Privacy Policy
Last updated: 2 November 2026
This policy explains what personal data AIToURL collects, why, and what rights you have. The data controller is [Your full legal name or company name], [Postal address] ([contact e-mail]). We apply the EU General Data Protection Regulation (GDPR).
1. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail address and profile picture from your sign-in provider (Google, GitHub) | Create and identify your account | Performance of the contract |
| Files you publish, their names, sizes, versions and download counts | Host your files and show you their stats | Performance of the contract |
| Sessions: IP address, browser and device type, sign-in time | Keep you signed in, let you see and close active sessions, protect accounts | Performance of the contract and legitimate interest (security) |
| Activity log: sign-ins, uploads, deletions, apps connected or revoked, with IP address | Show you your account history, investigate abuse and security incidents | Legitimate interest (security) |
| Apps you connect (for example Claude or ChatGPT) and the permissions you granted | Let your AI assistant use your account, let you revoke it | Performance of the contract |
| Subscription and billing details (handled by Stripe; we receive the plan, status and country, never your full card number) | Bill Pro subscriptions, meet accounting and tax obligations | Performance of the contract and legal obligation |
| Abuse reports (link, reason, optional e-mail and IP address of the reporter) | Handle reports of unlawful content | Legal obligation and legitimate interest |
People who open a public link are not tracked: we count downloads per file but do not store their IP address or build profiles. We do not sell your data, show ads or use your files to train AI models.
2. Cookies
We only use cookies that are strictly necessary for the Service: your session cookie and the security cookies used during sign-in. There are no analytics or advertising cookies, so no consent banner is needed.
3. Who processes your data
| Provider | Role | Location |
|---|---|---|
| Railway Corp. | Hosting of the application, database and file storage | Servers in the EU (Amsterdam); US company |
| Google, GitHub | Sign-in, only if you choose them | Under their own privacy policies |
| Stripe | Payments for Pro subscriptions | EU and US |
When a provider is based outside the EU, transfers are covered by the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
4. How long we keep data
- Account data: until you delete your account.
- Files: until you delete them; on the Free plan, automatically 90 days after their last download.
- Sessions: until they expire (30 days of inactivity) or you sign out.
- Activity log: until you delete your account.
- Billing records: 10 years, as required by French accounting law.
- Abuse reports: up to 1 year after they are closed.
Deleting your account (Dashboard → Security) immediately deletes your files, links, sessions, connected apps and activity log, except billing records we must keep.
5. Your rights
You can access, correct, export or delete your data, object to or restrict its processing, and withdraw any consent. Most of this is available directly in your dashboard; for anything else, write to [contact e-mail]. We answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or your local authority.
6. Security
Connections are encrypted (HTTPS). Access tokens are short-lived and stored hashed, file links are unguessable, and connected apps can be revoked instantly. No system is perfectly secure: if a breach affecting your data occurs, we will notify you and the authorities as required by law.
7. Changes
We will post any update here and notify you in the Service of material changes. See also our Terms of Service.