Privacy Policy

Welcome to Go2Ln (“Go2Ln”, “we”, “our”, or “us”). We operate the website https://go2ln.com and associated redirection endpoints (including short domains such as gd.is, g2ln.com, and g2ln.us), providing an all-in-one link management platform that includes URL shortening, dynamic QR code generation, link-in-bio profile pages, and comprehensive link analytics (collectively, the “Service”).

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you register for an account, use our dashboard, configure branded domains, or simply interact with/click a link processed through our platform.

1. Information We Collect

We process information in two capacities: as a Data Controller (for our direct account holders and site visitors) and as a Data Processor (handling click stream and redirection data on behalf of our users who share short links).

A. Information You Provide Directly (Account Holders & Visitors)

• Account Registration: When you create an account, we collect your name, email address, password (stored hashed and salted), and account role/tier.
• Billing Information: If you subscribe to a paid tier, your credit card number, expiration date, and billing address are collected and processed directly by our third-party PCI-DSS compliant payment gateways (e.g., Stripe). Go2Ln does not store full payment card details on its servers.
• User Content: Original destination URLs, custom slugs/aliases, link-in-bio content (titles, text, uploaded media, linked buttons, themes), and custom QR code parameters (logos, styling colors, design attributes).
• Custom Domain Records: DNS verification entries, SSL certificates, and custom apex/subdomain mappings linked to your account.
• Customer Support: Inquiries, feedback, and diagnostic details sent via our support forms or contact emails.

B. Link Interaction Data (End-Users Clicking Short Links)

When someone accesses a link shortened by Go2Ln (e.g., go2ln.com/slug or gd.is/slug) or scans a Go2Ln-generated QR code, our servers collect transmission logs required to perform the redirect and generate aggregated analytics for the link creator:

• IP Address: Processed in volatile memory to detect abuse, protect against DDoS attacks, and compute approximate, non-exact geographic location (country, region, and city). Raw IP addresses are truncated or anonymized in long-term log storage.
• Timestamps: Exact date and time of the redirection.
• Referring URLs: The webpage, application, or platform where the short link was embedded or clicked.
• Device & Client Headers: Browser family and version, operating system, device category (desktop, mobile, tablet), and preferred system language.
• Destination Payload: The final redirect target URL.

C. Automated Site Technologies (Cookies & Local Storage)

We use session cookies and local browser storage to keep you authenticated in your account, remember theme and interface preferences, maintain anti-CSRF tokens, and analyze aggregate web traffic.

2. How We Use Your Information

We process personal data for the following lawful business purposes:

• Providing the Core Service: Executing real-time 301/302 link redirections, generating functional dynamic QR codes, serving public link-in-bio landing pages, and enforcing custom domain rules.
• Generating Link Performance Metrics: Compiling aggregated, non-personally identifiable analytics (clicks over time, geographic distribution, referring sources, browser share) displayed inside the user dashboard.
• Account Administration & Billing: Managing signups, authenticating logins, provisioning subscription limits, generating invoices, and enforcing plan usage caps.
• Platform Security & Fraud Prevention: Detecting, blocking, and mitigating phishing attempts, malicious redirects, spam URLs, automated bots, crawling abuse, and denial-of-service vectors.
• System Communications: Sending service alerts, password reset emails, transactional receipts, updates regarding downtime or API upgrades, and security warnings.

3. Legal Bases for Processing (GDPR & International Frameworks)

If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland, our processing relies on the following legal bases:

• Contractual Necessity (Art. 6(1)(b) GDPR): Processing required to deliver our SaaS services, fulfill subscription agreements, manage user accounts, and execute redirections.
• Legitimate Interests (Art. 6(1)(f) GDPR): Securing our infrastructure, preventing link fraud/phishing, generating aggregate platform telemetry, and improving system performance.
• Legal Obligation (Art. 6(1)(c) GDPR): Retaining accounting, financial transaction, and tax records to comply with applicable statutory laws.
• Consent (Art. 6(1)(a) GDPR): Where required for optional marketing communications or non-essential browser tracking cookies.

4. How We Share and Disclose Information

Go2Ln does not sell, rent, monetize, or trade personal information to data brokers or advertising exchanges. Information is disclosed solely in the following operational scenarios:

• Third-Party Service Providers (Sub-Processors): We work with cloud infrastructure, hosting providers, transactional SMTP delivery services, and payment gateways strictly under contractual instructions to maintain service uptime and account billing.
• Abuse & Phishing Prevention: We may cross-reference submitted destination URLs against public and private threat databases (such as Google Safe Browsing and anti-phishing networks) to verify link safety.
• Compliance with Legal Inquiries: We may disclose data if required to do so by lawful subpoena, court order, or binding regulatory mandate, or where necessary to investigate violations of our Terms of Service.
• Business Transfers: If Go2Ln undergoes a merger, acquisition, restructuring, or asset sale, user account records will be transferred as part of the business assets under equivalent confidentiality protections.

