Get a quote

Privacy Policy

Last updated: October 1, 2026

This Privacy Policy describes how INTELSO SARL (operator of ShortU, accessible at stu.cm, Yaoundé, Cameroon) collects, uses, stores and protects your personal information when you use our URL shortening, link management and click analytics platform. By using ShortU, you consent to the practices described in this policy.

1. Data Controller

The data controller for your personal information is:

2. Data We Collect

We collect the following personal data:

2.1 Account data (provided by you)

  • Required: email address, username, password (stored as a bcrypt hash — never in plain text).
  • Optional: first name, last name, biography, profile photo (avatar), custom QR logo.
  • Social login: if you sign in via Google, LinkedIn, Twitter/X or Facebook we receive your name and email address from the provider, according to the permissions you grant.

2.2 Link data (the links you create)

  • The long URL you shorten;
  • The title, custom code, expiry date, password, click limit or redirect rules you set;
  • The date and time the link was created.

2.3 Click data (collected automatically)

When a visitor clicks one of your short links, we record:

  • Country of origin — derived from IP address using the MaxMind GeoLite2 database;
  • Device type — mobile, tablet or desktop;
  • Browser — Chrome, Firefox, Safari, Edge, etc.;
  • Operating system — Windows, macOS, Android, iOS, etc.;
  • Referrer domain — the website from which the visitor clicked the link.

We do not store full IP addresses in an identifiable form. The IP address is used only to derive the country and is then immediately removed from our processing logs. The uniqueness cookie (see section 4) is anonymised and contains no personally identifiable information.

2.4 Payment data

When you subscribe to a paid plan, payment information (card numbers, mobile money account identifiers) is processed directly by our payment providers (CinetPay, Campay, MTN MoMo, Orange Money or another active USSD operator). We never store card numbers or PINs.

We retain only: the amount, currency, plan subscribed, payment method (online or USSD), provider name and transaction status (pending / validated / rejected).

2.5 Service usage data

  • Request logs (date/time, endpoint called, HTTP response code) — retained for 90 days for security and debugging;
  • Language preference (session cookie);
  • API tokens created (SHA-256 hash only — the raw token is never stored).

3. Purposes of Processing and Legal Bases

PurposeLegal basis
Providing, maintaining and improving the ShortU servicePerformance of contract
Displaying click analytics for your linksPerformance of contract
Sending transactional emails (activation, password reset, expiry alerts)Performance of contract
Processing payments and sending billing notificationsPerformance of contract
Detecting and preventing abuse, spam and malicious link sharingLegitimate interest (platform security)
Responding to your support requestsLegitimate interest / consent
Compliance with legal obligations (reporting to authorities)Legal obligation

4. Cookies and Similar Technologies

ShortU uses the following types of cookies:

CookiePurposeDuration
sessionidMaintaining your Django login sessionUntil browser closes, or 14 days (if "remember me")
csrftokenProtection against CSRF attacks1 year
django_languageRemembering your language preference (FR/EN)1 year
su_visit_[code]Unique visit counting for your short links (one cookie per link)30 days

We use no advertising cookies and no third-party tracking cookies (Google Analytics, Facebook Pixel, etc.).

5. Sharing Data with Third Parties

We do not sell, rent or trade your personal data. We may share your data only in the following cases:

  • Payment providers (CinetPay, Campay, MTN, Orange) — only the data necessary for billing;
  • Email delivery services (configured SMTP) — only your email address and transactional email content;
  • MaxMind GeoLite2 — a local database installed on our servers; no IP address is sent to third parties;
  • Legal authorities — only when required by Cameroonian law or by order of a competent court;
  • Successors — in the event of a merger, acquisition or asset sale, data may be transferred, with prior notice.

6. Data Retention

Data typeRetention period
Account dataUntil account deletion + 30 days for permanent removal
Click data30 days (Free) / 365 days (Starter) / Unlimited (Pro)
Payment data7 years (Cameroonian accounting legal obligation)
Request logs90 days
Contact emails2 years

7. Data Security

INTELSO SARL implements the following security measures:

  • HTTPS — all communications between your browser and our servers are encrypted via TLS 1.2+;
  • Password hashing — your passwords are hashed with bcrypt before storage;
  • API tokens — stored as SHA-256 hashes only;
  • CSRF protection — all forms and mutating API requests are protected by a CSRF token;
  • Rate limiting — excessive login attempts and API calls are automatically blocked;
  • SSRF protection — shortened URLs are validated to prevent redirects to internal network addresses;
  • Encrypted backups — database backups are encrypted and stored off the production servers.

No method of transmission over the Internet is 100% secure. In the event of a data breach likely to affect your rights, we will notify you within 72 hours of detection.

8. Children's Privacy

ShortU is not directed at children under 13 years old. We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has provided us with personal data, contact us at support@stu.cm and we will delete that data promptly.

9. Your Data Rights

Under applicable data protection laws (including Cameroonian law and CEMAC regulations), you have the following rights:

  • Right of access — obtain a copy of the personal data we hold about you;
  • Right to rectification — correct inaccurate or incomplete data from your profile settings;
  • Right to erasure — request deletion of your account and associated data;
  • Right to restriction — request that we restrict processing of your data in certain circumstances;
  • Right to portability — receive your link data in a structured format (CSV) via the export feature;
  • Right to object — object to certain processing based on legitimate interest.

To exercise these rights, use your dashboard settings or contact us at support@stu.cm. We will respond within 30 days.

10. International Data Transfers

Our servers are hosted in Cameroon and/or in data centres located in Europe. Any transfer of data outside Cameroon is subject to appropriate safeguards in accordance with applicable regulations.

11. Changes to This Policy

We may update this Privacy Policy at any time. For material changes affecting your rights we will notify you by email or by a prominent on-site announcement at least 14 days in advance. The last updated date is shown at the top of this page. Continued use of ShortU after the effective date constitutes your acceptance of the revised policy.

12. Contact and Complaints

For any questions about this Privacy Policy or to exercise your rights:

If you believe that the processing of your data violates applicable law, you have the right to lodge a complaint with the competent data protection authority in Cameroon.

Terms of Use  ·  Help Center