Privacy Policy
xxsml.com is a short-link, QR code and link-analytics service. This page explains what we collect, why, who else sees it, and what you can ask us to do. There are two groups of people it covers: customers who have an xxsml account, and visitors who click or scan a link an xxsml customer created.
Information about customers
- Account details: your email address and name, used to sign you in with a one-time email link. We do not store passwords for sign-in.
- Content you create: links, destinations, QR code styling, any logo you upload, link-in-bio pages, survey questions, team members, custom domains and webhooks.
- Billing: payments are handled by Stripe. We receive your Stripe customer and subscription identifiers, plan and add-ons, and billing status. We never see or store your full card number.
- Messages you send us: if you use the contact form we store your name, email, business name and message, plus a one-way hash of your IP address used for rate limiting.
- Session cookie: a cookie keeps you signed in (up to 30 days of activity) and protects forms against cross-site request forgery. We do not use advertising or tracking cookies on xxsml.com itself.
Information about visitors who click or scan a link
When someone opens an xxsml link, we record a click event so the link's owner can see how it performs:
- time of the click;
- approximate location (country and city), derived from the connection;
- device type, operating system and browser, derived from the user agent;
- the referring page, if the browser sends one;
- a one-way SHA-256 hash of the IP address and of the user agent. We do not store the raw IP address or user agent text in click records, and we use the hashes only to recognise repeat traffic and filter bots.
Link owners see this as aggregate analytics and can export it. We do not sell visitor data or use it for our own advertising.
Some link owners enable optional features that collect more. A link with survey on scan shows the visitor questions and stores the answers the visitor chooses to give. A link-in-bio page may include a lead-capture form that stores what the visitor types. Owners can also add Meta, Google Ads or TikTok retargeting pixels; if so, that provider receives the visitor's page view and handles it under its own privacy policy. These features are configured by the link owner, who is responsible for telling their visitors and obtaining any consent the law requires. The visitor-facing page of these features is the owner's, not ours.
How we use information
- to provide, secure and support the service, including sign-in, redirects, analytics, QR generation and billing;
- to detect abuse, such as links pointing to malware or phishing, and automated traffic;
- to send service email (sign-in links, billing and account notices). We do not send marketing email to visitors.
Who we share it with
We do not sell personal information. We use these service providers to run xxsml, and they process data only for us: Stripe (payments), Maileroo (transactional email) and our hosting providers. A link owner's own analytics and webhook destinations receive the data for that owner's links. We may disclose information if required by law or to protect against fraud or abuse.
Retention
We keep account data and click records for as long as the account is active. Analytics views show a limited history window depending on the plan, but the underlying records are kept until the owner deletes the link or the account. When a link is deleted its click records are deleted with it. After an account is closed we delete its data, except billing records we must keep for tax and accounting and backups that expire on their normal rotation.
Security
All traffic uses HTTPS. Sign-in links expire after 15 minutes, uploaded images are checked for malware, and click records store hashes instead of raw IP addresses. No system is perfectly secure, so we cannot guarantee absolute security.
Your choices and rights
Customers can edit or delete their links and content in the dashboard, and can ask us to export or delete their account. Visitors whose data appears in a click record can ask us to look up and delete it, although because we store only hashes we may need the link and approximate time to find it. Depending on where you live (for example, in the EU, UK or California) you may have additional rights to access, correct or delete your data; we will honor those requests. To make a request, use the contact form at xxsml.com and mention "privacy".
Children
xxsml is for businesses and is not directed to children under 13. We do not knowingly collect their personal information.
Changes
If we change this policy we will update the date above and, for material changes, notify account holders by email.
Contact
Enthropic Data LLC — use the contact form at xxsml.com.