1. Data Controller
The data controller for the personal data processed through the Yabrix website and services (the “Service”) is CAHAMS INTERNET S.L., with registered office at Calle General Díaz Porlier, 48, 1A, 28001 Madrid, Spain, Tax ID ESB85084317, registered with the Commercial Registry of Madrid, Volume 24,243, Page 157, Section 8, Sheet M-435744.
For any questions regarding this Privacy Policy or the processing of personal data, you may contact us at:
📧 info@yabrix.com
2. Categories of Personal Data Processed
Yabrix processes only the personal data necessary to provide, operate, secure, and improve the Service, as described in this Privacy Policy. Under no circumstances does Yabrix intentionally process special categories of personal data as defined under Article 9 of the GDPR, nor data relating to criminal convictions or offences.
Depending on the interaction with the Service, the following categories of data may be processed:
- Account data: name, email address, login credentials
- Billing data: billing address, payment status (payments are processed by third-party providers)
- Technical and usage data: IP address, timestamps, user agent, page URLs, destination URLs, referrer information, and request data
- Short-link and QR-code interaction data, including link or QR interactions and redirect events
- Campaign attribution data, including UTM parameters where applicable
- Device, browser, operating system, and approximate geographic information derived from technical request data
- Configuration and preference data related to the Service
IP addresses may be processed transiently where technically necessary to provide the Service, derive privacy-preserving analytics, ensure security, prevent abuse, or determine approximate geographic information. Yabrix does not use IP addresses to identify individual visitors and does not store full IP addresses as part of its analytics or link-interaction datasets.
Mandatory fields indicated in registration or contact forms are required to provide the requested service.
3. Data Subjects and Responsibility
Depending on the context, Yabrix may process data relating to:
- Customers (organizations or individuals with a Yabrix account)
- Authorized users acting on behalf of a customer
- Website visitors whose data is processed through the analytics Service on customer websites
- Individuals who access short links, scan QR codes, or otherwise interact with links created through Yabrix Links
Customers are responsible for ensuring that their use of the Service complies with applicable data protection laws, including obtaining any required user consent.
By providing personal data, you confirm that you are legally authorized to do so and that the information provided is accurate, complete, and up to date.
When Yabrix processes analytics or link-interaction data on behalf of a Customer, the Customer generally acts as data controller and Yabrix acts as data processor, as further described in the Yabrix Data Processing Agreement (DPA).
For certain processing activities necessary to operate and protect the Yabrix platform, manage accounts, prevent fraud and abuse, ensure infrastructure security, comply with legal obligations, or establish, exercise, or defend legal claims, Yabrix may act as an independent data controller.
4. Purpose and Legal Basis of Processing
Yabrix processes personal data for the following purposes and legal bases:
4.1. Provision of the Service
To create and manage user accounts and provide the requested Yabrix functionality, including analytics, dashboards, short links, redirects, QR codes, custom domains, APIs, campaign attribution, and related features.
Legal basis: Performance of a contract (Article 6.1.b GDPR), where Yabrix acts as data controller.
4.2. Communications and Support
To respond to inquiries, provide technical support, and communicate service-related information.
Legal basis: Legitimate interest (Article 6.1.f GDPR) and/or performance of a contract.
4.3. Commercial Communications
To send product updates or commercial communications when explicit consent has been granted.
Legal basis: Consent (Article 6.1.a GDPR).
You may withdraw consent at any time.
4.4. Analytics, Link Measurement and Attribution
Yabrix provides privacy-focused analytics and measurement functionality for websites, short links, QR codes, redirects, and campaigns. Depending on the Service used, this may include processing technical request information, referrers, campaign parameters, device information, approximate geographic information, and interaction events.
By default, Yabrix analytics are designed to operate without cookies or invasive tracking techniques. Where required by law or explicitly enabled by the Customer through a valid consent mechanism, Yabrix may use cookies or a persistent identifier (such as a visitor UUID) to enable additional functionality or improve measurement accuracy.
Where Yabrix processes this information on behalf of a Customer, the Customer is responsible for determining the applicable legal basis and for providing any required notices or obtaining any required consent. Yabrix processes such data in accordance with the Customer's instructions and the DPA.
4.5. Security, Fraud and Abuse Prevention
Yabrix may process technical request data, IP addresses, link and domain information, account activity, and related security signals where necessary to protect the Service, detect and prevent phishing, malware, spam, fraud, abusive traffic, unauthorized access, and other prohibited or harmful activity.
This processing may include automated security and abuse-detection mechanisms and may result in links, domains, API credentials, or accounts being temporarily restricted or disabled where necessary to protect users, third parties, or Yabrix infrastructure.
Legal basis: Yabrix's legitimate interests in protecting the security, integrity, availability, and reputation of the Service and preventing fraud and abuse (Article 6.1.f GDPR), and compliance with legal obligations where applicable (Article 6.1.c GDPR).
4.6. Google Analytics and Google Search Console Integrations
Yabrix may allow users to connect their Google accounts in order to import reporting and search-performance data from Google Analytics and Google Search Console into the Yabrix platform.
These integrations are available only when a user explicitly authorizes access through Google OAuth.
Depending on the features enabled, Yabrix may access the following categories of Google user data:
- Google account identifiers and basic account metadata required to complete and maintain the OAuth connection
- Google Analytics property and reporting data made available to Yabrix through the Google Analytics Data API
- Google Search Console site and performance data made available to Yabrix through the Search Console API
- Technical authentication data such as access tokens, refresh tokens, token expiry timestamps, and connection status metadata
Yabrix uses this data only for the following purposes:
- to authenticate the user and establish the requested Google integration
- to retrieve analytics and search-performance data requested by the user
- to display dashboards, reports, summaries, comparisons, alerts, or other user-facing product features inside Yabrix
- to maintain, secure, troubleshoot, and improve the specific integration features requested by the user
Yabrix does not use Google user data obtained through these integrations for advertising, profiling for advertising purposes, resale, or data brokerage.
