Skip to main content

LEGAL

Privacy Policy

Effective Date: October 3, 2026

Introduction

Routo is a service provided by CodaSignal, LLC, a Delaware limited liability company ("Routo","we","us","our"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our link management platform, including our website (routo.io), console application, API, and related services (collectively, the"Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, do not use the Service.

This Privacy Policy is part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

Information We Collect

We collect several types of information to provide and improve our Service.

1. Personal Information

Account Information

When you create a Routo account, we collect:

  • Name (full name or display name)
  • Email address
  • Password (encrypted and not readable by us)
  • Company or organization name
  • Phone number (optional)
  • Profile picture (optional)

Billing Information

When you subscribe to a paid plan, we collect:

  • Billing address
  • Payment method information (credit card, bank account)
  • Tax identification numbers (if applicable)

Note: Payment card information is processed and stored by our third-party payment processor (Stripe). We do not directly store complete payment card numbers.

Team Information

When you invite team members or join an organization, we collect:

  • Team member names and email addresses
  • Role and permission assignments
  • Invitation acceptance information

API Keys

When you generate API keys, we collect:

  • API key name and description
  • Creation date and last used date
  • Associated permissions and scopes

2. Usage Data

Link Data

When you create and manage links, we collect:

  • Original destination URLs
  • Short link paths and domains
  • Link titles, descriptions, and tags
  • Custom domain configurations
  • QR code configurations
  • Link expiration dates
  • Advanced settings (platform-specific destinations, fallback URLs)
  • A/B test variants and configurations

Analytics Data

When someone clicks on your links, we automatically collect:

  • Truncated IP address (IPv4 reduced to /24, IPv6 reduced to /48 — the last octet/segment is dropped at ingestion so individual addresses are not retained)
  • Geographic location (country, city) derived from the truncated IP and Cloudflare's geolocation headers
  • Device type and operating system
  • Browser type and version
  • Referrer URL (where the click came from)
  • Timestamp of the click
  • User agent string

We also generate internal abuse-detection signals (bot detection, fraud risk score, suspicious-activity flags) from each click. These are used only for security and to enforce our Acceptable Use policy.

Service Usage

We log information necessary to operate the Service:

  • API requests and response status codes
  • Error messages and stack traces (for debugging)
  • Performance metrics (request latency, database query times)

We do not use a dedicated product-analytics vendor (such as PostHog, Mixpanel, or Amplitude) inside the authenticated console.

On the public marketing site (routo.io) we use Google Analytics 4 and a self-hosted codasignal-analytics script for aggregate traffic reporting. In the console (console.routo.io) we use Google Analytics 4 for aggregate usage reporting — page views and the standard interaction events Google Analytics measures automatically, such as outbound link clicks. It never loads on, and never receives the one-time codes from, sign-in, password-reset, email-verification, or invitation links. These scripts load only after you accept the "Analytics" category in the consent banner. One choice covers both sites, and you can change it at any time — from the "Cookie preferences" button in the site footer, or from the user menu in the console.

Technical Information

We automatically collect:

  • Device identifiers (for security and authentication)
  • IP addresses
  • Browser type and version
  • Operating system
  • Cookies and similar tracking technologies
  • Session information

3. Information from Third Parties

Authentication Providers

If you sign up or log in using Google or GitHub, we receive:

  • Profile information (name, email, profile picture)
  • Authentication tokens (used only for sign-in)
  • Public profile data you authorized during OAuth consent

Payment Processor

We receive limited information from Stripe:

  • Payment confirmation and status
  • Subscription status
  • Billing event notifications
  • Fraud detection signals

How We Use Your Information

We use the information we collect for the following purposes:

1. Provide and Maintain the Service

  • Create and manage your account
  • Process your subscription and payments
  • Generate and manage short links
  • Track clicks and provide analytics
  • Deliver QR codes
  • Enable custom domain functionality
  • Facilitate team collaboration
  • Provide customer support

2. Improve and Optimize the Service

  • Analyze usage patterns and trends
  • Conduct research and development
  • Test new features and functionality
  • Optimize performance and reliability
  • Identify and fix bugs
  • Enhance user experience

