1. Scope and responsibility
This Policy explains how xl.gl processes personal information when someone creates or uses a Publisher account, opens a Short Link, passes through an advertising or other intermediate page, submits a report, or contacts us. It also covers the link journey on gate and blog sites operated for the xl.gl Service, even if the underlying site has a different owner. A site owner may separately process information for its own purposes under its own notice. Independently operated Destination sites, advertisers, payment services and communication platforms have their own privacy practices.
In this Policy, Publisher means an account holder using our link tools, and Visitor means someone who opens a link or public page. We also refer to people who submit abuse or copyright reports as reporters. The operator and privacy contact are identified in section 12. This Policy describes data processing; the xl.gl/terms govern use of the Service and Publisher payments.
2. Information we collect
Information you provide. Publishers give us a username, email address and password when registering. They may provide Short Links, aliases, Destination URLs, account settings, support messages, payout instructions and information requested to review traffic or a payment. Account security features may produce authentication records. Reporters and other contacts provide the details in their submissions. A copyright notice may contain a name, contact details, signature, descriptions of protected work and reported URLs. If you contact us through email, WhatsApp, Telegram or X, we process what you choose to send and the information needed to reply; those platforms separately process your use of their services.
Information generated by use. We record registration and login IP addresses and security events. For link visits, we may record IP address, time, Short Link and Destination, referring host, approximate location, network or ASN, device and browser characteristics, journey steps, bot or fraud signals, and whether the visit qualified for Publisher earnings. We also keep link statistics, account balances, payout and transaction history, and referral relationships. A referrer may see a referred Publisher's username, joining date and commissions generated in the referral dashboard.
Information from others. Advertising and payment partners may send us billing, qualification, payment-status, fraud or chargeback information. Security and IP-intelligence services may provide network and risk assessments. We may receive information needed to investigate an abuse report or respond to a legal request.
Registration details are needed to operate an account. Payout details are needed to send a payment. A report needs enough information to investigate it; copyright notices may require additional information under the applicable procedure. A Visitor need not create an account to follow a Short Link, although certain technical information is necessary to serve and protect the link journey. We do not ask Publishers to provide routine identity or tax documents unless law or an external payment service requires them for a particular method.
3. Why we use information
Where EU or UK data-protection law applies, the following describes the usual legal grounds. Other regions may use different legal terminology or requirements. We do not treat acceptance of the Terms as consent to every use of data.
Purpose | Information used | Legal grounds |
|---|---|---|
Create and manage Publisher accounts, links and tools | Registration, authentication, links, settings and service records | Performance of our agreement with the Publisher; security may also rely on legitimate interests |
Deliver link journeys and keep them working | Link and Destination, IP address, browser/device and journey information | Legitimate interests in operating the Service for Publishers and Visitors |
Verify visits, prevent abuse, calculate earnings and referrals | Visit, network, security, attribution, account and partner reports | Agreement with the Publisher; legitimate interests in accurate accounting and fraud prevention |
Process payouts and keep financial records | Payout instructions, balance and transaction history | Agreement; legal obligations where applicable |
Answer contacts, reports and appeals; enforce rules | Submitted messages, report evidence and relevant account or visit information | Legitimate interests in support, safety and rights protection; legal obligations where applicable |
Provide advertising and measure its performance | Device, IP, page and ad-interaction data, identifiers and partner data | Consent for optional storage, access or tracking where required; other lawful grounds only where applicable to the particular processing |
Protect the Service and meet legal duties | Logs, account and visit signals, reports and relevant records | Legitimate interests in security and legal compliance; legal obligations where applicable |
Our legitimate interests include delivering requested links, maintaining reliable accounting, preventing fraud and malicious destinations, answering reports, and protecting the Service and its users. We consider the effect of those activities on the people concerned and respect applicable rights to object.
4. Cookies and similar technologies
Our sites and intermediate pages may use cookies, local storage, pixels and comparable technologies. Some keep you signed in, protect forms, remember security or account settings, preserve a link's required intermediate steps, or recognize a referral. The referral cookie normally lasts 90 days. Session, remembered-login and journey technologies have their own operational lifetimes; contact us for details about a particular site or technology. Blocking essential session or journey technology may prevent an account feature or link step from working.
Advertising and measurement partners may use identifiers and similar technology to select, deliver and measure ads, including across sites where permitted. We do not classify every referral, fraud-prevention or advertising technology as automatically essential. In locations where consent or another choice is required, our consent-management platform (CMP) presents the applicable purposes and configured partners, including participants in the IAB Europe Transparency & Consent Framework where used. The current configured list is the one presented in the relevant CMP.
You may use the CMP controls where shown to make or change applicable choices, and you can use browser controls to remove or block stored data. If you reject optional tracking, you may continue the link journey with limited contextual advertising in any region. That choice does not remove the technical processing needed to deliver the link and protect the Service. Contextual advertising is not a blanket exemption from cookie or privacy rules; optional technologies remain subject to the choices and requirements that apply to them.
5. Advertising, analytics and traffic decisions
Monetized Pages may display ads supplied by us or programmatic advertising partners. Depending on your choices and location, ads may be personalized or more limited and contextual. Partners may receive or collect information such as IP address, device or browser signals, page context, ad identifiers and interactions, and may use it under their own notices. Publishers may be represented to an ad or measurement partner by an attribution code. This does not mean every record is anonymous. We do not sell personal information for money. Some laws may nevertheless treat advertising disclosures as a “sale,” “sharing” or targeted advertising; relevant opt-outs are described in section 9.
