Privacy policy
DRAFT — not reviewed by a lawyer. This text is a draft prepared by the URLY team. A lawyer in Uzbekistan has not reviewed it yet, and it is not legal advice. Until reviewed it creates no obligations beyond those that follow directly from the law. The final version will be published before the commercial launch. In case of discrepancies, the Uzbek and Russian versions prevail.
Draft version of 14.10.2026. The operator's details will be given in the final version. Questions passed to the lawyer: L-01, L-02, L-03, L-10, L-12, L-16, L-17, L-28
Who processes the data
URLY ([details to be confirmed]) controls account data. For visit statistics of a customer's links URLY acts as a processor on the customer's behalf (see /dpa); the allocation of roles awaits review by a lawyer.
Account data
We store your email, name (if given), chosen language, role in the workspace and a password hash (Argon2id; the password itself is not stored). We do not ask for your phone number, passport data or PINFL.
Visit data
When a short link is visited we record the time, the source domain (without path or parameters), device class, OS and browser family, UTM tags and a bot flag. The full User-Agent and the IP address are not stored. The country is determined at the moment of the visit from a local GeoIP database, if one is installed; only the country code is stored.
IP address
The IP address is used in memory only: to determine the country and to protect against overload and abuse. Rate limiting uses its keyed hash, kept for a few minutes. IP addresses are not written to logs.
Cookies
The dashboard uses only necessary cookies: the session, CSRF protection and the chosen language. Short links without pixels set no cookies. On links where the customer added retargeting pixels, the visitor is asked first; see section 11 and the cookie notice (/cookies).
Purposes and legal grounds
Data is processed to provide the service under the agreement, to keep it secure and fight abuse, and to meet legal requirements. The legal grounds for each category await confirmation by a lawyer.
Retention
Account data is kept while the account exists. Detailed visit events are kept per plan for 30–730 days and then deleted automatically. Aggregates are kept longer. The email queue is purged after 30 days. Backups are kept for up to 35 days.
Recipients and storage location
Subprocessors (hosting, email delivery, backup storage) have not been chosen yet. Their list and storage country will be published before launch in line with the Law “On Personal Data” (as amended by ZRU-1125).
Your rights
You may ask to access, correct or delete your data, and withdraw consent where processing is based on consent. Write to privacy@urly.uz; we answer within the period set by law.
Incidents
In case of a personal data breach URLY notifies the competent authority and the affected people within the periods set by law.
Retargeting pixels on customers' links (draft for lawyer review, L-28)
A customer may attach pixels of Meta, Google, TikTok, Yandex, LinkedIn or VK to its links. They load only after the visitor allows them on a consent page; declining, Do Not Track and Global Privacy Control mean no pixel. The vendors then receive the page address, the time, technical browser data and their own cookie identifiers as independent recipients under their own policies, possibly outside Uzbekistan. If the customer enables server-side events, URLY sends the visit to Meta (Conversions API, including the IP address and User-Agent) or Google (GA4 Measurement Protocol, without IP) after consent; this data is kept encrypted for at most 24 hours. URLY stores only the answer (allowed/declined) and which pixels loaded, for 35 days, and aggregated counts.
Questions about these documents: legal@urly.uz. Complaints about links: Report abuse