bit7s1. Overview
Bit7s ("we", "us", "our") operates a marketing link & page platform that lets users turn product images into trackable marketing pages with short links, QR codes, and built-in analytics. This Privacy Policy explains what data we collect, why we collect it, how long we keep it, and the rights you have over it.
By using our service at bit7s.com you agree to the practices described in this policy. This document is written in plain English so non-technical users can understand exactly what happens to their information.
2. What We Collect
2.1 Data You Provide
- Account information - email address and hashed password when you register.
- Content you upload - product images, link destinations, page titles, CTA button text you create.
- Optional profile - display name, contact phone (optional).
- Payment information - when you subscribe, your email address, order number, plan, and the charged amount in USD are passed to our payment providers (PayPal and Airwallex). You enter card details on the provider's secure hosted checkout; Bit7s never receives or stores your full card number. See section 10 below.
- Top-up vouchers - if you fund your in-account wallet balance by bank transfer, you may upload a payment receipt, transfer confirmation or screenshot (JPG/PNG/GIF/PDF, up to 5 files of 5 MB each) together with an optional note. These documents can contain bank account numbers, payer name or transaction references that appear on the receipt. They are used solely to manually verify your transfer and credit your balance; they are visible only to authorized Bit7s finance/administrative staff and are never shown to other users or third parties.
2.2 Data We Automatically Collect
When someone visits one of your marketing pages, a short link, or scans one of your QR codes, we automatically collect the following from the visitor:
| Data Point | Purpose | Retention |
|---|---|---|
| Raw IP address | Anti-abuse, unique visitor counting | 30 days |
| Country, region (state/province) & city (GeoIP, incl. ISO country code) | Aggregate analytics | 24 months (aggregated) |
| District / neighborhood (GeoIP, where available) | Aggregate analytics | 24 months |
| Latitude & longitude (approximate, from GeoIP) | Map-based location analytics | 30 days |
| ISP / network provider | Anti-abuse, aggregate analytics | 24 months |
| Timezone | Aggregate analytics | 24 months |
| Device type (mobile/desktop/tablet) | Analytics | 24 months |
| Device brand & model (parsed from User-Agent) | Analytics | 180 days |
| Operating System | Analytics | 24 months |
| Browser & version | Analytics | 24 months |
| Browser language (Accept-Language) | Analytics | 24 months |
| Referer | Traffic source attribution | 180 days |
| User-Agent string | Device/browser parsing | 180 days |
| Session identifier (non-persistent) | Unique visitor counting within a session | 180 days |
| URL query parameters (of the visited page) | Campaign attribution | 180 days |
| HTTP response status code | Service reliability monitoring | 180 days |
| Access timestamp | Time-series analytics | 24 months |
The same set of fields (IP address, country, region, city, device type, OS, browser, referer, User-Agent) is also collected when a visitor views or clicks an advertisement served through our ad platform, and is subject to the same retention schedule above.
When you make a payment (subscription or wallet top-up), we also record the IP address and User-Agent string of the device used to complete the transaction, solely for fraud prevention and payment security. These are retained as part of the payment record for as long as required by applicable tax and accounting law.
3. How Data Flows Through Our System
To be transparent about IP handling, here is the exact data lifecycle:
Raw IP address
↓
Short-term storage (30 days, for anti-abuse & unique visitor detection)
↓
GeoIP resolution (one-time lookup; resolved country/city is stored)
↓
Aggregation into statistics (country / city / device / OS / browser counts)
↓
Anonymization / aggregation (no IP, only counts)After 30 days the raw IP address and approximate latitude/longitude are permanently deleted from our logs. Detailed fields (referer, full User-Agent, device brand/model, session id, query parameters) are retained for 180 days. Only the resolved country, region, city, district, ISP, timezone, device type, OS, browser, language and aggregated counts are retained for up to 24 months for analytics. Individual access-log rows are deleted entirely after 24 months.
4. How We Use Your Data
- Provide short link, QR code, and marketing page features you requested.
- Generate aggregated analytics (views, unique visitors, clicks, CTR, geography, device).
- Prevent fraud, bot traffic, and abuse of the service.
- Send transactional emails (account verification, password reset).
- Manually verify bank-transfer top-ups against the vouchers you upload, maintain your wallet balance and its transaction ledger, and detect fraudulent or duplicated payment claims.
- Improve our product and measure aggregate usage trends.
