Last Updated: October 16, 2026

KuaLat ("we", "us", or "our"), accessible at kua.lat, values your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, process, store, and disclose information when you visit our website, register for an account, shorten links, create bio profiles, use our developer APIs, or click on a KuaLat short link.

This policy applies globally to all users and visitors. It complies with applicable data protection laws, including the General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act (CCPA / CPRA), and the Indonesian Personal Data Protection Law (UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi / UU PDP).

1. Important Definitions and Scope

To ensure clarity throughout this policy:

• Registered User: An individual or organization that creates an account on KuaLat to shorten links, create bio pages, build QR codes, configure custom domains, or use developer tools.
• Link Visitor: An individual who clicks a KuaLat short link or visits a bio profile page created by a Registered User.
• Site Visitor: An individual who visits our public marketing pages (such as the homepage, pricing, or developer documentation) without logging in.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Data Controller: KuaLat operates as the Data Controller for Registered User account details and direct platform operational data. For destination data and third-party tracking pixels placed on bio profiles or splash pages by Registered Users, the Registered User acts as the primary controller, and KuaLat acts as a technical processor.

2. Information We Collect

We collect information across three categories based on how you interact with our platform:

a. Information You Provide to Us (Registered Users)

• Account Registration: When you register, we collect your name, email address, chosen username, and encrypted password hash (salted using modern cryptographic hashing algorithms such as bcrypt or argon2).
• Social Authentication: If you register using single sign-on (such as Google, GitHub, Facebook, X, Microsoft, or Proton), we receive your verified email address, public profile name, and unique authentication identifier from that provider.
• Two-Factor Authentication (2FA): When you enable two-factor security, we store your TOTP secret key or verification email address.
• Billing and Subscription Details: When you purchase a paid plan (Lite, Creator, Pro, Business, Scale, Enterprise), transaction details such as your billing address, tax identification numbers, and selected currency are collected. Payment transactions are processed directly by certified third-party payment gateways (such as Stripe, PayPal, or Midtrans). KuaLat never stores complete credit card numbers or sensitive CVV codes on its servers.
• User Content: Long destination URLs, custom aliases, titles, bio profile text, social link handles, uploaded files, parameter templates, and custom domain names you configure.
• Communications: Information you provide when contacting our support desk, submitting abuse reports, or corresponding with our team.

b. Information Collected Automatically from Link Visitors

When a Link Visitor clicks a shortened link or views a bio profile, our routing engine processes minimal technical data necessary to deliver the link and compute aggregated analytics:

• IP Address: Processed to identify the visitor's approximate geographic region (country and city) and detect malicious traffic or click fraud. Where configured, IP addresses are hashed using a secure cryptographic salt to prevent individual re-identification.
• Referrer Information: The URL of the website or platform where the short link was clicked.
• Device and Browser Data: User-agent strings, device category (desktop, mobile, tablet), operating system, browser type, and preferred browser language.
• Timestamp: The date and time the short link was requested.
• Query Parameters: UTM campaign parameters (such as utm_source, utm_medium, utm_campaign) attached to the short URL for campaign tracking.

We do not collect personal names, email addresses, or physical home addresses from Link Visitors who merely click a shortened link.

c. Information Collected from Threat Mitigation and Security

• Abuse Reports: When an abuse report is submitted via https://kua.lat/report, we collect the reported link, reason for report, submitter email address, and IP address.
• URL Threat Scanning: URLs submitted for shortening are screened against threat intelligence feeds, including Google Web Risk, PhishTank, and VirusTotal, to identify malware, phishing, and security threats.

3. How We Use Your Information and Legal Bases for Processing

Under global data protection regulations (including GDPR Article 6 and Indonesian UU PDP Article 20), we process personal data only when a valid lawful basis applies:

4. How We Share and Disclose Your Information

KuaLat does not sell, rent, or trade your personal data to advertisers, data brokers, or third parties for their independent marketing purposes.

We share information only under the following limited conditions:

a. Authorized Service Providers

We engage trusted third-party vendors to provide specialized infrastructure and technical services under strict data processing agreements:

• Cloud Infrastructure and Hosting: High-availability server providers and Content Delivery Networks (such as Cloudflare) for DDoS mitigation, caching, and network routing.
• Payment Processors: PCI-DSS compliant gateways, including Stripe, PayPal, and Midtrans, to process subscription billing securely.
• Email Delivery Services: Transactional email delivery providers to send password resets, 2FA codes, account notices, and abuse notifications.
• Threat Intelligence Engines: Scanning engines (Google Web Risk, PhishTank, VirusTotal) to verify that shortened destination links do not distribute malware or phishing.

b. Public Link and Bio Profile Information

Information you intentionally place on a public bio profile (such as social handles, profile photos, bio text, and public links) is visible to anyone on the internet who visits your profile address.

c. Legal Obligations and Protection

We may disclose personal data if required to do so by applicable law, regulation, subpoena, search warrant, or valid court order from competent authorities. We may also disclose information to:

• Investigate and enforce violations of our Terms of Service.
• Protect the security, integrity, and availability of our network.
• Defend against legal claims or protect the safety and rights of KuaLat, our users, or the public.

d. Business Transfers

In the event of a merger, acquisition, corporate reorganization, or sale of assets, user personal data may be transferred as part of the transaction. We will notify you via email or a prominent website notice before your data is transferred and becomes subject to a different privacy policy.

