Privacy policy

Who is responsible?

TIPIT SRL, Rue Médart, Forv. 3 bte B, 5380 Fernelmont, Belgium (CBE 1007.088.147), is the controller of your account data and of this site. For any question: contact@bref.timour.me.

For the analytics of people who visit our customers' links, the customer organisation is the controller, and we act on its behalf (see the data processing agreement).

The data we process

Your account

• Email address, your name if you give it, sign-in identifier (through the Leaf platform).
• Your organisations, your role, the invitations sent and received (the invited person's email address).
• What you create: links, destinations, titles, tags, settings, uploaded images and logos.
• Your subscription: plan, period, payment status. Card details are handled by the payment provider and never reach us.

Visitors to your links

For every visit to a short link, we record the date and time, the link, the source (click or QR code scan), the country (derived from the network by our host), the device type, system and browser (derived from the User-Agent header), the domain of the referring site and, during an A/B test, the variant served.

We keep no IP address, no visitor identifier and no tracking cookie: this data cannot identify a person or follow them from one visit to the next.

Visitors to this site

No audience measurement tool and no advertising cookie. Your chosen language is kept in your browser's local storage.

Reports

If you report a link, we receive the link, the reason, your explanation and, if you give it, your email address.

Why, and on what basis

• Providing the service, managing your account, organisations and subscription: performance of the contract.
• Sending invitations and service messages (changes to the terms, security): performance of the contract.
• Protecting visitors and the service against abuse (checking destinations, limits, handling reports): legitimate interest.
• Keeping accounts and issuing invoices: legal obligation.

We sell no data and make no advertising use of it.

Who receives it

• Leaf and Cloudflare, Inc.: hosting of the site, database and files.
• Brevo (Sendinblue SAS, France): sending invitation emails.
• Google (Web Risk): checking destination addresses. Only those addresses are sent, never data about you or your visitors.
• The Leaf platform's payment provider, for subscriptions.
• Authorities, only when the law requires it.

Transfers outside the European Union

Some providers (Cloudflare, Google) are based in the United States. Transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

How long

• Account and content: while the account exists, then erased within 30 days of its deletion.
• Visit analytics: viewable according to your plan's history, erased at the latest 3 years after the visit, or immediately with the link or the organisation.
• Billing: for the period required by Belgian accounting and tax law.
• Reports: 12 months after they are handled.

Security

Encrypted connections (HTTPS), an organisation's data accessible to its members only, passwords of protected links stored hashed, destinations checked.

Your rights

You can ask to access, correct or erase your data, restrict its processing, receive it in a portable format (CSV export is available at any time), or object to processing based on our legitimate interest, by writing to contact@bref.timour.me. We reply within one month.

You can also lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels.

If you visited one of our customers' short links, please contact them first: they are responsible for those analytics, and we will help them answer you.

Cookies

Bref only sets strictly necessary cookies:

• the Leaf platform's session cookie, when you are signed in to the dashboard;
• a bref_pw_… cookie, for 24 hours, when you unlock a password-protected link.

No audience measurement, advertising or tracking cookie is used, neither on this site nor when redirecting short links.

Changes

We will update this policy when our processing changes. The update date is shown at the top of the page.