3. Communicate with You

  • Send transactional emails (account confirmation, password resets, billing notifications)
  • Provide customer support responses
  • Send service announcements and updates
  • Request feedback and conduct surveys

4. Security and Fraud Prevention

  • Verify identity and prevent unauthorized access
  • Detect and prevent fraud, spam, and abuse
  • Monitor for security threats
  • Enforce our Terms of Service
  • Comply with legal obligations
  • Protect our rights and property

5. Analytics and Business Intelligence

  • Generate aggregate statistics about Service usage
  • Understand user demographics and behavior
  • Measure marketing campaign effectiveness
  • Make informed business decisions
  • Create anonymized datasets for research

6. Legal and Compliance

  • Comply with applicable laws and regulations
  • Respond to legal requests and prevent harm
  • Enforce our agreements and policies
  • Resolve disputes
  • Protect the rights, privacy, safety, or property of Routo, you, or others

Information Sharing and Disclosure

We do not sell your personal information. We share information only in the following circumstances:

1. With Your Consent

We may share your information when you explicitly consent or direct us to do so, such as:

  • Connecting third-party integrations
  • Sharing analytics data with team members
  • Exporting data for your own use

2. Service Providers

We share information with third-party vendors who perform services on our behalf:

Infrastructure and Storage

  • Cloudflare — Workers, Pages, Email Routing, KV, R2 (global edge network)
  • Turso — primary database hosting (libsql)

Payment Processing

  • Stripe — payment processing and billing (PCI-DSS Level 1)

Authentication

  • Google OAuth — used only when you choose Google sign-in
  • GitHub OAuth — used only when you choose GitHub sign-in

Internal Infrastructure

  • Infisical — secrets management (no user data; operational use only)

Website and Console Analytics (consent-gated)

  • Google Analytics 4 (container G-5K184KBHJB) — aggregate traffic reporting for the marketing site and the console; anonymize_ip enabled; loads only after consent
  • codasignal-analytics (analytics.codasignal.com) — privacy-respecting self-hosted analytics for the marketing site; loads only after consent

These providers are contractually obligated to use your information only as necessary to provide services to us, and are prohibited from using it for their own purposes.

3. Business Transfers

If Routo is involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4. Legal Requirements

We may disclose your information if required to do so by law or in response to:

  • Valid legal processes (subpoenas, court orders)
  • Government or regulatory requests
  • Requests from law enforcement
  • National security requirements

We will notify you of such requests unless prohibited by law.

5. Protection of Rights

We may share information when we believe it's necessary to:

  • Comply with applicable laws and regulations
  • Respond to claims that content violates third-party rights
  • Enforce our Terms of Service and other agreements
  • Protect the rights, property, or safety of Routo, our users, or the public
  • Detect, prevent, or address fraud, security, or technical issues

6. Aggregated and Anonymized Data

We may share aggregated or anonymized information that cannot reasonably be used to identify you:

  • Industry reports and benchmarks
  • Research publications
  • Marketing materials
  • Public blog posts or case studies

Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy.

Account Data

  • Active accounts: Retained for the duration of your subscription
  • Canceled accounts: Retained for 90 days after cancellation, then permanently deleted
  • Inactive accounts: Free accounts inactive for 90+ days may be deleted with notice. Paid accounts inactive for 2+ years may be deleted after notice.

Analytics Data

Retention varies by subscription plan:

  • Free: 7 days
  • Pro: 90 days
  • Business: 1 year
  • Enterprise: Per contract

You can export analytics data at any time before deletion.

Billing Data

  • Payment records: Retained for 7 years for tax and accounting purposes
  • Invoice history: Retained indefinitely for your reference
  • Payment method details: Retained by Stripe per their policies

Backup Data

  • Database backups: Retained for 30 days
  • System logs: Retained for 90 days
  • Security logs: Retained for 1 year

Legal Hold

We may retain information longer if required by law, legal process, or to protect legal rights.

Deletion Requests

You may request deletion of your account and data at any time by contacting support@routo.io. We will fulfill deletion requests within 30 days, subject to legal and operational requirements.

