Privacy Policy · የግላዊነት ፖሊሲ

1. Introduction

EthioLink ("we," "us," "our") operates the URL shortening and analytics platform available at https://short.et (the "Service"). We are committed to protecting your privacy and handling your personal data in accordance with the Personal Data Protection Proclamation No. 1321/2024 of the Federal Democratic Republic of Ethiopia ("PDPP") and other applicable laws.

This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding your personal data. By using the Service, you consent to the practices described in this policy.

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, identification numbers, location data, and online identifiers.

Processing: Any operation performed on personal data, including collection, storage, use, sharing, and deletion.

Data Controller: EthioLink, which determines the purposes and means of processing your personal data.

Data Subject: You, the individual whose personal data we process.

3. Data we collect

3.1 Information you provide

• Account information: email address, username, password (stored as a secure scrypt hash - we never see or keep the plaintext), and full name if you give one.
• Link data: the long URLs you shorten, custom codes you select, and any titles you add.
• API usage: API keys you generate (stored only as SHA-256 hashes), the endpoints you call, and the parameters you submit.
• Team information: if you use team workspaces, the usernames or emails of members you invite.
• Payment information: when you subscribe to a paid plan we record transaction references, amounts, invoices and billing history. We do not store full payment card details - payments are processed by licensed third-party providers.

3.2 Information we collect automatically

When someone clicks a short link you created we record:

• a salted, one-way hash of their IP address (SHA-256 with a server-side salt - never the raw IP);
• the referring website's hostname;
• browser and device type, derived from the User-Agent string;
• country, derived from the visitor's IP through an offline lookup at request time. When the Service runs behind our CDN or reverse proxy we resolve the visitor's real address from the proxy headers first, so the country recorded is the visitor's and not the CDN edge's;
• a randomly assigned visitor cookie identifier used to count unique visitors.

Session data: we record login timestamps and store session tokens only as SHA-256 hashes, plus the time a session was last active. Audit logs: we keep an append-only record of actions taken on your account (for example plan upgrades and administrator decisions); the source address on those entries is stored as the same salted hash, never in the clear.

3.3 Information we do NOT collect

• Raw IP addresses - they are hashed immediately and the plaintext is never written to disk.
• The content behind shortened URLs - the Service never sees the destination page, only the URL you paste.
• Any data from children under 18.

4. How we use your data

We process your personal data only for the purposes below, each with a lawful basis under the PDPP:

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal effects without human intervention. You can withdraw consent for digests at any time in your analytics settings, and object to legitimate-interest processing as described in section 7.

5. Data sharing

5.1 Third-party processors

We share data only with the providers below, and only as much as each one needs to perform its job:

All processors are bound by data processing agreements that require them to protect your data to at least the standard set by the PDPP, and to process it only on our documented instructions.

5.2 Legal disclosures

We may disclose your data if required by law, court order, or where necessary to establish, exercise or defend our legal rights. Where lawful and practical we will tell you before doing so.

5.3 Business transfers

If EthioLink is acquired or merged, your data may be transferred as part of that transaction, subject to the same privacy protections and to continued compliance with this policy. We will give notice before your data becomes subject to a different policy.

6. Data retention

We keep data only as long as we need it:

When a retention period expires, the data is securely deleted or anonymized so it can no longer be linked to you.

7. Your rights under the PDPP

You have the following rights regarding your personal data. We answer requests within 30 days and we do not charge a fee for the first request.

7.1 Right to access

You can request a copy of all personal data we hold about you. We will provide it in a structured, commonly used, machine-readable format within 30 days. Administrators can generate the same export for your account from the console, and it is logged when they do.

7.2 Right to rectification

You can correct inaccurate or incomplete personal data through your account settings, or by contacting us at [email protected].

7.3 Right to erasure

You can request deletion of your personal data. We will honour the request unless we are legally required to retain it (for example for tax, billing or audit purposes). Note that our audit logs are pseudonymized (hashed) and may be retained as required by law; clicks are already stored with hashed IPs, so analytics cannot be traced back to an individual.

7.4 Right to restrict processing

You can ask us to restrict processing of your data in certain circumstances - for example while we are verifying the accuracy of data you have contested.

7.5 Right to object

You can object to processing based on legitimate interests, and to processing for direct marketing (including analytics digests) at any time.

7.6 Right to data portability

You can export your links and analytics data in CSV format at any time from the analytics page, or request a complete machine-readable export as described in section 7.1.

7.7 Right to lodge a complaint

You have the right to lodge a complaint with the Ethiopian Communications Authority (ECA), the supervisory authority for data protection in Ethiopia. We would appreciate the chance to resolve your concern first.

To exercise any of these rights, write to [email protected]. Please tell us which right you are exercising and, where relevant, the account or link concerned, so we can act quickly.

8. Data security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) for every request, with HSTS in production.
• Encryption at rest (AES-256) provided by the hosting platform's storage layer.
• Hashed session tokens - raw tokens exist only in your cookie and are never stored.
• scrypt password hashing with a unique per-account salt, compared in constant time.
• Hashed IP addresses for click analytics, login fingerprints and audit entries - no raw IPs are persisted anywhere.
• Access controls and audit logging - every administrator action is recorded, and privileged endpoints require an administrator session or key.
• Data minimization - we collect only what the feature needs to work.
• Regular security audits and penetration testing (an automated suite runs against every release).

No system is perfectly secure. If you believe your account has been compromised, change your password and contact us immediately.

9. Where your data is stored

Our application and database run on Google Cloud infrastructure, in a cloud region located outside Ethiopia. Google Cloud is a globally distributed provider: we host outside the country because Ethiopia has no Google Cloud region, and we say so plainly rather than claiming local-only storage.

Because personal data therefore crosses a border, we do not rely on any assumption that it stays "in country". We transfer and process it only on the bases the PDPP allows:

• your consent, given when you create your account (which you may withdraw at any time by closing your account);
• performance of our contract with you (running the Service you signed up for);
• legal obligation, where the law requires us to keep or disclose something.

Each provider listed in §5.1 is bound by a data processing agreement with confidentiality, security and breach-notification duties, and may process your data only on our documented instructions. We do not transfer personal data to anyone else.

Two infrastructure exceptions are unavoidable even for a visitor inside Ethiopia: DNS, content delivery and DDoS protection (Cloudflare) and transactional email delivery (Brevo). Both see only the minimum needed to route a request or deliver a message - Cloudflare sees an IP address for routing, and neither receives your account data, your links or your analytics.

We will update this section if our hosting region changes, and we will tell account holders by email before the change takes effect.

10. Breach notification

In the event of a personal data breach, we will notify the Ethiopian Communications Authority and the affected data subjects within 72 hours of becoming aware of the breach, as required by the PDPP. Our notice will describe what happened, what data was involved, what we have done to contain it, and what you can do to protect yourself.

11. Cookies

We use exactly two first-party cookies:

We do not use third-party advertising cookies, tracking pixels or fingerprinting scripts. Because the visitor cookie is needed to produce unique-visitor counts, disabling cookies in your browser will make analytics count each visit separately.

12. Children's privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has created an account, contact [email protected] and we will delete the account and its data.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by a prominent notice on the Service before they take effect, and the "Last updated" date at the top of this page will change. Continued use after changes constitutes acceptance.

14. Contact

Data Protection Officer
EthioLink
Email: [email protected]

For legal notices, see the Terms of Service or write to [email protected].