Privacy Policy

This Privacy Policy describes how CarpathiaLabs S.L.U. ("Company", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you visit or use our website located at https://splash.ist/ (the "Platform"), create an account, generate shortened links, custom bio pages, or dynamic QR codes, or interact with links generated through our services.

We operate in strict compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

1. Data Controller and Data Protection Officer (DPO)

The legal entity responsible for the processing of your personal data is:

2. Categories of Data We Collect

We collect personal data from three main user categories: Registered Users/Account Holders, Website Visitors, and End Users (individuals who click on or scan short links, bio pages, or QR codes created via Splash.ist).

A. Information Provided Directly by Registered Users

• Account Registration: Full name, email address, username, and encrypted/hashed password.
• Single Sign-On (SSO): If you register or log in using Google, Twitter (X), or Facebook, we receive your basic public profile information (such as your profile ID, name, email address, and avatar image) from the respective provider.
• Billing and Payment Information: When purchasing a paid subscription, payment card details, billing address, and transaction metadata are processed directly by our payment processors (Stripe and PayPal). We do not store full payment card numbers on our servers.
• User Content: Original destination URLs, custom short link slugs, custom domain records, bio profile content (avatar images, bio text, social media handles, custom links), and dynamic QR code assets.
• Customer Support & Communications: Information submitted when opening support tickets via our internal CRM system, contacting us via form/email, or submitting abuse/copyright reports via the /report endpoint.

B. Link Analytics Data (End-User Click & Scan Data)

When end users click a splash.ist short link or scan a splash.ist QR code, we process operational metrics to provide link tracking services to our account holders:

• Anonymized IP Address: IP addresses are automatically truncated and anonymized upon capture to ensure visitor privacy while preventing abuse, spam, and fraud.
• Device & Technical Information: Browser type, operating system, device category (mobile, desktop, tablet), language preferences, and referrer URL.
• Geolocation Data: General country and city level location inferred from anonymized technical signals.
• Timestamps: Date and exact time of click or scan.

C. Website Visitor & Marketing Data

When you navigate the main website (https://splash.ist/), we collect technical and behavioral information via cookies and similar technologies, managed through our Consent Management Platform (Iubenda):

• Third-Party Analytics: Usage logs and interaction data via Google Analytics, Bing Analytics, and Microsoft Clarity.
• Marketing & Conversion Tracking: Conversion event data via the Facebook Pixel (Meta Pixel) to measure advertisement effectiveness.

3. Legal Bases for Processing (GDPR Article 6)

We process your personal data under the following legal grounds:

4. Third-Party Service Providers (Data Processors)

We share personal data with trusted third-party service providers bound by Data Processing Agreements (DPAs) in compliance with GDPR Article 28:

• Web Hosting & Infrastructure: HostGator (server hosting, storage, and server logs).
• Payment Gateways: Stripe and PayPal (PCI-DSS compliant payment processing).
• Third-Party Analytics & Heatmaps: Google Analytics, Microsoft Clarity, and Bing Analytics.
• Marketing & Advertising: Facebook Pixel (Meta Platforms, Inc.).
• Consent Management Platform (CMP): Iubenda (cookie consent management and preference logging).
• Identity & Authentication Providers: Google, Twitter (X), and Facebook (SSO services).
• Customer Relationship Management (CRM): Internal CRM system hosted on secure cloud infrastructure for user ticket handling.

We may also disclose personal data to law enforcement, regulatory bodies, or legal proceedings where required by law, court order, or enforceable government request.

5. International Data Transfers

Some of our third-party service providers (such as Stripe, Google, Meta, and Microsoft) are located or operate servers outside the European Economic Area (EEA). Whenever personal data is transferred internationally, we ensure adequate safeguards are in place, including:

• Transfers to countries recognized by the European Commission as providing an adequate level of data protection.
• Execution of Standard Contractual Clauses (SCCs) approved by the European Commission.
• Verification of certification under the EU-U.S. Data Privacy Framework (DPF) where applicable.

6. Cookies and Tracking Technologies

Splash.ist uses essential, analytical, and marketing cookies. You can customize, accept, or reject non-essential cookies at any time using the Iubenda consent preference center available on our website.

• Essential Cookies: Required for basic site operation, secure login sessions, CSRF protection, and preference management.
• Analytics Cookies: Provided by Google Analytics, Bing, and Microsoft Clarity to understand user interactions, session replays, and website performance.
• Marketing Cookies: Provided by Meta (Facebook Pixel) to serve relevant advertisements and track conversion metrics.

7. Data Retention

• Account Information: Retained as long as your account remains active. Upon account deletion, personal data is purged or irreversibly anonymized within 30 days, except where longer retention is required for legal, accounting, or tax obligations.
• Link Click & QR Scan Data: Click/scan logs are stored in an aggregated and anonymized format for reporting purposes.
• Customer Support Records: CRM tickets and communication logs are retained for up to 3 years following ticket resolution to manage legal claims or repeat support requests.

8. Your Rights Under GDPR and Spanish LOPDGDD

If you reside within the European Union, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR): Request deletion of your personal data when it is no longer necessary or when processing is unlawful.
• Right to Restriction of Processing (Art. 18 GDPR): Request restriction of data processing under certain legally defined conditions.
• Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interest or direct marketing.
• Right to Withdraw Consent: Revoke previously granted cookie or marketing consent at any time without affecting the lawfulness of processing prior to withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please send a written request accompanied by proof of identity to our Data Protection Officer:

Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable privacy laws, you have the right to lodge a formal complaint with the competent supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Website: https://www.aepd.es

9. Data Security

We implement technical and organizational security measures to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure. These measures include SSL/TLS encryption for all transmitted web traffic, password hashing, restricted administrative access controls, and regular infrastructure vulnerability assessments.

10. Children's Privacy

Splash.ist is strictly intended for individuals who are at least 16 years of age (or the minimum legal age required in your jurisdiction to consent to online services). We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take immediate steps to delete such data.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect platform updates, technical changes, or legal obligations. When changes are made, we will update the "Effective Date" at the top of this page. For significant updates, we will notify registered users via email or a prominent banner on the Platform.

12. Contact Information

If you have questions, comments, or concerns regarding this Privacy Policy or our privacy practices, please contact us at: