Privacy notice

Account and portfolio data

Shorteri stores your name, sign-in email, verification status, account role, and account timestamps. If you use Google sign-in, Google provides the account identity needed to sign you in. We do not request access to private Instagram, TikTok, or YouTube data.

Portfolio data includes your public photo URL, bio, location if supplied, pricing, categories, social links, public contact destinations, and up to three video URLs. Published profile information is visible to visitors and may be indexed or shared. Draft and pending portfolios are restricted to their owner and authorized administrators.

Essential sign-in and security

Essential cookies support secure sign-in sessions and remember your privacy choice. One-time verification codes are stored as hashes, expire after ten minutes, have limited attempts, and are sent by Resend. Application rate limits use temporary security records. Product analytics do not store raw IP addresses or browser fingerprints.

First-party marketplace analytics

We record aggregate marketplace page views, visible creator-card impressions, profile views, featured-video clicks, and contact clicks. Events may include creator ID, timestamp, source page path, referring hostname, and a coarse device category. Query strings are excluded from source paths and full referring URLs are not stored.

Basic marketplace statistics use a keyed hash of the IP address, scoped to each creator profile, to prevent repeated visits inflating view counts. We store the protected identifier, not the raw IP address, and do not combine it with browser fingerprints. This applies whether optional analytics are accepted or declined. Signed-in administrators and creators viewing their own profiles are excluded.

A unique profile view counts each protected IP identifier once per profile in the selected reporting period. Daily charts count it once each day. Shared network addresses can group different people together, while changing addresses can count one person more than once. These statistics estimate distinct network visitors, not verified people. Older visits without the current identifier are excluded from unique view totals because they cannot be reliably deduplicated.

Listing payments and invite attribution

Creator listing plans use payment orders with an amount, reference, recipient details and an administrator verification record. We do not collect card numbers or banking passwords. Referral credits and partner commissions are recorded in an audit ledger; they are separate from marketplace visitor statistics.

A first-party, HTTP-only invitation cookie keeps the original acquisition visit for up to 30 days through sign-up. This stores a signed visit identifier, not a browser fingerprint. Visits can include the original channel, invite code, UTM campaign values, landing path and referring origin/path without its query string. Once an account is created, its original source is preserved in the application database. Administrators can make logged corrections. No invitations or messages are sent automatically.

Optional Google Analytics

When configured, Google Analytics loads only after you allow optional analytics. It helps measure traffic sources and navigation. Advertising storage, signals, and personalization are disabled. Declining optional analytics disables Google Analytics; basic marketplace statistics continue as described above. No dedicated first-party visitor cookie is used. You can change your choice with “Cookie preferences” at the bottom of the page.

External contact and video providers

Contact links pass through our application, record a click, and redirect to the creator’s saved destination. We cannot observe what happens inside another platform or your email application. YouTube’s privacy-enhanced player loads when you choose to play a video. Instagram and TikTok videos may open externally. Third-party profile photos load from their supplied image hosts.

Service providers and storage

Uploaded profile photos are stored on Vercel Blob. Anyone with the image URL can view the photo, including before a profile is published. Images are resized and camera metadata is removed. Unused uploads are removed after seven days by scheduled maintenance.

The intended deployment uses Vercel for hosting, Neon PostgreSQL for persistence, Resend for account emails, and Google for optional sign-in and site analytics. Providers process the data needed for their services. The operator must finalize the applicable contracts, regional hosting decisions, and transfer notices.

Retention and requests

Product analytics events are removed after 365 days. A daily maintenance job also removes expired sessions, verification codes, and rate-limit records. The operator must review these periods for the final service.

Account and portfolio data remain while needed to operate the service. Removed profiles are hidden and approval history remains reserved so promotion eligibility cannot shift. The operator must establish retention periods and a working channel for access, correction, export, deletion, or complaints. Add the operator’s contact details before commercial launch.