Privacy policy

Version 2026-11-13. Controller: Vexxis Group. Data protection contact: frog@myfrog.link.

1. Who is who

A Customer creates an account and links. A Visitor clicks a short link or opens a landing page. We treat their data differently.

2. Customer data

We collect: email, name (optional), password (stored hashed with a server secret), language, affiliate tag and the content you insert (links, texts, image URLs, pixels). Purpose: operate your account, send broken-link alerts and access emails. Legal basis: contract performance and legitimate interest (GDPR art. 6(1)(b) and (f); LGPD art. 7, V and IX).

3. Visitor data (what we measure)

For each access to a link or landing page we record: a random visit id, an anonymous visitor id (1st-party cookie mf_v, 400 days), approximate country/region/city (derived from the IP at the edge — the IP is not stored), device type, OS and browser (derived from the User-Agent, which is not stored), language, referring site, UTM parameters, time of day, time with the page visible, scroll depth, clicked button and time to click. We do not collect a Visitor's name, email, phone or precise location — unless the Visitor fills in an email-capture form created by the Customer (then the Customer is the controller and we are the processor).

4. How we use Visitor data

• Show the analytics dashboard to the Customer who owns the link.
• Produce aggregated, anonymous statistics across all customers (e.g. "buttons at the top get 32% more clicks", "TV QR codes convert best at 9 pm"). This consolidated analysis is what pays for the free service and is described in the Terms of use.
• Detect abuse and click fraud (bots).

We do not profile individual Visitors, do not match with other databases and do not sell data.

5. Third-party pixels

If the Customer configures Meta Pixel, Google Analytics or TikTok Pixel on a brand, those scripts load on their landing page and are governed by those third parties' policies. The Customer is responsible for obtaining the consents their audience requires.

6. Cookies

See the Cookie policy. Summary: mf_v (anonymous visitor), mf_s (logged-in Customer session), mf_l (language).

7. Sharing

We use Cloudflare as infrastructure provider (edge, database, email), processing data on our behalf. We do not share personal data with advertisers.

8. Retention

Detailed visit and click data: 24 months, then aggregated. Account data: while the account exists. Captured leads: until the Customer deletes them.

9. Your rights

Customers and Visitors may request access, correction, anonymization, portability or deletion of personal data, and withdraw consent, via the email above. Customers can delete their account in settings. We respond within 15 days.

10. Security

TLS on every connection, hashed passwords, HttpOnly/Secure cookies, security headers and per-customer isolation. No system is infallible; we will notify relevant incidents as required by law.

11. International transfers

The infrastructure is globally distributed (Cloudflare). Data may be processed outside your country with adequate contractual safeguards.

12. Changes

We will announce material changes by email or in the dashboard.