1. Who We Are
Redirecta ("we", "our", "us") operates the website redirecta.io. We are the data controller responsible for your personal data. If you have questions about this policy, contact us at [email protected].
2. What Data We Collect
Account data
When you register, we collect your email address and store a securely hashed version of your password. We never store passwords in plain text.
Usage data
When you use our redirect mapping tool, we process the URLs you upload (source and destination lists) and the matching results generated. This data is tied to your account so you can access your job history.
Log data
We log authentication events (login, registration, password changes) with timestamps and IP addresses for security purposes.
Analytics data (with your consent)
If you consent to analytics cookies, we use Google Analytics 4 and/or Google Tag Manager to collect anonymized usage statistics such as pages visited, session duration, device type, and approximate location. This data helps us improve the service.
3. Legal Basis for Processing (GDPR)
- Contract performance (Art. 6(1)(b)): Processing your account and uploaded data is necessary to provide the redirect mapping service you signed up for.
- Legitimate interest (Art. 6(1)(f)): Security logging and fraud prevention.
- Consent (Art. 6(1)(a)): Analytics cookies are only loaded after you explicitly opt in via our cookie consent banner.
4. How We Use Your Data
- To provide and maintain the redirect mapping service
- To authenticate you and secure your account
- To send transactional emails (verification, password reset)
- To improve our service based on anonymized usage patterns (with consent)
We do not sell, rent, or share your personal data with third parties for marketing purposes.
5. Data Sharing & Third Parties
We use the following third-party services to operate Redirecta:
- Hetzner Online GmbH (Germany): Server hosting. Your data is stored on servers in Nuremberg, Germany, within the EU.
- Cloudflare, Inc. (USA): CDN, DDoS protection, and DNS. Cloudflare processes request metadata. Cloudflare is certified under the EU-US Data Privacy Framework.
- Google LLC (USA): Analytics (only with your consent). Google is certified under the EU-US Data Privacy Framework.
6. Data Retention
- Account data: Retained until you delete your account.
- Job data: Retained until you delete individual jobs or your account. Failed and abandoned jobs are automatically deleted after 7 days.
- Auth logs: Retained for 12 months for security purposes, then automatically purged.
- Analytics data: Governed by Google's data retention policies (default: 14 months).
7. Your Rights
Under the GDPR (and similar laws), you have the right to:
- Access: Request a copy of all personal data we hold about you. You can export your data from your account settings.
- Rectification: Update your email address from your account settings.
- Erasure: Delete your account and all associated data from your account settings (Danger Zone).
- Data portability: Export your data in a machine-readable format (JSON).
- Withdraw consent: Change your cookie preferences at any time via the "Cookie Preferences" link in the footer.
- Object: Object to processing based on legitimate interest by contacting us.
- Lodge a complaint: File a complaint with your local data protection authority.
8. Cookies
For detailed information about the cookies we use, please see our Cookie Policy.
9. Security
We implement appropriate technical and organizational measures to protect your data, including:
- Passwords hashed with bcrypt
- HTTPS encryption in transit (TLS 1.2+)
- CSRF protection on all state-changing requests
- Content Security Policy headers
- Rate limiting on authentication endpoints
- HTML sanitization on all user-generated content
10. International Transfers
Your data is primarily stored within the EU (Hetzner, Germany). Where data is transferred to the USA (Cloudflare, Google Analytics), these providers are certified under the EU-US Data Privacy Framework, providing adequate safeguards for your data.
11. Children's Privacy
Redirecta is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to This Policy
We may update this policy from time to time. We will notify registered users of significant changes via email. The "Last updated" date at the top of this page indicates when it was last revised.
13. Contact
For privacy-related questions or to exercise your rights, contact us at: