Privacy Notice
What information ITA.TO collects, why, who receives it and how long it is kept. Last updated 29 October 2026.
1. Who we are
Privacy Operator at Oxiti Ltd, Oxiti Ltd, 5 Canon Court, Institute Street, Bolton, England, BL1 1PZ · privacy@ita.to. ITA.TO is a product and brand of Privacy Operator at Oxiti Ltd (UK company number 15228422; Companies House record).
Customers who use ITA.TO to collect information about their own visitors or recipients (for example through protected links, email codes or conversion tracking) decide why that information is collected and are responsible for their own notices. See the Terms of Service.
2. Information we collect and why
| Information | Why | Retention |
|---|---|---|
| Account holders and team members | ||
| Name, email, password hash, verification status, timezone; display name, job title, workspaces and roles; optional two-factor authentication secret (encrypted) and recovery codes (stored only as keyed hashes) | Account, sign-in, security and collaboration | While the account is active; reviewed on an erasure request |
| Passkeys. If you add a passkey we store its public key, a name you choose, when it was added and last used, and a counter that detects copied keys. The private key never leaves your device or password manager. | Letting you sign in without a password, and detecting misuse | Until you remove the passkey or close the account |
| Saved QR codes. Only if you press Save: the kind of code, the name you give it, what you typed into it (for example a contact's details or an email address), how you styled it and, if you added one, a small copy of your logo. A WiFi password is never saved. Codes you do not save are made in your browser and never sent to us. | Letting you reopen, change and download your own codes | Until you delete the code or close the workspace |
| Hosted pages and what visitors send to them. If you make a page (a business card, link page, video, app link, sign-up form, review page or coupon) we store its content. If a visitor uses a sign-up form we store the details they enter and the wording they agreed to; a rating and any comment; or the coupon code they asked for. The workspace that made the page decides why and how those details are used and is responsible for its own privacy notice (the form links to it); ITA.TO stores them on that workspace's behalf. We do not set cookies on a page except the one a visitor asked for when claiming a coupon. | Showing the page, and giving the workspace its sign-ups, feedback and coupon records | Sign-ups and ratings are deleted automatically after 365 days; coupon codes and pages until the page or workspace is deleted |
| Support, billing and how we look after customers. When you contact support, pay, ask for a refund or complain, our staff can see your tickets and messages, your invoices and payments, how your workspace is used, and the notes our team write about your account, in one place. To help us notice who needs help first, a computer program scores a workspace from those records and reads support messages for signs of frustration, using simple word matching in English. A person looks at the result; it never limits, charges, or contacts you by itself, and it is not used to make decisions about you. | Looking after customers, finding people who need help, preventing fraud and abuse | While the workspace exists; notes and scores are deleted with it. Billing records are kept as long as the law requires |
| Refunds and preventing repeat misuse. When someone asks for a refund we keep the request, the reason they gave, our decision and how the amount was worked out. To make sure the automatic approval of a first-payment refund is used once per person, we keep a one-way fingerprint (a hash) of the owner's email address, which cannot be turned back into the address, even if the workspace is later deleted. | Handling your request, our legal obligations for financial records, preventing abuse of refunds | Refund records as long as the law requires us to keep billing records; the fingerprint for as long as it is needed to prevent repeat misuse |
| Suggestions you dismissed. Which in-app suggestions you have closed or used, and how often one was shown, so they are not repeated. | Keeping suggestions occasional and relevant | Until you close your account |
| Login outcomes, device category and timestamps | Account security and fraud prevention | 180 days |
| Optional company OIDC identity linking: provider issuer, opaque provider-assigned subject, linking date; provider client secret stored encrypted at rest | Verify explicitly linked team members via company identity providers | Until unlinked or the configured provider/account is removed |
| Support access. When a member of the ITA.TO team opens a read-only “support view” of a workspace we record who, when, the reason they give, how many pages they viewed and how many attempted changes were blocked. The workspace’s own activity record shows it too. The view cannot change anything and cannot open private pages such as profiles, API tokens or downloads of protected files | Let customers see who looked at their workspace and why; accountability | With the workspace activity records (365 days by default); the platform record 365 days |