We use technical and partner signals to classify visits, detect bots or artificial traffic, apply frequency and advertiser-eligibility rules, and calculate Publisher earnings. A visit may be non-payable because of geography, device, network characteristics, privacy or advertising restrictions, or a frequency limit; that alone does not mean the Publisher committed misconduct. These decisions can affect earnings or access to a link. A Publisher may ask for an explanation and challenge an invalid-traffic or earnings determination through support@xl.gl, providing relevant traffic-source information. We review the available evidence and any applicable advertiser decision. Requests to exercise any additional rights concerning automated decisions can be sent to the same address.
Publishers receive aggregated analytics such as visits, device and geographic information, and revenue. Standard analytics do not expose Visitor IP addresses or other direct Visitor identifiers. The referral dashboard may disclose the limited referred-account details described in section 2.
6. Who receives information
We disclose information as needed to operate the Service to infrastructure, email, security, fraud-prevention and IP-intelligence providers; advertising networks, advertisers, demand-side and measurement partners; and payment processors, exchanges or blockchain services. Their roles depend on the activity: some act for us, while others determine their own purposes and provide their own notices. We share relevant details with a Publisher or referrer only as described for analytics, accounts and referrals. When an account is legitimately shared or transferred, the people given access can see its account, link and payout information.
Cloudflare provides DNS and, where used, network delivery, security and Turnstile bot checks. Turnstile can process IP address, browser and connection signals. Cloudflare describes its processing in its Privacy Policy and Turnstile Privacy Addendum, including processing for its own purposes. We use specialist providers to assess traffic validity; their involvement is not limited to in-house analysis.
We may disclose relevant information to investigate a report, defend rights, comply with a lawful request or report serious illegal activity. Copyright notices or related information may be shared with affected parties or authorities where appropriate; do not assume a report is confidential in all circumstances. We may also transfer relevant records as part of a genuine sale, reorganization or transfer of the Service, subject to applicable law.
External payment providers may require identity or compliance checks to use a method. If you choose a blockchain payout, the wallet address and transaction information recorded on a public blockchain may be visible permanently and outside our control. Following a Short Link also takes you to an independently operated Destination, which can collect information under its own policy.
7. International processing
Our servers and backups are located in Germany and the United States. Our operator is established in the Marshall Islands. Advertising, security, payment and other independent providers may process information in additional countries under their own arrangements. A link journey may also involve a Destination in another country.
8. How long we keep information
We keep information for the following periods or criteria, subject to applicable law and a narrower need to preserve evidence for a particular unresolved case:
Detailed link-visit records - Target of 180 days
Referral cookie - 90 days unless removed earlier
Support messages - 24 months after resolution
Closed abuse and copyright cases - 36 months after case closure
Routine security and server logs - 90 days, unless a longer statutory log period applies
Account and financial histories - no automatic time-based expiry while needed for account continuity, balances, payouts, accounting, disputes or legal obligations; reviewed for ongoing necessity
Some laws may require particular access logs to be kept longer than ordinary operational logs. We retain the relevant category for the required period where that law applies. Summary statistics that no longer identify a person may be kept longer. Closing an account removes ordinary access but may not immediately erase ledger entries, payout history, substantiated abuse records or other information that remains necessary. We will assess deletion requests under the applicable law and remove or de-identify information when the reason for keeping it ends. If a backup contains information deleted from live systems, it will normally age out through the backup cycle rather than be edited in place.
9. Your choices and rights
You can update account details through available settings and make a privacy request at support@xl.gl. Depending on where you live and the circumstances, you may have rights to access, correct, delete or receive a copy of personal information; restrict or object to processing; withdraw consent; or challenge a relevant automated decision. Withdrawing consent does not invalidate earlier lawful processing. We may need to verify your identity before acting on a request, particularly where account or payout information is involved. We will respond within the time required by applicable law, separately from the Terms' process for commercial disputes.
Use the CMP where shown to control optional advertising and similar technology. Where local law gives a right to opt out of sale, sharing or targeted advertising, use the available CMP choice or email support@xl.gl with the request. We will apply the right to practices covered by that law and explain any limitation that applies. If our systems receive a browser privacy signal that applicable law requires us to honor, we will treat it as an opt-out for the covered processing. You may complain to a competent data-protection authority or other regulator where that right exists.
10. Security
We use reasonable technical and organizational measures to protect personal information, including access controls and supported account-security features such as two-factor authentication. We limit access according to operational need and address security incidents as required by applicable law. No online service can guarantee absolute security. Publishers should protect their credentials and report suspected account misuse promptly.
11. Children
Publisher accounts are for people aged 18 or older. Visitors aged 13–17 may follow links and use public reporting or contact functions where lawful. We do not target children under 13 or knowingly serve Short Links to them. We do not assume we know every Visitor's age. If we learn that an under-13 Visitor's information has been processed, we will stop knowingly serving that Visitor and assess deletion or any legally required retention. A parent or guardian can contact support@xl.gl about a child's information.
12. Operator, contact and changes
xl.gl is operated by Wef Development, Seed Series, Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro, MH 96960. For privacy questions or requests, contact support@xl.gl.
We may update this Policy when our practices, providers or legal obligations change. We will post the revised version with a new effective date and give additional notice or obtain new consent where applicable law requires it.