Data Security

We implement industry-standard security measures to protect your information:

Technical Safeguards

  • Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
  • Hashing: Passwords are hashed using bcrypt with unique salts
  • Tokenization: API keys and authentication tokens use secure random generation
  • Firewall protection: Network-level security controls
  • DDoS mitigation: Protection against distributed denial-of-service attacks

Access Controls

  • Multi-factor authentication: Available for all accounts
  • Role-based access control: Team permissions and least-privilege principles
  • Audit logging: Tracking of sensitive operations and access
  • Employee access: Limited to authorized personnel with business need

Operational Security

  • Incident response: Documented procedures for security events
  • Vendor management: Security review of third-party providers
  • Secure development: Code review and security testing in our development process

Compliance

We follow industry security best practices but currently hold no formal certifications (such as SOC 2 or ISO 27001). If your organization requires audited compliance, contact us at support@routo.io to discuss Enterprise terms.

We support data subject rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) where applicable, but we are not a certified processor under either framework.

Limitations

While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the security of your account credentials and notifying us immediately of any suspected security breach.

Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information.

Access and Portability

  • Right to access: Request a copy of your personal information
  • Data portability: Export your data in a machine-readable format (CSV, JSON)
  • Console access: View most of your information directly in your account settings

To exercise these rights, visit your account settings or contact support@routo.io.

Correction and Updates

  • Right to correction: Request correction of inaccurate information
  • Self-service: Update most information directly in your account settings
  • Assistance: Contact support@routo.io for help updating your information

Deletion and Erasure

  • Right to deletion: Request deletion of your personal information
  • Account deletion: Cancel your account through account settings
  • Exceptions: We may retain information as required by law or for legitimate business purposes

Note: Deletion of your account will permanently delete all your links, analytics data, and configurations. This action cannot be undone.

Objection and Restriction

  • Right to object: Object to processing of your information for certain purposes
  • Marketing opt-out: We do not currently send marketing email. If we introduce a marketing list in the future, every message will include a one-click unsubscribe link.
  • Analytics opt-out: Configure privacy settings in your account

Consent Withdrawal

  • Right to withdraw: Withdraw consent for optional data processing
  • Effect: May limit your ability to use certain features
  • How: Contact support@routo.io to withdraw consent

LGPD Rights (Brazilian Users)

If you are located in Brazil or your personal data was collected in Brazil, we treat you as a titular de dados pessoais under Federal Law 13.709/2018 (Lei Geral de Proteção de Dados,"LGPD") and its amendment (Law 13.853/2019).

Controller and Brazilian Representative

Controller: CodaSignal, LLC, a Delaware limited liability company.
Brazilian Representative: to be designated (a Brazilian representative will be appointed before commercial launch in Brazil per LGPD Art. 23 §III).
LGPD contact channel: support@routo.io

Encarregado pelo Tratamento de Dados Pessoais

Our Encarregado (Data Protection Officer under LGPD Art. 41) is the Equipe de Privacidade Routo, reachable at support@routo.io. We aim to respond to LGPD requests within fifteen (15) days, per ANPD guidance.

Legal bases for processing (LGPD Art. 7 / Art. 11)

  • Performance of contract (Art. 7 V): account creation, login, billing, transactional email (verification, password reset, billing notifications), session and CSRF cookies.
  • Consent (Art. 7 I): marketing email (when offered, via opt-in), and analytics cookies on the marketing site and in the console (via the consent banner).
  • Legitimate interest (Art. 7 IX): truncated-IP click analytics, bot/fraud detection, product reliability and abuse prevention; balancing test is documented internally.
  • Legal obligation (Art. 7 II): security-incident logging, tax and accounting records, regulator-mandated retention.
  • Exercise of rights in proceedings (Art. 7 VI): retention to defend or assert legal claims.

We do not process sensitive personal data (LGPD Art. 5 II) as part of the Service. We do not process personal data of children under 13.

