Privacy Policy

Last updated: 30 September 2026

This policy explains what personal data Devspace Hub SRL ("crisp", "we") processes when you use crisp.to — short links, QR codes, link-in-bio pages, the dashboard at app.crisp.to and the API at api.crisp.to — and when you visit a link or page created with crisp. Questions: support@crisp.to.

1. Who is responsible

For account data, Devspace Hub SRL is the data controller. For data that our customers collect through crisp — for example email addresses submitted to a signup form on a customer's bio page — the customer is the controller and crisp processes that data on their behalf.

2. Data we collect from account holders

Account: name, email address and a securely hashed password. If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider — nothing else, and we never post on your behalf.
Sessions: a session cookie, plus the IP address and browser user-agent of each signed-in session, used for security.
Your content: links, destinations, tags, QR codes, bio pages, uploaded avatars and API keys (stored only as irreversible hashes).
Billing: payments are processed by Stripe. We store your Stripe customer and subscription identifiers and your plan; we never see or store card numbers.

3. Data we collect from visitors to crisp links and pages

When someone opens a crisp short link, scans a crisp QR code or views a bio page, we record an anonymous event: country (derived by our network provider, not stored as an IP address), device platform, referring site, whether it was opened inside an app's built-in browser, and the time. We do not store visitor IP addresses in analytics, we do not set cookies on visitors, and we do not build profiles of visitors across sites.

Deferred deep links (only where a customer's app uses this feature): to reopen the right screen after an app install, we compute a one-way hash from a shortened network prefix and basic device characteristics (screen size, time zone, language, OS version). The hash is kept for at most 72 hours and cannot be reversed to identify a person.

Email signups on bio pages: if you submit your email to a signup form on a page, it is stored with a timestamp and made available to that page's owner.

4. Why we use it (legal bases)

To provide the service you signed up for (contract); to keep the service secure, prevent abuse such as phishing or malware links, and produce aggregate analytics for link owners (legitimate interests); to meet tax and accounting obligations (legal obligation); and for email signups, the consent given when submitting the form. We do not sell personal data and do not use it for advertising.

5. Service providers

We use Cloudflare (hosting, storage, network and analytics infrastructure), Stripe (payments), and — only if you choose them — Google and Facebook (sign-in). Our pages load fonts from Google Fonts, which receives the requesting browser's IP address. Where these providers process data outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

Account data and content: for as long as your account exists, then deleted as described on our data deletion page. Raw visit events: up to 90 days. Daily aggregate statistics: for the life of the account. Deferred-deep-link hashes: 72 hours. Billing records: as long as tax law requires.

7. Cookies

We use one strictly necessary session cookie to keep you signed in to the dashboard, and your browser's local storage for small interface preferences. We use no advertising or cross-site tracking cookies.

8. Your rights

You can access, correct, export or delete your personal data, and object to or restrict certain processing. Email support@crisp.to from the address on your account and we'll respond within 30 days. You also have the right to complain to your data protection authority — in Romania, the ANSPDCP (dataprotection.ro). If you submitted your email to a customer's page and want it removed, contact that page's owner or us and we'll pass the request on.

9. Children

crisp is not directed at children under 16 and we do not knowingly collect their data.

10. Changes

If we make material changes we'll update the date above and, for account holders, notify you by email or in the dashboard before they take effect.