Privacy Policy

1. Data controller

The data controller for data collected through the ClicAven service is:
Anablabs SAS
France
DPO contact: contact form

2. Data collected

We only collect data necessary for the service to operate:

• Account data: email address, hashed password (bcrypt)
• Shortened links: destination URL, generated short code, creation date
• Click statistics: aggregated counters only. Each click increments three non-identifying dimensions: the day, the domain name of the referring page (never the full address, which could contain an identifier) and the device family (desktop, mobile, tablet). No IP address, no cookie, no browser fingerprint, no per-visitor row. Nothing is read from or written to the visitor's device, so no consent is required. Retention depends on your plan: 30 days (Free), 365 days (Pro), 3 years (Business), unlimited (Scale).
• Payment data: processed exclusively by Stripe — we store no banking data
• Technical logs: IP addresses anonymized at write time (IPv4 /24, IPv6 /48 truncation), retained 7 days maximum
• Anti-abuse data: the account holder's IP address at sign-up and link creation (phishing and spam prevention), retained 12 months

3. Purposes of processing

• Provision of the URL shortening service
• Account authentication and security
• Click statistics tracking for your use
• Billing and subscription management
• Sending transactional emails (confirmations, invoices)
• Detection and prevention of abuse and spam

4. Legal bases

• Contract performance: processing necessary to provide the subscribed service
• Legitimate interest: security, anti-abuse, service improvement
• Consent: marketing communications (if you have expressly consented)
• Legal obligation: retention of billing data required by law

5. Retention period

• Account data: retained while the account is active
• Shortened links: retained while the account is active
• Billing data: 10 years (accounting obligation)
• Technical logs: 7 days maximum (anonymized IPs)
• Anti-abuse IPs (sign-up, link creation): 12 months
• Upon deletion request: complete erasure within 30 days

6. Data recipients

Your data is processed by the following sub-processors, all GDPR compliant:

• OVH SAS (hosting) — Gravelines, France 🇫🇷
• Stripe Inc. (payment) — transfer governed by EU Standard Contractual Clauses
• Amazon Web Services (email via SES) — eu-west-3 region

No data is sold to third parties for advertising or commercial purposes.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right of rectification: correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to portability: receive your data in a readable format
• Right to object: object to certain processing
• Right to restriction of processing

To exercise your rights: contact form
Response time: 30 days maximum.
To file a complaint: you can contact the CNIL (cnil.fr).

8. Cookies

ClicAven only uses strictly necessary cookies for the service to function (authentication session, CSRF protection). No advertising or third-party tracking cookies are set.

9. Hosting

The entire service is hosted in France at OVH (Gravelines datacenter, France). Your data does not leave the European Union, except for email flows governed by appropriate safeguards.