Privacy policy

Last updated 12 November 2026

This policy explains what personal data Ferrow processes, why, on what legal basis, for how long, and what rights you have, as required by the EU and UK General Data Protection Regulation (GDPR) and similar laws. It covers our website and dashboard (ferrow.io), our short-link domain (ferw.link) and customers’ custom short-link domains (together, the link lane), and our click-tracking domains (frwtrk.com, frwclk.com) (the tracking lane).

Who we are

Ferrow is operated by WNH Marketing LLC, 30 N Gould St STE R, Sheridan, Wyoming 82801. For anything about privacy or your data, contact us at contact@ferrow.io.

Our role: controller or processor

Data about our customers (account, billing, support): we are the controller. We decide why and how it is processed.
Click data recorded for a customer’s links: the customer who created the link decides why it is shared and tracked, so the customer is the controller and we process the data on their behalf as a processor, under the data processing terms below. We also use click data ourselves, as a controller, only to detect bots and abuse and to apply plan limits.

If you clicked a link and have a question about why it was tracked, the organisation that shared the link is the right first contact. You can also write to us and we will pass your request on or help directly.

People who click links

When someone opens a short link or a tracking link, we record one click with:

the time, and which link was clicked;
approximate location (country, region, city) provided by our network provider, Cloudflare, from the IP address;
device type, operating system and browser, worked out from the browser’s user-agent string;
the referring website’s domain name only (for example www.facebook.com), never the full page address;
whether the request looks automated (a bot or link preview), so bots can be left out of statistics;
a visitor hash: a one-way SHA-256 hash of the IP address, the user-agent and a secret value that changes every day. It lets us count unique visitors within a day. It cannot be reversed to an IP address, and hashes from different days cannot be linked to each other.

We never store IP addresses. The IP address is used in memory, for the duration of the request, to deliver the redirect, look up the approximate location and compute the visitor hash, and then discarded.

Redirect domains set no cookies, store nothing on your device, run no scripts, and do no fingerprinting or cross-site tracking. We don’t sell click data, share it with advertisers other than the link’s owner, or use it to build profiles of individuals.

Google Ads tracking-template clicks

Advertisers can put one of our tracking links in Google Ads as a tracking template. When someone clicks such an ad, Google sends a request to our tracking domain, usually in the background (“parallel tracking”) while the visitor goes straight to the advertiser’s page. For these clicks we record the same information as above, marked as a Google Ads click, plus:

the Google click identifier (gclid) if one is present in the request.

Our tracking domains redirect to exactly the value of the link’s url parameter and never add any parameters to it. They refuse only requests without a url, and links we have disabled for abuse.

Who sees click data

The account that owns a link sees statistics for it and can export click records (without visitor hashes). We don’t give click data to anyone else, except our service providers listed below and where the law requires it.

Our customers and their teams

Account: email address and name.
Content: your links, domains, tags, folders, workspace members and settings.
Invitations: the email address of a person a workspace owner invites, and their role.
Billing: handled by Stripe. We store your Stripe customer ID and plan, never card details.
API keys: stored only as hashes.
Security: sign-in sessions; to limit abuse we count requests per IP for short periods, keeping only a keyed hash of the IP.

You give us your email address to create an account; without it we can’t provide the service. Everything else is optional or created by your use of the service.

People who contact us or report abuse

If you email us or use the abuse form, we process your email address, your message and the link you report, to answer you and to stop abuse.

Why we use data, and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Providing your account, links, redirects, analytics, sign-in emails and support	Performance of our contract with you
Recording clicks on a customer’s links and showing them their statistics	Carried out for the customer, as their processor; the customer relies on its own legal basis
Detecting bots and abuse, checking destinations for phishing and malware, rate limiting, keeping the service secure	Our legitimate interests, and those of the people who click links, in a safe service
Billing and accounting	Performance of our contract, and legal obligations (tax records)
Answering messages and abuse reports	Our legitimate interest in responding and in preventing abuse

Where we rely on legitimate interests, we have weighed them against your rights; you can object at any time (see Your rights). We do not send marketing emails, and we don’t use your data for advertising.

Automated decisions

We don’t make decisions about people that have legal or similarly significant effects based solely on automated processing. Our safety checks can automatically refuse or disable a link whose destination is flagged as phishing or malware; if you think that happened by mistake, contact us and a person will review it.

