Legal
Privacy Policy
Last updated November 2, 2026
Data controller and contact
This policy describes how fewly handles personal data for the Service operated from the public website fewly.tech.
For your own account, fewly is the controller. For the people who click your links and the contacts you track, you are the controller and fewly processes that data for you under our Data Processing Agreement.
You can reach our privacy contact at support@fewly.tech.
Information we process
The service collects different information depending on whether you are a registered customer or a person who clicks a link that another user created.
Information about registered customers
- Identifiers and contact details: name, email address, public workspace identifiers, and other account-related identifiers.
- Authentication and security data: password hashes, one-time codes, session and CSRF information, verification status, account status, activity timestamps. If you turn on two-step verification, an encrypted authenticator secret and hashed recovery codes. If you sign in with Google, the email address and name Google shares with us.
- Workspace and team data: workspace names, ownership, team membership, roles, invited email addresses, audit log entries.
- API and operational data: API key names, prefixes, revocation status, last-used timestamps and rate-limiting events.
- Billing and plan data: plan, seat quantity, subscription status, cancellation preferences, invoice details, and payment method metadata.
- Support and contact records: messages you send us, including support, billing, privacy, and abuse reports.
Information about links and link visitors
When an account is created or a link or click is processed, fewly may process the following, depending on the feature.
- The destination URL, custom code, title, tags, folders, descriptions, password protection and link settings.
- Custom short domains, security tokens, verification status, TLS configuration and workspace association.
- Link settings that affect redirects, such as rotation, geo or device targeting, retargeting pixels, and action pages.
- Click analytics timestamped to a link, including device, browser, operating system, referrer, and approximate location.
- Bot-detection and filtered-traffic information used to distinguish genuine human activity from scans.
- Tool usage information from the free browser tools, such as which tool was viewed, used, or downloaded.
- Survey or bio content, if you are creating or responding to those features.
- CRM contact identifiers, only on links where you turn on See who clicked: the value after
?fc=in the link. It is encrypted before it is stored, it is never passed on to the destination, and it is erased from click records after 180 days. - Ad spend you add to a client report, such as daily spend, impressions and clicks from Meta or Google Ads exports.
Link visitor privacy
fewly may process data about people who click links on the platform. Where visitor IP addresses are involved in analytics or uniqueness calculations, our application uses a keyed hash instead of storing the raw IP address. The app uses a hashed value rather than the raw IP for click analytics and for browser-tool uniqueness.
A hashed value can still enable approximate uniqueness calculations and bot filtering, but it is deliberately not a full plaintext identifier and is not a customer-facing contact identifier.
Country, region and city information is inferred locally from the visitor IP where available. It is used to provide approximate analytics, filtering, or routing, and should not be relied upon as a precise physical address.
Browser details, device types, referrers and timestamps may also be recorded. Bots are excluded from several primary analytics views, though some aggregate table data may still reflect filtered traffic.
Our web server and application logs record the page path without its query string, so tracking parameters and contact identifiers in a link are not written to logs. Logs are rotated and deleted after 14 days.
Products designed for marketers need some technical information to measure clicks. We aim to keep that information limited to what is operationally necessary.
Purposes and legal bases
fewly processes information for legitimate business purposes, including:
- providing and maintaining the Service;
- registering and authenticating accounts, including security and account recovery;
- creating, organising, resolving and analysing links;
- providing payment processing, subscriptions, refunds, invoices and customer support;
- responding to contact, privacy, support, or abuse-report requests;
- providing customer-managed links, integrations, and API access;
- detecting, investigating and preventing fraud, abuse and security incidents;
- producing anonymised or aggregate analytics for our own service quality and infrastructure;
- meeting legal, accounting, tax, regulatory and dispute-resolution obligations.
Where applicable law sets the legal basis, we rely on appropriate bases such as performance of a contract with you, our legitimate business interests, your consent where it is genuinely needed for a feature, and compliance with legal obligations.
We do not claim one legal basis for every process. If a feature specifically requires your consent, we collect or use that information only for that purpose while consent remains in place, unless another lawful basis applies.
