1. Two kinds of data
Data about you — the person or company with an account. For this we are the controller, and this policy explains what we do with it.
Data about your visitors — the clicks you track. For this you are the controller and we are your processor: we hold it, we do not decide what it is for, and we act on your instructions. The terms are in the Data Processing Addendum.
The distinction matters. If one of your visitors asks us about their data, we refer them to you, because we cannot make decisions about it.
2. Data about you
| What | Where it comes from |
|---|---|
| Name, email address, password (stored as a hash, never in the clear) | You, at registration |
| Company name, billing address, tax identifiers | You, when a plan is purchased |
| Payment card details | Handled by our payment processor. We see the last four digits and the outcome, never the full number. |
| Sign-in records: time, IP address, browser | Generated when you use the app |
| Support messages and anything you send us | You |
3. Data about your visitors
When a click passes through one of your tracking links, the service records the IP address, the derived location and network (country, region, city, ISP, network number), the user agent and the device it describes, the referring URL, the campaign parameters, and the outcome — where the visitor was sent and whether the request scored as automated.
The IP address is used to derive the location, to detect fraud and to recognise a repeat visit within a short window. We do not build a profile of any individual across your account or anyone else’s, and there is no identity graph anywhere in this product.
What you collect, why, and what lawful basis you rely on are your decisions as controller. Your own privacy notice is what your visitors read.
4. This website
This marketing site sets no cookies, runs no analytics and embeds no trackers. There is no consent banner because there is nothing to consent to.
Typefaces, styles and scripts are served from this site rather than from anyone else’s, so loading a page here makes no request to a third party at all. The one company involved is Cloudflare, which serves the page and processes the request in order to deliver it.
Nothing is stored in your browser either — no cookies, no local storage, nothing to clear. Leaving this site leaves no trace of having been here.
5. Why we hold it
- To provide the service — the contract between us. Account data, sign-in records and billing details.
- To keep it secure — our legitimate interest. Sign-in records, rate limiting, abuse investigation.
- To bill and to meet tax obligations — legal obligation.
- To answer you — support correspondence, kept while a question is open and for a period afterwards in case it recurs.
We do not use your data to advertise to you, and we do not send marketing email to people who have not asked for it.
6. Who else sees it
Only the suppliers needed to run the service, each for one purpose, each under a contract that forbids using the data for anything else. The current list is in the DPA, which is the document that gets updated when it changes.
We disclose data to an authority only where legally required, and where we are permitted to tell you, we will.
We never sell personal data. There is no arrangement under which we could.
7. How long
- Account and billing records: while the account is open, then as tax law requires.
- Click records: for the retention period of your plan, then deleted.
- Sign-in and security logs: 12 months.
- Support correspondence: 24 months.
- After an account closes: 30 days, then deletion. See the Terms, section 8.
8. Security
Passwords are stored using a memory-hard hashing function, never reversibly. Traffic is encrypted in transit. Backups are encrypted, and are verified by restoring them rather than by assuming they worked. Access to production systems is limited to those who need it, by key rather than password.
If a breach affects your data, we will tell you without undue delay and with what we actually know at the time, rather than waiting for a complete account.
To report a vulnerability: security@utmcap.com. We will not pursue anyone who reports one in good faith and does not access or alter other people’s data while doing so.
9. International transfers
The service runs on infrastructure in more than one country, and clicks are answered from whichever of Cloudflare’s locations is nearest the visitor. Where personal data moves outside the country it was collected in, it moves under the Standard Contractual Clauses or an equivalent recognised mechanism.
10. Your rights
Depending on where you live, you may have the right to a copy of your data, to correct it, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. To exercise any of them, write to privacy@utmcap.com. We answer within one month and we do not charge for it.
You may also complain to the data protection authority where you live. We would rather you told us first, but it is your right either way.
11. Contact
TODO: registered company name, TODO: registered address, TODO: country of registration.
Privacy questions: privacy@utmcap.com. Anything else: hello@utmcap.com.