5. Cookies and Tracking Technologies

You can adjust cookie settings directly inside your web browser. We categorize browser cookies into:

• Essential Cookies: Critical for user login authentication, account session state, and security validation (e.g., CSRF protection). The site cannot function properly without these.
• Functional & Preference Cookies: Save settings such as dashboard layouts, preferred default domains, or dark/light display preferences.
• Analytics Cookies: Anonymous aggregate telemetry tracking homepage conversions and platform page performance.

Link redirection hops through go2ln.com or gd.is do not rely on intrusive third-party cross-site advertising cookies.

6. Data Retention

• Account Data: Maintained as long as your Go2Ln account remains active. Upon voluntary account deletion or written closure request, associated personal identifiers, shortened links, and custom bio profiles are removed or permanently anonymized within thirty (30) days, except where financial, tax, or legal obligations mandate longer storage.
• Click Stream & Analytics Data: Raw server request logs containing IP addresses are truncated, rotated, or purged within ninety (90) days. Aggregated performance counters (total clicks, country totals, referrer totals) remain associated with the link metadata inside the creator’s dashboard until the link or account is removed.
• Abuse & Blocklist Records: Known malicious destination URLs, abusive patterns, and offending IP ranges are retained indefinitely in security blocklists to shield the network and the general public from ongoing threats.

7. Security Measures

We maintain technical and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, or alteration:

• Transport Layer Security (TLS/HTTPS) encryption for all public site traffic, admin portals, and redirection routes.
• One-way cryptographic hashing (e.g., bcrypt/Argon2) for user account passwords.
• Network-level firewalls, rate limiting, and automated bot screening to deter brute-force exploitation.
• Routine security auditing and administrative access restrictions based on the principle of least privilege.

While we apply rigorous industry safeguards, no method of transmission over the Internet or electronic storage is completely invulnerable; we cannot provide a guarantee of absolute security.

8. Your Data Protection Rights

Depending on your geographic location (including under GDPR, UK GDPR, or the California Consumer Privacy Act / CCPA), you hold specific statutory rights regarding your personal information:

• Right to Access & Portability: Request a copy of the personal data we hold about you in a clear, structured, and machine-readable format.
• Right to Rectification: Update or correct inaccurate or incomplete profile details directly through your account dashboard or by contacting us.
• Right to Erasure (“Right to Be Forgotten”): Request the permanent deletion of your account, created links, and stored personal profile data.
• Right to Restrict or Object to Processing: Object to or restrict specific forms of data processing under eligible legal grounds.
• Right to Non-Discrimination: You will not be penalized, denied features, or charged differential rates for exercising your privacy rights.
• Right to File a Complaint: You may lodge a complaint with your local data protection supervisory authority regarding our data practices.

To exercise any of these rights, contact us at privacy@go2ln.com. We verify requester identity before fulfilling substantive data requests.

9. Children’s Privacy

Go2Ln is a general-audience business utility intended for individuals who are at least 16 years of age (or the minimum legal age of digital consent in your jurisdiction). We do not knowingly collect, process, or target personal data from children. If we discover that personal data from an underage child has been inadvertently collected, we will take immediate steps to delete the information.

10. Third-Party Links & User Destinations

Shortened links created on Go2Ln redirect visitors to independent third-party websites outside of our control. Go2Ln is not responsible for the privacy practices, content, cookie behaviors, or data governance of destination websites operated by link owners. We encourage end-users to inspect destination domain safety and review third-party policies prior to disclosing personal details.

11. International Data Transfers

Our servers and core operational resources may be located in regions outside your state, province, or country of residence. Where data originating from the EEA, UK, or Switzerland is transferred internationally, we ensure adequate protections are implemented through Standard Contractual Clauses (SCCs) or verified adequacy frameworks to safeguard your privacy rights.

12. Updates to This Policy

We may modify or revise this Privacy Policy periodically to reflect technological adjustments, functional feature releases, domain architecture changes, or evolving regulatory obligations. Any revisions become operative once posted on this page with an updated “Last Updated” date.

13. Contact Us

If you have questions, privacy inquiries, data subject requests, or security disclosures regarding this policy or our platform practices, contact our team: