Privacy Policy
1. Who we are and what this covers
WebRedirect.io is a business name of Neeraj Sapkota, a sole trader based in Adelaide, South Australia (ABN [YOUR ABN]). In this policy, “we”, “us” and “our” mean Neeraj Sapkota trading as WebRedirect.io.
We run webredirect.io, a service that lets customers point their own domains or links at our servers and redirect visitors to another web address. This policy explains what personal information we collect, why, how long we keep it, and the choices you have.
It applies to two groups of people:
- Customers: people who sign up for an account and create redirects.
- Visitors: anyone whose browser follows a redirect hosted on our service, usually without knowing it passes through us.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where the EU or UK General Data Protection Regulation applies to you, we also meet those requirements, as set out in section 5.
2. Information we collect
We collect only what we need to run the service, bill for it and keep it safe.
| Who | What we collect | How we get it |
|---|---|---|
| Customers | Name, email address, hashed password, multi-factor authentication settings | You give it at sign-up |
| Customers | Billing details: name, billing address, last four digits of your card, payment history | Our payment processor; we never see or store full card numbers |
| Customers | Domains, redirect rules, API keys (stored hashed), team members you invite | You create them in the portal or API |
| Customers | Login times, IP addresses used to sign in, actions taken in your account (audit log) | Recorded automatically |
| Customers | Support emails and anything you send us | You send it |
| Visitors | IP address, date and time, requested domain, path and query string, browser user agent, referring page, preferred language | Your browser sends it when it follows a redirect |
| Visitors | Approximate location (country, region, city) and network operator, derived from the IP address | Looked up on our own server from a GeoIP database |
We do not use cookies or tracking scripts on redirects; a redirect is a single server response. The customer portal uses only essential cookies to keep you signed in and protect forms from forgery.
We do not intentionally collect sensitive information such as health, religious or political details. The service is not intended for anyone under 18.
The part of a link after a # symbol is never sent to our servers, so we cannot see or record it.
3. How we use it and how long we keep it
We use personal information to:
- run your account, provision redirects and issue TLS certificates for your domains
- show customers analytics about traffic to their redirects
- bill you and send receipts, trial and renewal notices
- detect and stop fraud, phishing, malware and other abuse of the service
- keep the service secure, fix faults and plan capacity
- answer support requests and meet our legal obligations
We do not sell personal information, and we do not use it for advertising.
Legal bases (GDPR). We process customer data to perform our contract with you. We process visitor data under our legitimate interests, and those of our customers, in operating redirects, measuring their use and preventing abuse. Billing and tax records are kept to meet legal obligations.
Retention
| Information | Kept for |
|---|---|
| Visitor hit logs (IP address, user agent, referrer, location) | 180 days, then deleted automatically |
| Account and redirect configuration | While your account is open, then 30 days after closure |
| Billing and tax records | 5 years, as Australian tax law requires |
| Security and audit logs | 12 months |
| Abuse reports and enforcement records | As long as needed to prevent repeat abuse |
| Backups | Rotated out within 30 days of the source data being deleted |
IP truncation. Customers can switch on IP truncation for any domain. When it is on, we remove the last part of each visitor’s address before storing it (the last 8 bits of an IPv4 address, the last 80 bits of an IPv6 address), so the stored address no longer points to a single device. Location is looked up before truncation, at country and region level only.
4. Who we share it with, and security
Our servers are located in Adelaide, Australia. We share personal information only with the providers below, and only what each needs:
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Microsoft (Microsoft 365) | Email for support and account notices | Customer names, email addresses, message contents | Australia and other countries where Microsoft operates |
| [PAYMENT PROCESSOR] | Card payments and subscriptions | Customer billing details | [LOCATION] |
| Let’s Encrypt (Internet Security Research Group) | Issues TLS certificates for customer domains | Domain names only | United States |
Certificates are recorded in public Certificate Transparency logs by design, so any domain you add to our service becomes publicly visible as having a certificate. Do not add domains you need to keep private.
Location lookups use a GeoIP database stored on our own server; visitor IP addresses are not sent to the database provider.
We give a customer the visitor data for their own redirects. We may also disclose information when the law requires it, to respond to valid requests from police or regulators, or to protect people from fraud, phishing or other harm.
Overseas disclosure. Some providers above store or process data outside Australia, including in the United States. We choose providers with recognised security standards and contractual privacy protections.
Security. We use TLS encryption in transit, hash passwords and API keys, support multi-factor authentication, restrict administrative access, keep systems patched, and take encrypted backups. No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
5. Your rights, complaints and contact
Everyone can ask to access the personal information we hold about them, and ask us to correct it. We respond within 30 days and do not charge for reasonable requests.
If GDPR applies to you, you can also ask us to delete your data, restrict or object to its processing, or give you a portable copy. You may complain to your local data protection authority.
Visitors. Customers decide where their redirects go and see analytics about them, so for visitor data we act on their behalf as well as our own. You can contact the website owner or us. To find hits linked to you, we will need your IP address and the approximate date and time.
Customers’ obligations. If you use WebRedirect.io for your own audience, you are responsible for telling your visitors their visits are recorded, usually in your own privacy policy, and for any consent your local law requires.
Closing your account. You can delete your account in the portal. Configuration is erased after 30 days; billing records are kept as section 3 describes.
Complaints. Email us first and we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Contact
- Privacy questions and requests: privacy@webredirect.io
- Legal notices: legal@webredirect.io
- Postal address: [PO BOX TBD], South Australia
Changes. We will post any changes here with a new date at the top. For significant changes we will email customers at least 14 days before they take effect.