Your LGPD rights (Art. 18)

  • Confirmation that we process your data and access to that data (free, within fifteen days)
  • Correction of incomplete, inaccurate, or outdated data
  • Anonymisation, blocking, or deletion of unnecessary or excessive data, or data processed in violation of LGPD
  • Portability — receive your data in a structured, machine-readable format
  • Deletion of personal data processed on the basis of consent (Art. 18 VI)
  • Information about public and private entities with whom we have shared your data
  • Information about the right not to consent and the consequences of refusal
  • Revocation of consent at any time, at no cost
  • Review of decisions taken solely on automated processing (Art. 20)

Exercise these rights by emailing support@routo.io with subject line"LGPD — Solicitação de Titular". You may also delete your account and export your data directly from your console settings once those flows are released.

Minors (Art. 14)

Routo is not directed to children under 13. We require a minimum age of 13 at signup and verify birth year on the registration form. If you become aware that a child under 13 has provided us personal data without parental consent, contact support@routo.io and we will delete it without undue delay.

International data transfers (Art. 33)

Your personal data is processed on infrastructure operated by Cloudflare (global edge) and Turso (regional database hosting), and may be processed by Stripe (United States) for payments and by Google/GitHub (United States) if you choose OAuth sign-in. We rely on specific contractual clauses with each sub-processor and on your explicit consent for international transfers initiated by your own actions, per LGPD Art. 33.

Security incidents (Art. 48)

Where a security incident may cause relevant risk or harm to a Brazilian data subject, we notify ANPD within three (3) business days of confirmation and affected data subjects without undue delay, per ANPD Resolution CD/ANPD No. 15/2024. A full incident report is filed with ANPD within twenty (20) business days.

Authority (ANPD)

You may lodge a complaint with the Brazilian data protection authority — Autoridade Nacional de Proteção de Dados (ANPD) — if you believe we have failed to comply with LGPD.

GDPR Rights (European Users)

If you are in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation:

  • Right to lodge a complaint with a supervisory authority
  • Right to restrict processing in certain circumstances
  • Right to data portability in structured formats
  • Right to object to automated decision-making

We have not currently appointed an EU representative. If your request relates specifically to EU data protection law, contact support@routo.io and we will respond within statutory timelines.

CCPA Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act:

  • Right to know what personal information is collected
  • Right to know if personal information is sold or disclosed (we do not sell personal information)
  • Right to opt out of the sale of personal information
  • Right to deletion of personal information
  • Right to non-discrimination for exercising CCPA rights

To exercise CCPA rights, email support@routo.io with subject line"California Privacy Rights Request" and include your name, email, account information, and specific request.

How to Exercise Your Rights

To exercise any of these rights:

  1. Email support@routo.io with your request
  2. Include your name, email, and account information
  3. Specify which right(s) you wish to exercise
  4. We will respond within 30 days (or as required by applicable law)

We may request additional information to verify your identity before fulfilling your request.

Cookies and Tracking

We use essential cookies on the marketing site and in the console. Non-essential cookies are set on either only after you opt in through the consent banner.

Essential cookies (always active)

  • Session cookies — maintain your sign-in state
  • Authentication cookies — secure your active session
  • Security cookies — protect against cross-site request forgery and similar attacks
  • routo_consent — written only after you save your choice in the consent banner; stores your preference for every routo.io site so we don't re-prompt on every visit

Analytics cookies (consent-gated)

  • Google Analytics 4 first-party cookies for aggregate traffic measurement (with anonymize_ip)
  • codasignal-analytics first-party cookies for privacy-respecting traffic reporting

Analytics cookies load only after you accept the"Analytics" category in our consent banner. You may revisit or change your choice at any time by clicking the consent banner trigger. We do not currently load any advertising or marketing cookies.

International Data Transfers

Your data may be processed outside your country of residence via our infrastructure providers, notably Cloudflare's global edge network and Turso's regional database hosting. Where required by law, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards available through our vendors' Data Processing Agreements.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Privacy, Support & Legal: support@routo.io
Website: routo.io

Routo is operated by CodaSignal, LLC, a Delaware limited liability company.

Response Time

We aim to respond to all privacy inquiries within 30 days.

Supervisory Authority

If you are in the European Economic Area, you have the right to lodge a complaint with your local data protection authority. A list of authorities can be found at: edpb.europa.eu/about-edpb/about-edpb/members_en

Last Updated: October 3, 2026

Thank you for trusting Routo with your information. We are committed to protecting your privacy and handling your data responsibly.