| Ignore-internal-traffic list. IP addresses or ranges that a workspace owner or administrator chooses to leave out of their statistics (for example an office), an optional label, and a daily total of how many visits were left out. A home address can be personal data about the person who added it. If a member chooses “don’t count this browser”, a cookie is set (see the Cookie Notice) | Keep a workspace’s own testing and internal visits out of its numbers | Until the workspace removes the entry; the daily totals while the workspace exists |
| Private AI assistant. Analytics questions and aggregate totals (without link names, destinations or visitor records); campaign and link briefs include the approved destination and allowed channels. Do not enter personal data, passwords or secrets. Processing runs on our self-hosted AI gateway; no external model inference provider is used. Suggestions require your review before any link or campaign is created. | Draft content and explain your workspace statistics at your request | ITA.TO stores assistant briefs, approved destinations, job references and results privately in its database, scoped to your account and workspace, so you can return after logging in again. Records become unavailable after 24 hours and are deleted by the retention cleanup task; backup copies follow the separate backup retention schedule. Gateway job inputs are cleared on settlement, results expire after 24 hours and job metadata is retained for 90 days. Monthly usage counters and administrator audit records are retained for operation. Backups may retain older copies until their retention expires. |
| Workspace activity records (who created, edited, rotated or deleted what) | Accountability and security | 365 days by default |
| Stripe customer, subscription, invoice, payment and refund references (we do not store card numbers) | Billing and legal records | As required by accounting and tax law |
| Support tickets and the messages in them; API tokens and AI-assistant (OAuth) grants (stored hashed) | Support and access control | While needed for the purpose; ticket content can be removed on request |
| Abuse reports you send about a link: the link, the concern you choose, any text you type, the date, and a keyed hash of your network address (we do not ask for your name or email). Our decisions about the link, and notes to its owner | Review reports, spot floods of duplicate reports, decide whether a link is unsafe, and tell the link's owner | The hashed network address is erased after 30 days; the rest 730 days after the report is resolved. Staff decisions are in an audit log kept 365 days |
| Team invitations: the invitee's email address | Let a workspace owner add a colleague | Until it is accepted, revoked or expires; removed 90 days after that |
| Email address and queued email content | Transactional and (if you opt in) product emails | Sent mail removed after 30 days; failed mail after 90 days (its text is discarded after 7) |
| Privacy request details and your explanation | Evidence that we responded | 365 days by default, subject to legal holds |
| Cookie choices: a random identifier, time, the categories you accepted, banner version and page path. No IP address, no browser details, no account link | Show that your cookie choice was recorded and respected | 730 days |
| Customer content | ||
| Link destinations, titles, aliases, campaigns, placements, QR designs, branded domains, logos and access-page wording | Provide the service | While the workspace keeps them |
| QR rotation history: generation numbers, status, who rotated or retired a code and when, the optional reason you type, and counts of scans that reached a retired code | Show you the history of each printed code | With the campaign. Scan totals of a retired code are frozen and kept even after raw visit events are pruned |
| Link health checks. Our servers visit a link’s destination now and then (about hourly, from the name “ITA.TO-LinkHealth”) to see whether it still works, whether it redirects somewhere new, and whether the domain or certificate has a problem. We keep the result (web status, the website it ended on, response time, a short description) for the latest 30 checks of each link, and an optional backup destination you choose. The website at the destination can see these visits in its own logs | Warn you about broken or hijacked links and, if you choose, switch to your backup | The latest 30 checks per link; removed with the link |
| Protected files: the file (encrypted), its name, type, size and checksum. When malware scanning is on, file content is passed to the scanner | Deliver the file under your access rules | Until you delete it: access stops at once and the stored copy is removed afterwards |
| Visitors and recipients of customers’ links, QR codes and files | ||
| Time of each link click or QR scan, broad operating-system and browser family, device category, referrer hostname, approximate country (only when delivered through a verified Cloudflare edge), campaign labels. No IP address or full user agent is stored. | Campaign analytics and troubleshooting | 90 days |
| Fair counting. To stop one visitor or script from inflating a workspace’s counts, the service keeps a temporary, keyed one-way fingerprint of the link, the visitor’s network address, browser name and language, for at most one hour, and a per-link tally for five minutes. The address and browser name themselves are not stored. | Keeping analytics and plan allowances accurate, and protecting the service from abuse | 1 hour |
| Optional screen size, connection category and processor-core count, if the visitor ticks the box on a protected access page | Extra aggregate analytics | Part of visit events (90 days) |
| Recipient email addresses and one-time codes entered on protected links (codes are stored only as a keyed hash) | Verify a recipient before releasing a link or file | Codes are deleted when they expire, or one day after use. Access events: 90 days |
| File-access grants: the recipient’s email (if verification was used), time, and whether the transfer was streamed or interrupted | Control and record file delivery (does not prove the file was opened or kept) | Deleted 7 days after the grant expires |
| Optional /t/ advertising gateway choice: whether a visitor allowed the listed advertising vendors, vendor names, and link identifier. No visitor IP or stable identity is saved in the choice record. | Demonstrate that advertising scripts were gated behind a visitor choice | 365 days (daily pruning task required) |
| Conversion events your systems send us (type: purchase, lead or signup; amount and currency; your own event ID) | Conversion reporting for the workspace that sent them | While the workspace keeps the campaign |
| Security of the service | ||
| Keyed-hash network tokens derived from IP addresses, and rule codes | Abuse prevention and incident diagnosis | 30 days by default |
| Cloudflare Turnstile result (where enabled); we do not intentionally keep challenge tokens | Stop automated registration, sign-in and form abuse | See Cloudflare’s own retention |
3. Optional integrations a workspace may switch on
- Google Analytics 4 forwarding. When a workspace enables it, we send Google a customer-supplied client ID, the event name and, for purchases, a transaction ID, currency and value. Nothing else about the visitor is sent.
- Webhooks. A workspace owner can send event notices (link visited, conversion recorded) to a URL they choose. We do not control what that recipient does with them.
- Company identity providers. If an administrator enables OIDC, sign-in redirects to the configured employer identity provider (for example Microsoft Entra ID, Okta or Google). We keep an opaque account subject and encrypt the client credential; identity provider accounts remain managed by that organisation.
- Optional Meta, Google Ads and TikTok tags. Only if a workspace enables supported advertiser IDs and a visitor chooses the dedicated /t/ gateway URL, a separate page describes those vendors and asks for advertising consent. The first page loads no advertiser tags; on explicit opt-in the listed vendor tags can load and independently receive browser/device data and set cookies. Ordinary short-link redirects are unaffected. The workspace that switches it on is responsible for the advertising (it decides to use the vendors and supplies the privacy notice linked from the choice page, the vendor agreements, and instructions for withdrawing); ITA.TO provides the choice page, records the choice and loads nothing before it. The choice page offers “Continue without advertising tracking” first, and declining never affects access to the destination. A choice is not remembered between visits, so you are asked each time.
- Self-hosted AI. The private assistant processes requested analytics summaries or approved campaign/link inputs on our AI infrastructure. It does not use OpenAI, Claude or another external inference API. Hosting and network providers still process service traffic. Statistics and rule-based findings work without AI. Model interpretations can be wrong; check the recorded figures and review every draft.
- Link health monitoring. Described in the table above. It only fetches destinations of links in workspaces whose plan includes it, and sends alert emails to that workspace’s owners and administrators.
- Browser extension. If a team member installs the optional ITA.TO extension, it keeps their API token on that computer only and sends the address and title of the page they choose to shorten to ITA.TO. It has no analytics. Its own privacy policy is in the extension’s store listing.
- Zapier and Make automation. If a workspace chooses to connect an app using an API token or webhook receiver, data it authorises can be sent to that chosen app, under its own privacy and data protection terms. ITA.TO does not connect an account automatically.