- Sell your personal data or visitor data to third parties.
- Use visitor data for advertising profiles or cross-site tracking.
- Share your account information with marketing partners.
5. Data Retention
| Data Type | Retention |
|---|---|
| Raw IP addresses & approximate latitude/longitude | 30 days (then permanently deleted / anonymized) |
| Detailed access logs (referer, full User-Agent, device brand/model, session id, query parameters, response code) | 180 days (then fields are cleared; aggregate dimensions remain) |
| Aggregated analytics (country, region, city, district, ISP, timezone, device type, OS, browser, language — no IP) | 24 months |
| Uploaded images | Until you delete them |
| Account data | Until you request deletion |
| Payment records (order, amount, status, provider transaction ID; no card number) | As required by applicable tax and accounting law (card data handled by PayPal/Airwallex) |
| Top-up vouchers (payment receipts/screenshots you upload) | Up to 180 days after the top-up is approved or rejected, or longer only where the transfer is disputed or accounting/tax law requires retention; access restricted to authorized finance staff |
| Wallet balance ledger (top-ups, debits, purchases, adjustments) | As required by applicable tax and accounting law (append-only; not edited or deleted) |
6. Your Rights
Depending on where you live, you may have the following rights under CCPA (California), GDPR (EU/UK), or similar laws:
- Access - request a copy of your personal data.
- Deletion - request deletion of your account and all associated data.
- Correction - fix inaccurate information.
- Portability - receive your data in a machine-readable format.
- Opt-out - decline non-essential data processing.
To exercise any of these rights, email privacy@bit7s.com. We respond within 30 days.
Visitor IP data deletion: If you are a visitor (not a registered user) and wish to have the IP-address-based data we collected from you removed, you can submit an automated deletion request by sending a POST request to https://bit7s.com/api/privacy/delete-visitor-data from the IP address in question. The request must originate from the same IP you want removed. Aggregate, non-identifying analytics (country, device type, etc.) are retained for statistical purposes. You may also email privacy@bit7s.com for manual review.
7. Data Security
- Passwords are hashed using
pbkdf2_sha256(never stored in plain text). - All traffic is served over HTTPS / TLS 1.3.
- Database access is restricted to production servers with role-based permissions.
- Image uploads are stored in isolated object storage.
- Top-up vouchers are accessed only through the authenticated administrator review interface via unlisted, unguessable file URLs; they are never displayed to other users or indexed as site content. Access is limited to administrators with the finance review permission, and every approval, rejection and manual balance adjustment is logged with the administrator's note.
8. Cookies
We use only essential cookies (session and login state). No advertising or cross-site tracking cookies. See our Cookie Policy for details.
9. Payment Processors and Sub-Processors
Payments are processed by independent payment providers acting under their own privacy policies:
- PayPal (paypal.com) — payments made via a PayPal account, subject to the PayPal Privacy Statement.
- Airwallex (airwallex.com) — credit/debit card payments entered on Airwallex's secure hosted checkout, subject to the Airwallex Privacy Policy.
We share only the data necessary to complete a transaction: your email address, order number, selected plan, and the charge amount in USD. Bit7s never receives your full card number. The payment providers act as independent controllers of payment data and may process it in the jurisdictions where they operate. We do not use any China-based payment processors; Alipay and WeChat Pay are not accepted. The complete, current sub-processor list is maintained in our Data Processing Addendum.
10. International Data Transfer
Our production application and database servers are hosted in Singapore. Content delivery and DDoS protection are provided by Cloudflare's global edge network. By using the service you understand that your data is processed in Singapore and, for payment processing, in the jurisdictions where PayPal and Airwallex operate. We do not transfer service data to servers in the operator's home jurisdiction. Where transfers are subject to GDPR, we rely on appropriate safeguards, including Standard Contractual Clauses. See Company Information for our infrastructure layout.
11. Children's Privacy
The service is not directed to children under 13 (COPPA) or under 16 (GDPR). We do not knowingly collect data from children. If you believe a child has registered, contact privacy@bit7s.com.
12. Changes to This Policy
We may update this policy as the product evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced by email 30 days before taking effect.
13. Contact
Questions about this Privacy Policy or wish to exercise a GDPR, CCPA, or other data-protection right? Email our data protection contact at privacy@bit7s.com, or for legal matters legal@bit7s.com, or use our contact page. We respond within 30 days.