Privacy
Last updated 29 October 2026
What toa.ee collects, why, who processes it, how long we keep it and your rights. No tracking cookies, no ads, and no IP addresses stored.
This notice explains what personal data toa.ee collects, why, and what you can do about it. In short: we collect what we need to run toa.ee, we don't sell data or show ads, and we don't use tracking cookies.
Who we are
toa.ee is run from Tallinn, Estonia. We are the controller of the personal data described here.
Questions or requests about your data: hello@toa.ee.
Who this notice covers
- People with a toa.ee account.
- People who open a toa.ee short link or digital business card, whether or not they have an account.
- People who use our free tools, report a link or email us.
toa.ee is a business tool and isn't directed at children.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Account details: your email address, your password (never stored in readable form), your Google account ID if you sign in with Google, your plan and settings | To create and run your account, sign you in and keep it secure | Contract |
| Your content: short links and where they point, slugs, titles, UTM templates, QR code styles, digital business card details, and logos and images you upload | To provide the service you asked for. Digital business cards are public by design: you choose what to publish | Contract |
| Billing: plan, subscription status, invoices and a customer reference from Stripe. We never see your full payment card number | To take payments and keep the records accounting law requires | Contract; legal obligation |
| Visits to short links and digital business cards: the time, approximate country, device type, browser, the website the visitor came from, whether it looks like a bot, and a random identifier that changes every day. For digital business cards, also whether the contact was saved and which button was tapped | To send visitors where the link points, show owners how their links and digital business cards perform, and spot abuse and bots | Legitimate interests |
| Security data: your IP address, for a short time, to limit repeated requests and block abuse | To keep toa.ee available and safe | Legitimate interests |
| Abuse reports: the reported link, the reason, any details you add, and an identifier derived from your connection so one person can't report the same link many times | To review reports and act on illegal or harmful content | Legitimate interests; legal obligation (EU Digital Services Act) |
| Product usage: events such as account created, link created or plan changed, linked to your account | To understand how toa.ee is used and improve it. We don't use third-party analytics | Legitimate interests |
| Free tools: the fact that a tool was used. What you type into the QR code generator or the UTM builder stays in your browser | To see which tools are useful | Legitimate interests |
| Emails: messages we send you about your account and billing, and messages you send us | To run your account and answer you | Contract; legitimate interests |
| Error reports: technical details when something breaks, with links and personal details removed where we can | To find and fix problems | Legitimate interests |
| Blog authors: the name, bio and photo an author chooses to publish | To credit authors | Legitimate interests |
We don't store the IP addresses of people who open a short link or digital business card, and those pages set no cookies. The daily identifier lets us count unique visitors for a day; it can't be used to recognise someone the next day or on other websites.
Contract means we need the data to provide the service you signed up for. Legal obligation means the law requires it. Legitimate interests means we have weighed our interests — running a safe, reliable service — and link owners' interest in measuring their own links against your privacy, and kept the data to a minimum. You can object to this at any time (see Your rights).
Apps and API keys you connect
You can connect apps such as Claude, Zapier, Make or the toa.ee browser extension, or create API keys. For each one we store its name, what it may do (read, or read and write), when it was created and the last day it was used (the day only), and a daily count of requests. We never store a key or sign-in token in readable form, only a fingerprint of it. When you connect an app, we send it the data it asks for, at your request; that app's own privacy policy covers what it does next. You can disconnect apps and revoke keys at any time in Settings.
Legal basis: performing our contract with you.
The toa.ee browser extension
The extension sends toa.ee the address of the page or link you choose to shorten, only when you ask it to. It keeps your sign-in on your device. It sends nothing else and has no analytics.
Legal basis: performing our contract with you.
Cookies and browser storage
We only use cookies and browser storage that toa.ee needs to work: to keep you signed in, to secure sign-in, and to remember try-it links made without an account. We don't use cookies for analytics or advertising, so we don't ask for cookie consent. The full list is on our Cookies page and updates whenever the site changes.
Who we share data with
We don't sell personal data. We share it only with providers that help us run toa.ee, under contracts that require them to protect it, and only as much as each one needs.
| Provider | What for | Where |
|---|---|---|
| Zone Media OÜ (zone.ee) | Hosting our servers and databases | Estonia (EU) |
| Off-site backup provider | Encrypted backups | EU |
| Stripe | Payments, invoices and billing management. Stripe is also a controller of payment data under its own privacy policy | EU and United States |
| Resend | Sending account and billing emails | United States |
| Sentry | Error reports | EU or United States |
| Checking links against Google Safe Browsing (we send the link, not data about you), and sign-in if you choose Continue with Google | EU and United States | |
| Apps you connect (for example Anthropic for Claude, Zapier, Make) | Only when you connect them, with the access you allow | Wherever that app processes data under its own privacy policy |
Apps you connect are not our processors; their own privacy policies apply to what they do with the data you let them request.
We may also disclose data when the law requires it, for example to a court or the police with a valid order.
Some providers process data outside the European Economic Area, mainly in the United States. We use them only where the transfer is covered by an EU adequacy decision, such as the EU–US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses. Email us for details.
How long we keep data
| Data | How long |
|---|---|
| Account details | While you have an account. Your links keep working for 30 days after you delete it; then we remove your account details and the content of your links |
| Short links and digital business cards | Until you delete them; their content is removed 30 days later |
| Logos and images you upload | While a digital business card, QR code or blog post uses them; deleted within 7 days after nothing uses them |
| Digital business cards on a cancelled paid plan | Paused for 90 days, then deleted unless you subscribe again |
| Visit records | Up to 400 days, and deleted straight away when the link or digital business card is deleted. Daily totals, which contain no visitor identifiers, are kept while the link exists |
| Security data | Up to 1 hour |
| Abuse reports | 12 months |
| Product usage events | 24 months. When you delete your account, they're no longer linked to you |
| Revoked API keys and disconnected apps | 30 days after revoking |
| Connected apps not used | Deleted after 90 days without use (you can reconnect) |
| Sign-in codes and tokens for connected apps | Until they expire or are revoked, then 1 day |
| Apps that registered themselves and never connected | 30 days |
| API request counts and quota email records | 13 months |
| API idempotency records | 24 hours |
| Billing records | 7 years, as Estonian accounting law requires |
| Error reports | Up to 90 days |
| Backups | Up to 30 days |
Your rights
You can ask us to:
- give you a copy of your personal data;
- correct it;
- delete it — you can also delete your account yourself in Settings;
- limit how we use it;
- give you your data in a format you can take elsewhere — paid plans can also export click records as CSV;
- stop using it where we rely on legitimate interests.
Email hello@toa.ee. We'll reply within one month. If we need to confirm who you are, we'll ask.
If you only opened a toa.ee link, we usually can't tell which visits were yours, because we don't keep IP addresses or cookies. Tell us what you need and we'll help where we can.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the data protection authority where you live or work.
Automated decisions
We don't make decisions about you based only on automated processing that have legal or similarly significant effects. To keep toa.ee safe, a link can be blocked automatically when Google Safe Browsing flags it, or after several independent abuse reports. If that happens to one of your links, email us and a person will review it.
Security
We use encrypted connections, limit who can access personal data, and keep backups so data isn't lost. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.
Changes to this notice
When this notice changes, we update the date at the top. If a change affects how we use your data in a significant way, we'll email account holders before it applies.