- Google tag (measurement). If we have configured one, it is not requested until you accept Analytics or Marketing in the cookie banner, and Google Consent Mode signals start as “denied”. See the Cookie Notice.
- Destination safety checks. Every destination is checked automatically: against our own blocklist of hosts and domains, and by a rule-based score computed from the text of the web address alone (we do not fetch the page); where enabled, also against Google Web Risk. A link that scores high, or that several independent people report, shows visitors a warning page before they continue. Blocking a link, or pausing a workspace's ability to create links, is decided by a person, who can be asked to review it (open a support ticket). See the abuse policy.
- External file storage. Encrypted files are held on our servers or, if configured, an S3-compatible store. Files are encrypted before they leave the application.
4. Lawful bases
Contract may support account and service processing; legitimate interests may apply to security, fraud prevention and proportionate analytics, subject to an assessment; legal obligations apply to billing records. Separate consent may be needed for optional marketing emails (these are opt-in with one-click unsubscribe) and for any optional tracking. Specific bases for each activity will be confirmed with counsel before this notice is finalised.
Proposed bases for the newer features (to be confirmed with counsel): link health checks and ignoring a workspace’s own traffic: legitimate interests in accurate statistics and reliable links, with a short retention and a right to object; AI explanations: providing the service you ask for (contract) with your question sent only when you submit it; advertising tags on a /t/ page: your consent, given by choosing “Allow” and withdrawable by blocking or deleting the vendors’ cookies and using the vendors’ own controls; company sign-in: legitimate interests of the employer that configured it and the contract with that workspace.
5. Who receives information
We use service providers to run ITA.TO. The providers named in our records are: our hosting provider, Cloudflare (network proxy and Turnstile), Stripe (billing), and our email delivery provider (MXroute). Google receives data only through the optional integrations in section 3. Our self-hosted AI infrastructure receives the requested inputs described in section 2; our hosting and network providers handle this traffic. Meta, Google Ads and TikTok receive data only if a visitor chooses “Allow” on a customer’s /t/ page. An identity provider (such as Microsoft Entra ID, Okta or Google) is involved only if a workspace configures it. A workspace’s own destination websites, and any Zapier or Make app it connects, receive what that workspace sends them. The exact providers, their locations and contracts will be confirmed before this notice is finalised. We disclose information when the law requires it.
6. International transfers
Where a provider processes data outside the UK, we will document the transfer mechanism that applies. This section will be completed once provider locations are confirmed. The location of our AI hosting and network processing must be included in these provider records; self-hosting does not by itself guarantee that all processing stays in the UK. Advertising vendors that a visitor allows may process data worldwide under their own terms. We keep encrypted backups of the database and stored files for about 14 days before the oldest is replaced. Erasing something in the product does not instantly remove it from backups already made, but it disappears from them as they expire. Hosting logs follow the host's own lifecycle.
7. Cookies
Ordinary short-link redirects and QR scans set no cookie. A separately configured /t/ advertising gateway instead presents a visitor choice: continue without tracking, or explicitly allow the listed advertiser tags on the next page. These optional advertiser tags are distinct from this website's normal cookie banner. To withdraw advertiser cookies already placed, use the advertiser and browser cookie controls described in the linked client privacy notice. A workspace administrator who presses “don’t count this browser” in Settings gets one small cookie for that purpose. Link health checks and AI explanations use no cookie or browser storage. On ITA.TO marketing and account pages, optional cookies and similar storage are off until you accept them in the cookie banner; you can change this site choice at any time from “Cookie settings” in the footer. The details are in the Cookie Notice.
8. Your rights
You may ask for access, correction, erasure, restriction, objection or portability as applicable. Signed-in users can start a request from the Privacy centre (which also offers an export of your account data); anyone can write to privacy@ita.to. We will tell you about any exemption, legal retention or identity check that applies. If you are unhappy, you can complain to the UK Information Commissioner’s Office (ico.org.uk).
If your information was collected by a customer through one of their links, QR codes or files, please contact that customer too; they decide how it is used.
9. Changes
We will update this notice when our processing changes and tell account holders about material changes. This notice is not proof of compliance.