Privacy Policy

Veezio Solutions s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, company number 23746068, is the controller of the personal data described here, within the meaning of Regulation (EU) 2016/679 (GDPR).

Write to help@routee.link with anything about your data. We answer within 30 days, as the GDPR requires, and usually much sooner.

We have not appointed a data protection officer: our processing does not meet the thresholds in Article 37 that would require one. The address above reaches the people who make these decisions.

Creators hold an account, shorten links and are paid a share of what those links earn. Visitors open a Routee link and may buy a pass. The data we hold differs a lot between the two, so this policy treats them separately.

Card numbers. Payment details go straight to Stripe and never reach our servers; we see only the last state of a payment and identifiers that point back into Stripe.

Your raw IP address in any record we keep. Our servers necessarily see it in transit, as every web server does, but what we store is a keyed hash of it. Without the key, which is not stored alongside the data, the hash cannot be turned back into an address.

Passwords. There are none - you sign in with a one-time code, a passkey, or Google.

routee_session keeps a creator signed in. It is set only after you sign in, lasts 30 days, and is HTTP-only.

routee_pass tells us your pass is yours when you open a link. It is set only after you buy a pass, lasts 400 days, and is HTTP-only.

Both are strictly necessary to deliver something you asked for, so under Section 89(3) of Act No. 127/2005 Coll. and Article 5(3) of Directive 2002/58/EC they do not need consent. We set no advertising cookies, no analytics cookies, and nothing that follows you to another site.

When a creator gives us a VAT number, we check it against VIES, run by the European Commission, and for Czech numbers against ARES, run by the Czech Ministry of Finance. Only the number itself is sent. These are public authorities acting on their own account, not our processors.

A creator sees masked email addresses - two characters and the domain, never the whole address - along with country, plan, what the pass paid and when. They cannot see the full address, the IP hash, or anything about links that are not theirs. This is deliberate: the visitor's contract is with us, and their address is not the creator's to hold.

We do not sell personal data, we do not share it for advertising, and we do not hand it to anyone beyond the parties above except where a court or an authority with jurisdiction requires it, or where we have to defend a legal claim.

Closing an account replaces the email address with an unusable placeholder, removes the name, deletes sessions, passkeys and payout details, and archives the links. The original address is kept encrypted in a separate record, so that a tax or regulatory check can still be answered - it is not readable in the ordinary running of the service.

What survives is the accounting trail, which the law does not let us delete on request.

Access to what we hold about you, correction of anything wrong, deletion where nothing obliges us to keep it, restriction of processing while a dispute is resolved, a machine-readable copy of what you gave us, and objection to anything we do on the basis of legitimate interests.

Where processing rests on legitimate interests - the visit statistics and the IP hash - you can object at any time and we will stop unless we can show compelling grounds that override your interests.

Write to help@routee.link. We do not charge for this and we do not make you prove anything beyond that you control the address in question.

Complain to the Czech data protection authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. If you live in another EU country, your own authority can take the complaint instead.

We take no decisions about you by automated means that produce legal effects or similarly significant effects. Fraud checks can hold a payout for review, but a person decides what happens to it.

Everything travels over TLS. Bank accounts, crypto wallets and the email addresses of closed accounts are encrypted at rest with AES-256-GCM. IP addresses are stored only as keyed hashes. Sessions can be revoked and die with the record behind them. Access to the production database is limited to the people who run the service.

If a breach is likely to be a risk to you, we tell the authority within 72 hours and tell you without undue delay, as Articles 33 and 34 require.

Routee is not for people under 16 and we do not knowingly collect their data. If you believe a child has given us data, write to help@routee.link and we will remove it.

We may update this policy. Where a change affects what we do with data we already hold, we say so before it takes effect. The date at the top always tells you which version you are reading.