Yabrix does not use Google user data obtained through these integrations for any purpose that is not clearly disclosed in this Privacy Policy and, where applicable, in the product interface presented to the user at the time of connection.
Legal basis: performance of a contract (Article 6.1.b GDPR), and where required, consent (Article 6.1.a GDPR).
4.7. Limited Use of Google User Data
Where Yabrix accesses Google user data through Google APIs, Yabrix will use that data in accordance with the Google API Services User Data Policy, including the Limited Use requirements where applicable.
Google user data obtained through Google APIs will only be used to provide or improve user-facing functionality that is visible and relevant to the user in the Yabrix application.
Yabrix does not sell Google user data.
Yabrix does not transfer Google user data to third parties except:
- as necessary to provide or secure the requested service through subprocessors acting on Yabrix’s behalf and under contractual confidentiality and data-protection obligations
- where required by law
- where necessary to investigate abuse, fraud, or security incidents
Yabrix does not allow humans to read Google user data except:
- where necessary to provide support requested by the user
- where necessary for security, fraud prevention, or debugging
- where required by law
5. Data Retention
Yabrix retains personal data only for as long as necessary for the purposes for which it is processed, taking into account the nature of the data, the applicable Service or plan, legal obligations, security requirements, and contractual commitments.
Account and billing-related data may be retained for the duration of the customer relationship and for any additional period required by applicable legal, accounting, tax, or dispute-resolution obligations.
Analytics and link-interaction data is retained according to the retention period applicable to the Customer's Service or plan, as displayed on the Yabrix website or within the Service. Data may be aggregated, anonymized, or deleted when the applicable retention period expires.
Full IP addresses are not stored as part of Yabrix analytics or link-interaction datasets. IP addresses may be processed transiently or retained for a limited period in security or infrastructure logs where necessary for security, fraud prevention, abuse detection, troubleshooting, or legal compliance.
Where cookies or persistent identifiers are enabled by a Customer, their use and retention depend on the applicable functionality and the Customer's configuration and consent requirements.
For Google integrations specifically:
- OAuth tokens and connection metadata are retained for as long as the integration remains active, unless earlier deletion is requested.
- Imported Google Analytics and Google Search Console data is retained for as long as necessary to provide the related reporting and analytics features to the Customer, subject to the Customer's subscription settings, deletion requests, legal obligations, and legitimate backup requirements.
- When a user disconnects a Google integration, Yabrix will stop new data collection from that Google account and will delete or anonymize related credentials within a reasonable period, unless retention is legally required.
- Backup copies may persist temporarily for security and disaster-recovery purposes and are deleted according to Yabrix's backup retention cycle.
6. Data Recipients and Processors
Yabrix may share or make personal data available to trusted service providers where necessary to operate, secure, and deliver the Service.
These providers may include:
- Hosting and infrastructure providers used to operate Yabrix services and store or process Service data.
- Content delivery, DNS, network security, and traffic protection providers used to improve performance, availability, and security of Yabrix websites, short-link domains, and custom domains.
- Payment service providers used to process subscriptions and payments.
- Email and communication service providers used to deliver transactional, account, support, and service-related communications.
Service providers process personal data only to the extent necessary to provide their respective services and are subject to appropriate contractual and data protection obligations.
Where a service provider processes personal data outside the European Economic Area, Yabrix ensures that an appropriate transfer mechanism or safeguard is in place in accordance with applicable data protection law, such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or Standard Contractual Clauses.
Yabrix does not sell personal data to third parties.
7. International Data Transfers
Where personal data is transferred outside the European Economic Area, Yabrix applies the safeguards required by applicable data protection law. Depending on the destination and provider, these safeguards may include an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission, or other legally recognized transfer mechanisms.
8. Data Subject Rights
You have the right to:
- Access your personal data
- Request rectification of inaccurate data
- Request erasure of your data when no longer necessary
- Request restriction of processing in certain circumstances
- Object to processing based on legitimate interests
- Request data portability where applicable
Requests may be made by email or postal mail, provided that proof of identity is supplied where necessary.
Because Yabrix is designed to minimize the collection of identifiable visitor data, in some cases we may not hold sufficient information to identify or locate data relating to a particular website visitor or link user. Where Yabrix processes personal data solely on behalf of a Customer, requests relating to that data may be referred to or handled in coordination with the relevant Customer as data controller.
Users who connect Google integrations may, subject to applicable law and technical limitations:
- request information about the Google user data processed by Yabrix
- request deletion of imported data associated with their account
- disconnect Google Analytics or Google Search Console integrations from within the Yabrix product or by contacting Yabrix support
- revoke Yabrix’s access from their Google account permissions settings
You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD):
https://www.aepd.es/
9. Security Measures
Yabrix implements appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, loss, or disclosure.
While no system can guarantee absolute security, Yabrix continuously reviews and improves its safeguards.
10. Confidentiality
All personal data is treated as confidential and accessed only by authorized personnel and service providers acting under Yabrix’s instructions.
11. Changes to this Privacy Policy
Yabrix may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by other reasonable means.
Continued use of the Service after an update constitutes acceptance of the revised Privacy Policy.
12. Contact
For any questions regarding this Privacy Policy or data protection matters: Contact