5. International Data Transfers

KuaLat operates infrastructure in Indonesia and utilizes global cloud services and content delivery networks. If you access our Service from outside Indonesia, including from the European Union, the United Kingdom, or the United States, your information may be transferred across international borders.

When transferring personal data internationally, we implement appropriate safeguards in compliance with applicable law, including standard contractual clauses approved by regulatory authorities and technical encryption safeguards.

6. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Information: Retained for the duration of your active account. If you delete your account, we delete or permanently anonymize your personal account data within thirty (30) days, except where retention is required by law.
• Link Analytics: Granular click logs are retained for reporting periods specified in your plan tier, after which they are aggregated into anonymous statistical summaries.
• Financial and Billing Records: Invoices and payment transaction logs are retained for the statutory period required by tax and accounting laws (typically 5 to 10 years).
• Abuse and Security Records: URLs flagged for malware, phishing, or abuse, along with associated enforcement logs, are retained indefinitely in our security blacklist to prevent recurring attacks.

7. Your Data Protection Rights

Depending on your geographic location and applicable local laws (including GDPR, CCPA/CPRA, and Indonesian UU PDP), you have specific rights regarding your personal data:

• Right of Access: You can request confirmation of whether we process your personal data and obtain a copy of that data.
• Right to Rectification: You can correct inaccurate or incomplete personal data directly within your account profile or by contacting us.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data where there is no ongoing legal justification for us to hold it.
• Right to Restrict Processing: You can request that we restrict the processing of your data under specific statutory conditions.
• Right to Data Portability: You can request an export of your account data and link assets in a structured, commonly used, and machine-readable format.
• Right to Object: You can object to data processing based on legitimate interests.
• Right to Withdraw Consent: Where processing relies on your consent (such as promotional newsletters), you may withdraw consent at any time without affecting past lawful processing.
• Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service because you exercised your statutory privacy rights.

To exercise any of these rights, please submit a request to [email protected] or visit your account settings dashboard. We will verify your identity before fulfilling the request and respond within thirty (30) days.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing violates applicable law.

8. Data Security Safeguards

We implement appropriate technical and organizational measures to protect personal data against accidental loss, unauthorized access, destruction, alteration, or disclosure:

• Encryption: All traffic between your browser and KuaLat is encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS). Database storage utilizes encryption at rest.
• Authentication Safeguards: User passwords are encrypted using salted one-way hashing algorithms. We enforce optional multi-factor authentication (TOTP and email 2FA).
• Access Control: Access to internal systems is restricted to authorized personnel who require it for operational duties and are bound by confidentiality agreements.
• Threat Defense: Continuous network monitoring, automated rate limiting, and third-party threat scanning for links prevent malicious tampering and automated credential stuffing.

No method of internet transmission or electronic storage is completely impenetrable. While we maintain rigorous commercial security standards, we cannot guarantee absolute security.

9. Children's Privacy

KuaLat is designed for general audiences and professionals. It is not directed to children under the age of 13 (or under 16 where required by European or local law). We do not knowingly collect personal data from children.

If we learn that personal data from a child under the applicable legal age has been collected without verified parental consent, we will take immediate steps to delete that information from our servers. If you believe a child has provided us with personal data, please contact us at [email protected].

10. Third-Party Links and Tracking Pixels

a. Outbound Short Links

KuaLat shortens and routes links to external websites that are independent of our platform. When visitors click a short link, they leave our infrastructure and navigate to a third-party destination. We do not control and cannot be held responsible for the content, security, or privacy policies of third-party websites.

b. User Tracking Pixels

Registered Users on premium plans may add third-party tracking pixels (such as Google Analytics, Meta Pixel, TikTok Pixel, or LinkedIn Insight Tag) to their bio profiles or splash pages. Registered Users are legally responsible for obtaining necessary visitor consents and providing required privacy notices before deploying tracking pixels.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory modifications. When changes are made, we will update the "Last Updated" date at the top of this document. For material updates, we will notify registered users via email or through a conspicuous notice on our platform dashboard.

12. Contact and Data Protection Officer

If you have questions, inquiries, or requests regarding this Privacy Policy or our data processing practices, please reach out to our team:

• Data Privacy Desk:[email protected]
• General Support:[email protected] | https://kua.lat/contact