Privacy Policy

Last updated: 2026-08-19

1. Controller

a7.ee (the “Service”) is operated by JOSKI OÜ, Astangu tn 21/3, 13519 Tallinn, Estonia.
Contact: info@a7.ee

2. What we collect

Account data. When you register we collect only your email address and a password (stored by our authentication provider as a salted hash). We do not ask for your name, phone number or address to create an account.

Visitor data of your links. When someone opens a short link we process: the destination click, the approximate country and city (derived from the IP at the edge, then discarded — the raw IP is never stored), the browser user-agent (scrubbed after 30 days), the referrer, and an anonymous visitor hash (HMAC) that cannot be reversed into an IP address. This data is aggregated into click statistics.

Technical data. Session cookies required to keep you signed in, and standard edge logs from our hosting providers.

3. Legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — account creation and delivering the link/QR service.
• Legitimate interest (Art. 6(1)(f)) — click analytics, abuse prevention, service security.
• Consent (Art. 6(1)(a)) — where we ask for it explicitly (e.g. optional marketing, if ever offered).

4. Retention

• Click records: 400 days, then deleted.
• User-agent and referrer fields: scrubbed after 30 days.
• Account data: kept while the account exists; deletion on request.
• Aggregated statistics: kept indefinitely (no longer allow identification).

5. Your rights (GDPR Art. 15–22)

You may request access to, rectification of, or erasure of your personal data, restrict or object to processing, and receive your data in a portable format. Send requests to info@a7.ee — we respond within 30 days. You may also lodge a complaint with your national supervisory authority (in Estonia: Andmekaitse Inspektsioon, aki.ee).

Because link visitors are recorded under a non-reversible hash and the raw IP is never stored, we generally cannot identify or erase a single visitor’s click record on request; aggregate retention is time-limited instead.

6. Processors and transfers

We use the following processors: Supabase(authentication and database, EU region), Vercel(hosting/edge, EU), Mollie (payments, only when you purchase a paid plan). Data may be transferred outside the EEA where these providers use standard contractual clauses or the EU–US Data Privacy Framework.

7. Cookies

We use only strictly necessary cookies (your sign-in session and technical cookies from hosting). We do not use advertising or cross-site tracking cookies. If we ever add optional analytics or marketing cookies, we will ask for your consent first.

8. Contact

Privacy questions or data-subject requests: info@a7.ee