duties. Under GDPR, we rely on the bases shown below.

We do not use your data for advertising, we do not build profiles of link visitors, and we do not sell personal data. At launch, no AI model processes customer data.

7. Cookies

We only use cookies that are essential for gotly to work. We do not use advertising or tracking cookies.

You can clear cookies in your device settings at any time. If you block them, you may not be able to sign in.

8. Who we share data with

We share data only with service providers who help us run gotly, under contracts that limit what they can do with it:

We may also share data:

• with a court, regulator or law enforcement body when the law requires it;
• to protect people from fraud, phishing or other harm, for example when we report a malicious link;
• with a buyer or successor if our business is sold or merged, who must keep protecting it as this policy says.

9. Where data is stored and international transfers

gotly's servers are in the United States. Cloudflare delivers traffic from its locations around the world, and some providers, such as Stripe and Google, may process data in other countries.

If you are in India, your data is transferred to the United States, which the DPDP Act permits. If you are in the EU, the UK or another country with transfer rules, your data is transferred to the United States and possibly other countries. Where those countries are not covered by an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK addendum for UK data) or another lawful transfer method. You can ask us for a copy of the safeguards.

10. How long we keep data

• Account and workspace data: while your account is open, then deleted within 60 days of closing it (30 days to export your data, then up to 30 days to delete it).
• Links and click analytics: click analytics are available for the history period of your plan, shown on the pricing page. Clicks older than that period are deleted.
• Leads: until the customer deletes them or deletes the workspace.
• Billing records and invoices: 8 years, as tax and accounting laws in the United States and India require.
• Sign-in and security records: 12 months.
• Abuse reports: 2 years.
• Backups: deleted data may stay in backups for up to 14 days before it is overwritten.

We may keep data longer if the law requires it, or if it is needed for a legal claim or an abuse investigation.

11. Security and breach notification

We protect data with measures such as encrypted connections (HTTPS), access controls, hashed API keys and sign-in tokens, and daily off-site backups. No system is perfectly secure, but we work to keep risks low and fix problems quickly.

If a personal data breach happens, we will:

• notify the Data Protection Board of India and affected people, as the DPDP Act and DPDP Rules require;
• notify the relevant EU or UK supervisory authority, and affected people where needed, within the time limits GDPR sets;
• report cyber security incidents to CERT-In where Indian law requires it;
• tell affected customers without undue delay when the breach involves leads or other data we process for them, so they can meet their own duties.

12. Your rights

Under India's DPDP Act

You can:

• ask for a summary of the personal data we process about you and how we process it;
• ask us to correct, complete or update your data;
• ask us to erase your data, unless we must keep it by law;
• withdraw your consent at any time, as easily as you gave it (this does not affect processing already done);
• raise a grievance with us (see section 13);
• nominate another person to use your rights if you die or become unable to.

Under EU and UK GDPR

You can ask to access, correct or delete your data, to restrict or object to how we use it, and to get a copy in a portable format. Where we rely on consent, you can withdraw it at any time. You can also complain to your local data protection authority.

How to use your rights

Email [email protected]. We may need to confirm your identity first. We will respond within the time limits the law sets. If your request is about leads a business collected from you, we will pass it to that business (see section 5).

13. Legal notices and complaints

Legal notices, privacy complaints and grievances (including under India's DPDP Act and the Information Technology Act, 2000) go to:

• ModelCam Technologies LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA
• Email: [email protected]

We will acknowledge your grievance and resolve it within the time limits the law sets. If you are not satisfied with our response, you can complain to the Data Protection Board of India. If you are in the EU or UK, you can complain to your local data protection authority.

14. Children

gotly accounts are not meant for children. You must be at least 18 years old to create an account. We do not knowingly collect children's personal data for accounts. If you think a child has given us personal data, contact us and we will delete it.

Customers must not use lead forms to collect children's data without the parental consent the law requires.

15. Changes to this policy

We may update this policy as gotly or the law changes. The "Last updated" date at the top shows when it last changed. We will tell account holders about important changes by email or in the app before they take effect.

16. Contact

Privacy questions and requests: [email protected], or by post to ModelCam Technologies LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA.