Privacy Policy

Veezio Solutions s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, company number 23746068, is the controller of the personal data described here, within the meaning of Regulation (EU) 2016/679 (GDPR).

Write to help@routee.link with anything about your data. We answer within 30 days, as the GDPR requires, and usually much sooner.

We have not appointed a data protection officer: our processing does not meet the thresholds in Article 37 that would require one. The address above reaches the people who make these decisions.

Creators hold an account, shorten links and are paid a share of what those links earn. Visitors open a Routee link and may buy a pass. The data we hold differs a lot between the two, so this policy treats them separately.

Card numbers. Payment details go straight to Stripe and never reach our servers; we see only the last state of a payment and identifiers that point back into Stripe.

Your IP address beyond 180 days. Link opens carry the address for that window, because a card dispute is argued on where and when a service was used; after it the address is erased and only the keyed hash remains, which cannot be turned back into an address without a key we do not store beside it. Nothing else we keep holds a raw address.

Passwords. There are none - you sign in with a one-time code, a passkey, or Google.

routee_session keeps a creator signed in. It is set only after you sign in, lasts 30 days, and is HTTP-only.

routee_pass tells us your pass is yours when you open a link. It is set only after you buy a pass, lasts 400 days, and is HTTP-only.

Both are strictly necessary to deliver something you asked for, so under Section 89(3) of Act No. 127/2005 Coll. and Article 5(3) of Directive 2002/58/EC they do not need consent.

Nothing else is kept on your device unless you allow it. A link you paste before signing up waits in local storage until your account exists, and is deleted the moment it is used; the id that tells two open tabs apart lives in memory and is gone when the tab closes; your answer to the question below is remembered in local storage so we stop asking.

We advertise on X, and we would like to know which of those ads bring people here. Measuring that means letting X store a cookie on your device, which is not necessary for anything you asked us for - so we ask first, and nothing is loaded until you say yes. Refusing changes nothing about how the site works.

The question is only ever put on our own pages. A paywall never asks it, and never loads anything belonging to X.

You can take the answer back whenever you like, from the link in the footer. It is one click, in the same place, as giving it. Withdrawing does not undo measuring that already happened.

Legal basis: your consent, under Section 89(3) of Act No. 127/2005 Coll. and Article 5(3) of Directive 2002/58/EC, and Article 6(1)(a) GDPR.

We count page views through Vercel Web Analytics. It sets no cookies and stores nothing on your device: visitors are told apart by a hash made from the request itself, which is discarded after 24 hours, and it holds no identifier that could follow you to another site. Because nothing is stored on or read from your device, it is outside what Section 89(3) asks consent for.

When a creator gives us a VAT number, we check it against VIES, run by the European Commission, and for Czech numbers against ARES, run by the Czech Ministry of Finance. Only the number itself is sent. These are public authorities acting on their own account, not our processors.

A creator sees masked email addresses - two characters and the domain, never the whole address - along with country, plan, what the pass paid and when. They cannot see the full address, the IP hash, or anything about links that are not theirs. This is deliberate: the visitor's contract is with us, and their address is not the creator's to hold.

We do not sell personal data, we do not share it for advertising, and we do not hand it to anyone beyond the parties above except where a court or an authority with jurisdiction requires it, or where we have to defend a legal claim.

Closing an account replaces the email address with an unusable placeholder, removes the name, deletes sessions, passkeys and payout details, and archives the links. The original address is kept encrypted in a separate record, so that a tax or regulatory check can still be answered - it is not readable in the ordinary running of the service.

What survives is the accounting trail, which the law does not let us delete on request.

Access to what we hold about you, correction of anything wrong, deletion where nothing obliges us to keep it, restriction of processing while a dispute is resolved, a machine-readable copy of what you gave us, and objection to anything we do on the basis of legitimate interests.

Where processing rests on legitimate interests - the visit statistics and the IP hash - you can object at any time and we will stop unless we can show compelling grounds that override your interests.

Write to help@routee.link. We do not charge for this and we do not make you prove anything beyond that you control the address in question.

Complain to the Czech data protection authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. If you live in another EU country, your own authority can take the complaint instead.

We take no decisions about you by automated means that produce legal effects or similarly significant effects. Fraud checks can hold a payout for review, but a person decides what happens to it.

Everything travels over TLS. Bank accounts, crypto wallets and the email addresses of closed accounts are encrypted at rest with AES-256-GCM. IP addresses are stored as keyed hashes, apart from the 180-day dispute window on link opens, and are readable there only by the people who run the service. Sessions can be revoked and die with the record behind them. Access to the production database is limited to the people who run the service.

If a breach is likely to be a risk to you, we tell the authority within 72 hours and tell you without undue delay, as Articles 33 and 34 require.

Routee is not for people under 16 and we do not knowingly collect their data. If you believe a child has given us data, write to help@routee.link and we will remove it.

We may update this policy. Where a change affects what we do with data we already hold, we say so before it takes effect. The date at the top always tells you which version you are reading.