Privacy policy

1. Who we are

vveb.top is run by Syed Ahmed, a sole proprietor trading as vveb.top. For personal data that we decide how to use, such as your account, we are the controller (the data fiduciary under India's Digital Personal Data Protection Act, 2023). For the click data about people who tap your links, you decide why the links exist and we process the data for you. Our grievance officer is Syed Ahmed, Hyderabad, Telangana, India. Write to support@vveb.top for anything in this policy.

2. What we collect

From you, when you hold an account

• Account: your email address, your name if you add one, a backup email if you add one, an avatar seed, the sign-in identifier from Firebase, your role, and the name of your workspace.
• Your links: destinations, titles, back-halves, expiry dates, settings, collections and the QR looks you choose.
• API keys: we keep a one-way hash and a short prefix, never the full key.
• Payments: the plan and period you pick, the method (UPI, PayPal or Skydo), the payment reference you send, the amount and currency, and the dates. We do not receive or store card numbers.
• Messages: what you send to support.

About people who click a short link

• The time of the click.
• Country, region and city, which Cloudflare works out from the connection.
• Device type, operating system, browser and language, read from the browser's user agent. We also keep the user agent text.
• The referrer, and any UTM tags on the link.
• A flag for bots, and a flag for clicks that came from vveb.top itself.
• A visitor fingerprint: a one-way hash of the connection address, the user agent and a secret salt that changes every day. It cannot be turned back into an IP address.

We do not store the visitor's IP address. We do not read or store anything the visitor types on your destination page.

From people who report a link

The category and details they enter, an email address if they choose to give one, and a salted hash of their connection address. We use the hash only to limit how many reports one person can send in an hour.

From your device

The cookies and browser storage in the cookie policy, and the technical data a web server sees in every request, such as your IP address and browser details. Our hosting provider processes these to deliver pages and to protect the service.

3. Why we use it

Under the Digital Personal Data Protection Act, 2023, we process data with your consent or for a legitimate use the Act allows, such as performing what you asked us to do, meeting a legal duty and preventing fraud. Where another law applies to you, such as the UAE Federal Decree-Law No. 45 of 2021 on personal data protection, the grounds in the table also follow that law. Where the law of your country asks for consent, we ask for it, and you can withdraw it at any time. We do not use your data for advertising, and we do not build profiles of individual visitors.

4. Who else handles it

We do not sell personal data. We share it only with the services that help us run vveb.top:

• Cloudflare hosts the service, delivers pages, stores our database and cache, and processes requests worldwide.
• Google Firebase handles sign-in: email and password, email links, and Google sign-in. It sends the sign-in emails.
• Google Fonts serves the typefaces on our pages. When a page loads, your browser asks Google for the fonts, so Google receives your IP address and browser details. This applies to our website, to sign-in pages, and to the page a visitor sees when a link opens through the escape page.
• Payment services (UPI apps and banks, PayPal and Skydo) process the payments you make. They are separate controllers of what they collect.

We may also disclose data when the law requires it, to protect people from harm, or as part of a sale or reorganisation of the service. In that last case the new owner must honour this policy.

5. International transfers

Cloudflare and Google run infrastructure in many countries, so your data can be processed outside the country where you live, including outside India and the UAE. Where the law requires a safeguard for such a transfer, we rely on the providers' contractual commitments and on the protections each country's law allows.

6. Retention: how long we keep it

• Account and links: for as long as your workspace exists. Deleting a link deletes its click records. Deleting a workspace deletes its links, click records, members and keys.
• Payment records: for as long as the tax and accounting law of the countries that apply requires.
• Reports of abuse: for as long as we need them to handle the report and to prevent repeat abuse.
• Support messages: for as long as we need them to help you and to show what we agreed.
• Backups and logs: for a short period after deletion, until they roll off.

Pausing a link, or moving to the Free plan, deletes nothing.

7. How we protect it

All traffic uses HTTPS. Sign-in sessions use a signed, HttpOnly cookie. API keys are stored as hashes. Workspaces are kept apart in the database, and staff access is limited to what the work needs. No system is perfectly safe. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

8. Your rights

Depending on where you live, you can ask us to:

• tell you what we hold about you and give you a copy;
• correct what is wrong;
• delete your data;
• limit or stop some uses of it;
• move it to another service; and
• withdraw consent you gave.

You can also name someone to exercise these rights for you if you die or cannot act. Write to support@vveb.top from the email you sign in with, so that we know the request is yours. We aim to reply within 30 days. You may complain to our grievance officer first. If we do not resolve it, you can complain to the Data Protection Board of India or to the authority in your country. If you are a visitor and want data about your click removed, write to us or to the owner of the link.

9. If you run a workspace

You decide why you send people through your links. You are responsible for telling your visitors what you collect, including through your destination pages, and for having a lawful ground to do so. We process click data for you under your instructions and these terms. Ask us if you need a data processing agreement.

10. Children

vveb.top is for adults. We do not knowingly collect personal data from anyone under 18. If you think a child has given us data, write to us and we will delete it.

11. Changes to this policy

We may update this policy. The date at the top shows the latest version. For a change that matters, we will tell you by email or in the dashboard before it takes effect.