How long we keep it

Individual click records: 24 months, then deleted automatically. Monthly totals used for plan limits are kept while the account exists.
Account data and links: while your account is active. When a workspace is deleted, its links and click records are deleted. To delete your user account entirely, email us.
Invitations: until accepted or revoked; unaccepted invitations expire after 7 days.
Security records: sign-in sessions until they expire or you sign out; rate-limit counters for minutes to hours.
Messages and abuse reports: as long as needed to handle them and prevent repeat abuse.
Billing records: as long as tax law requires.

Service providers (sub-processors)

We use these providers to run the service. They process data on our behalf, under contract, only for that purpose:

Cloudflare: network, redirects, caching and queues (link and tracking lanes); global network.
Vercel: hosting for the website and dashboard (servers in Singapore).
Supabase: database (servers in Singapore).
Resend: sign-in and invitation emails.
Stripe: payments.
Zoho: our email inbox, for messages you send us.

International transfers

Our main servers are in Singapore, and some providers process data in other countries, including the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) or, where a provider is certified, the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

Security

All traffic is encrypted with HTTPS. Data is encrypted at rest by our database provider, access to production systems is limited to the people who run the service, database tables are closed to direct public access, API keys are stored only as hashes, and we never store the IP addresses of people who click links. If a personal data breach happens, we will notify affected customers without undue delay and, where required, the relevant data protection authority within 72 hours.

Cookies and local storage

Only the dashboard uses cookies, and only strictly necessary ones: a session cookie to keep you signed in, and one that remembers which workspace you last opened. The dashboard also saves two settings in your browser’s local storage: your light or dark theme, and that you have dismissed the cookie notice. We use no analytics, advertising or tracking cookies, so no consent banner is needed. Redirect and tracking domains set none and store nothing.

Your rights

Under the GDPR and similar laws, you have the right to:

access the personal data we hold about you and get a copy;
correct data that is wrong or incomplete;
delete your data (“right to be forgotten”);
restrict how we use it;
receive data you gave us in a portable, machine-readable format, or have it sent to another service;
object to processing based on legitimate interests;
complain to a data protection supervisory authority, in particular where you live or work.

Email contact@ferrow.io. We answer within one month (we may extend this by two months for complex requests and will tell you why). It is free, and we may ask you to confirm your identity first. You can also delete links, workspaces and click data yourself in the dashboard, and export your clicks as CSV.

Because we don’t store IP addresses or cookies for people who click links, we usually can’t identify an individual visitor’s clicks. If you can give us details that let us find them, we will act on your request.

Children

Ferrow is a business service and is not meant for children under 16. We don’t knowingly create accounts for them; if you believe a child has given us personal data, contact us and we will delete it.

Data processing terms for customers (GDPR Article 28)

This section applies when we process personal data on a customer’s behalf as a processor: the click data recorded for the customer’s links (time, approximate location, device type, operating system, browser, referring domain, bot flag, daily visitor hash, and for Google Ads clicks the gclid) about people who open those links. It forms part of our terms and applies automatically; no signature is needed.

Instructions: we process this data only to provide the service as you configure it, unless the law requires otherwise (we will tell you, unless the law forbids it). You are responsible for having a lawful basis for the tracking and for informing your audience where required.
Duration: while you use the service, then deleted within the retention periods above.
Confidentiality and security: people authorised to process the data are bound by confidentiality, and we apply the security measures described above.
Sub-processors: you authorise the providers listed under Service providers. Each is bound by data protection terms at least as protective as these, we remain responsible for them, and we will update the list at least 30 days before adding or replacing one so you can object; if we can’t resolve a reasonable objection, you may stop using the service.
Your obligations to individuals: we help you answer people exercising their rights, through the dashboard (deletion and export) or by email.
Breaches: we notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need for your own notifications.
Assistance: we help with data protection impact assessments and consultations with authorities, given the information available to us.
Deletion: when you delete links or a workspace, or the service ends, we delete the related personal data unless the law requires us to keep it.
Information and audits: we provide the information needed to show compliance and allow reasonable audits, on reasonable notice, at most once a year unless a supervisory authority requires otherwise.
Transfers: for transfers from the EEA, the UK or Switzerland to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (module 2 or 3, with the UK Addendum where relevant) are incorporated by reference, and we require the same of our sub-processors.

For a signed copy of these terms for your records, email contact@ferrow.io.

Changes

We’ll post changes here and update the date above. For significant changes we’ll notify account holders by email. See also our terms and acceptable use policy.