Payment processing
Purchases are processed by the payment provider shown at checkout. Our current checkout provider supports subscription billing and may retain transaction records, tax details, payment method data, and customer information necessary to process, support, refund and reconcile those transactions.
We do not collect or store your complete card number. We receive limited transaction-related metadata so subscriptions, invoices and plan access can be synchronised with your account.
Where another Merchant of Record is used for a purchase in the future, that entity may process the information necessary for the transaction, tax handling, transaction-related support, fraud prevention and refunds. Its own privacy notice will apply to that process.
You can always avoid sharing payment details by submitting them directly to the secure payment form, never by sending them to us by email.
Who processes data for us
fewly runs on its own servers, rented from Contabo GmbH in a data centre in France (European Union). The database, link redirects, analytics and backups are stored there. These companies process data for us:
- Contabo GmbH: Servers, database and backups. France (EU).
- Stripe: Payments and invoices. United States and EU.
- Resend: Sending account and report emails. United States.
- Google: Checking destinations against Safe Browsing; Sign in with Google if you use it. United States.
- VirusTotal (Google): Checking destinations for malware, when enabled. United States.
Approximate location comes from a geolocation database that runs on our own servers, so visitor IP addresses are not sent to a location service.
Integrations you set up yourself, such as webhooks, retargeting pixels, Zapier or your CRM, send data to the destinations you choose. Those services act for you, not for fewly.
Where data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We will update this list before adding a new company that processes customer data.
Your customers' data and our DPA
If you use fewly for clients, patients or customers, our Data Processing Agreement forms part of our Terms and covers that data. It explains what we do with it, the security we apply and how we help you answer requests from the people concerned.
- Contact identifiers are encrypted at rest and erased from clicks after 180 days.
- Visitor IP addresses are stored only as a keyed hash.
- Accounts can use two-step verification, and workspaces can require it for every member.
- For health, finance or similar clients, use a CRM contact ID rather than an email address or phone number in your links.
Data retention
Retention varies by data category and plan. We keep account records while your account is active. Detailed click history is retained according to your plan; current plan defaults allow 30 days for the Free plan and 365 days for Pro and Team. Aggregated tables may be retained longer because they support dashboard queries and business analytics.
We may retain records for longer where reasonably needed for security logs, dispute resolution, legal holds, audits, accounting, fraud prevention, or to protect the Service and its users.
- CRM contact identifiers on clicks: 180 days.
- Server and application logs: 14 days.
- Webhook delivery history: 14 days.
- Database backups: taken every 15 days, and only the two newest are kept, so about a month.
If you delete your account or content, it is removed from the live database straight away and from backups within about 45 days, unless we must keep a record by law.
Your privacy rights
Depending on your laws and your relationship with us, you may be able to request access to your data, correction of inaccurate data, an export copy, deletion of your account or particular content, restriction of processing, or objection to certain processing.
You can make privacy requests by emailing support@fewly.tech from the address associated with your account, or by contacting support if you have a different privacy question.
We will verify your request before acting on it. Not every right applies in every situation, and not all records can be deleted immediately, especially where legal retention or security needs apply.
Security and children's privacy
We use technical and organisational measures intended to protect personal data, including authentication, password hashing, one-time codes, access controls, secure HTTP-only cookies, CSRF protections, and monitoring. No security measure guarantees that all data is protected all the time.
If you find a potential vulnerability, contact abuse@fewly.tech and include enough technical detail for us to review it responsibly.
The Service is not directed to children. We do not knowingly collect personal data from children under 13 or from users under the age at which digital consent is required by their local law. If we learn that a child created an account contrary to applicable law, we will take reasonable steps to delete the account or relevant records.
Changes and contact
We may update this policy as the product changes, as providers change, or as new legal requirements apply. If a change materially affects you, we will communicate it clearly through the Service or by reasonable means.
This policy was last updated on October 23, 2026. We try to keep it clear and practical.
For anything about data or privacy, write to support@fewly.tech.
Related policies: Terms of Service · Refund Policy
Contact fewly
General support: support@fewly.tech
Privacy requests: support@fewly.tech
Abuse and security reports: abuse@fewly.tech
Related policies: Terms of Service · Privacy Policy · Refund Policy