Privacy policy

Under Regulation (EU) 2016/679 (GDPR) the data controller is Core Matrix s.r.l., Viale Monza 347, 20126 Milano (MI), Italia, VAT no. IT14316370965, certified email corematrix@pec.it. For any privacy request write to support@lyz.bz.

1. What data we process

• Account: name, email, password (stored only in hashed form by Firebase Authentication) or your Google profile if you sign in with Google.
• Content: the links you create (destination address, alias, title, optional expiry) and, if set, a non-reversible hash of the link password; connected custom domains; API keys (stored only as a hash).
• Billing: name or company name, tax code or VAT number, address, certified email or SDI code, payment history. Card and IBAN details are handled directly by Stripe and never reach us.
• Team (Business plan): the list of account members and active invites.
• Click statistics: for people who open a link we record aggregated data (clicks per hour, country, device type, operating system and browser, referring site, QR code scan). To count unique visitors we compute a non-reversible fingerprint of IP address and user agent with a key that changes every day: we do not store the IP and the same person cannot be linked across days.
• Technical data: IP address and request logs, for security and abuse prevention.

2. Purposes and legal bases

• Providing the Service, managing your account and team, sending service emails (verification, password reset, subscription notices): performance of a contract (Art. 6(1)(b)).
• Invoicing, tax and accounting obligations, responding to authorities: legal obligation (Art. 6(1)(c)).
• Click statistics for the link owner, security, fraud and abuse prevention, handling notices: legitimate interest (Art. 6(1)(f)), with minimised data and no profiling.

We do not sell data, do no advertising profiling and do not use content to train artificial intelligence models.

3. Cookies

We only use strictly necessary cookies: __session (sign-in session, up to 14 days) and lang (preferred language, 12 months). Link redirects and statistics use no cookies and store no identifiers in the clicker’s browser, so no consent banner is needed.

4. Where data is kept and who processes it for us

Data is stored in the European Union. We use these providers, appointed as processors or acting as independent controllers:

• Google Cloud / Firebase (Google Ireland Ltd.): application, database (Milan), authentication.
• Cloudflare (Cloudflare Inc. and affiliates): running link redirects on the edge network, custom-domain certificates, aggregated click statistics.
• Stripe Payments Europe Ltd. (Ireland): payments, as independent controller for payment data.
• TeamSystem S.p.A. – Fatture in Cloud (Italy): electronic invoicing.
• Brevo (Sendinblue SAS, France): service emails.

Some of these providers belong to groups based outside the EU: any transfers rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

5. How long

• Account and links: while the account is active; after closure links are disabled and deleted within 30 days.
• Invoices and accounting data: 10 years, as required by law.
• Daily visitor fingerprints: 400 days; aggregated statistics: up to 800 days.
• Technical logs: up to 90 days, unless needed to investigate abuse.

6. Your rights

You can request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interest by writing to support@lyz.bz. We reply within one month. You may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or the authority in your country.

7. Children

The Service is only for people aged 16 or over.

8. Changes

We update this policy when our processing changes; material changes are notified by email.