01 · Data controller
UTMTrackly is a project of Playground. di Tano Giuseppe, VAT no. 02610410694, based in Vasto (CH), Italy (“Playground.”, “we”), the controller of the data described in this policy.
For any privacy question or to exercise your rights, write to hello@atipicaplayground.com.
02 · Who this policy is for
This policy covers three different situations:
- Visitors to the site utmtrackly.com, including people who use the free UTM link builder.
- Users of the platform, that is people with an account on app.utmtrackly.com.
- People who open a short link or scan a QR code created with UTMTrackly (for example get.utmtrackly.com/…).
03 · What data we process
Public site
The free UTM link builder runs entirely in your browser: the URLs and parameters you type are not sent to our servers. The site uses no analytics, advertising or profiling tools, and fonts are loaded from our own domain, with no external services.
As with any website, the network that delivers it (Cloudflare, see below) processes technical connection data, such as IP address and browser type, to deliver the pages and protect them from attacks.
Platform accounts
- Account data: email, name (optional), organization and role.
- Password: never stored in plain text, only as an irreversible cryptographic hash (scrypt).
- Sign-in sessions: for each connected device we record only a generic label (for example “Chrome · Windows”), the sign-in date and the last activity. We do not keep the full user agent.
- Activity log: relevant actions such as changing a link’s destination or the time zone, with date and author, for security and transparency towards the organization.
- Content you enter: links, campaigns, folders, templates, QR codes and any uploaded logos.
Short link clicks and QR code scans
When someone opens a short link we record, to provide analytics to the customer who created it:
- date and time;
- country, estimated from the IP address at the time of the click;
- device type, browser family and operating system family;
- the domain of the referring site (for example instagram.com), without the full path;
- whether the visit looks automated (a bot), to exclude it from the analytics;
- a daily pseudonymous identifier, computed with a secret key that changes every day and is then destroyed, used only to count the day’s unique visits.
The IP address is not stored, nor is the full user agent, and we use no cookies on short links. The country is estimated with a database installed on our servers (DB-IP) or with information provided by Cloudflare, without sending the IP to other services.
Service emails
For team invitations, password recovery and security notices we process the recipient’s email address and the content of the message.
Cookie preferences
If you accept or reject cookies through the banner, we record your choice, the date and a random identifier, so that consent can be demonstrated. See the Cookie policy.
04 · Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the site and the platform, managing accounts, organizations and subscriptions | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) |
| Computing short link analytics for the customer who created the links | Processing on behalf of the customer (see “Roles”); for our part, legitimate interest in providing the service (Art. 6(1)(f)) |
| Security, prevention of abuse (phishing, malware, spam) and protection from attacks | Legitimate interest (Art. 6(1)(f)) |
| Sending service emails | Performance of the contract (Art. 6(1)(b)) |
| Recording cookie preferences | Legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1)) |
| Tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data, we do not use it for advertising and we do not send marketing messages without your consent.
05 · Roles: controller and processor
For click data on short links and QR codes created by a customer organization, the customer is the controller, deciding which links to create and how to use the analytics, and Playground. is the processor (Art. 28 GDPR). Our mutual commitments are set out in the Terms of service.
If you clicked a company’s link and want to exercise your rights, you can contact that company or write to us: we will forward the request.
06 · How long we keep it
- Accounts and content: for as long as the account exists; deleted within 30 days of closure, unless the law requires otherwise.
- Sign-in sessions: up to 30 days, renewed when you use the platform; they end immediately when you sign out or disconnect them from your profile.
- Individual clicks: 13 months (395 days), a period the organization can shorten. After that only aggregated totals by day, country or device remain, which cannot be traced back to individuals.
- Unique-visit key: destroyed after one day, so the daily identifier can no longer be reconstructed.
- Activity log: for as long as the organization exists.
- Database backups: 14 days.
- Accounting records: 10 years, as required by law.
07 · Who we share it with
Data is processed by us and by the following providers, appointed as processors under Art. 28 GDPR, only to the extent needed for their service:
- Keliweb S.r.l. (Italy): platform servers, in a data centre in Italy.
- Cloudflare, Inc. (USA): DNS, site delivery, attack protection and hosting of the public site.
- Brevo (Sendinblue SAS, France): sending service emails.
- Supabase, Inc.: record of cookie preferences for Playground’s banner.
The DB-IP country database is installed on our servers and receives no data. We may disclose data to authorities only where required by law.
08 · Transfers outside the EU
Some providers, such as Cloudflare, are based in the United States. In these cases the transfer relies on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission, together with the additional safeguards offered by the providers.
09 · Your rights
At any time you can ask to access your data, correct it, erase it, restrict its processing, object to processing based on legitimate interest, receive it in a portable format and withdraw any consent given (Arts. 15-22 GDPR). Write to hello@atipicaplayground.com: we will reply within one month.
You can manage much of your data yourself from your platform profile: name, password and active sessions. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the country where you live.
10 · Security
We protect data with appropriate technical and organizational measures, including:
- connections that are always encrypted (HTTPS);
- passwords stored only as cryptographic hashes;
- sessions with random tokens, stored in the database only as hashes;
- separation of data between organizations at database level;
- a server reachable only through Cloudflare’s protected network, with technical access only via cryptographic key;
- daily backups.
11 · Changes
We may update this policy, for example when we add features or providers. The version in force is always the one published on this page, with the update date at the top. We notify platform users of important changes by email or in the dashboard.