Privacy Policy

This Privacy Policy describes how MMX LLC, a New York limited liability company ("we," "us," or "our") collects, uses, and shares information about you when you use the Suppo.se link-shortening service (the "Service"). This policy supplements our Terms of Service.

1. Information We Collect

1a. Information you provide

• Account information. Email address, display name (if you set one), and authentication method (email/password or OAuth provider: Google, Facebook, Microsoft).
• Custom links. The destination URLs you submit, the custom slug (if chosen), and any title or metadata you attach.

1b. Information collected automatically

• Redirect events. When a visitor follows one of your custom links, we log: timestamp, full IP address, HTTP referrer (if any), user-agent string, and derived country/region. IP addresses are used for geolocation and abuse prevention.
• Service usage. Pages you visit on suppo.se, features you use, and actions you take (link creation, deletion, etc.).
• Device and browser information. Browser type and version, operating system, and language preference.
• Cookies and session tokens. See our Cookie Policy. Currently we set only strictly necessary authentication cookies.

1c. Information from third parties

• OAuth providers. If you sign in with Google, Facebook, or Microsoft, we receive your email address and display name from that provider. We do not receive passwords or payment information from OAuth providers.

2. How We Use Your Information

• To operate the Service: create and manage your account, store and serve your custom links, and process redirects.
• To provide analytics: aggregate click counts, geography, and referrer data visible to you in your dashboard.
• To communicate with you: transactional emails (account verification, password reset, important service notices).
• To enforce our Terms of Service and Acceptable Use Policy, including investigating reports of abuse.
• To improve the Service: understand how features are used and diagnose technical issues.
• To comply with legal obligations: respond to lawful requests from law enforcement or regulators.

3. How We Share Your Information

We do not sell your personal information. We share information only as follows:

• Service providers. Amazon Web Services (hosting, infrastructure, email via SES). These providers may access your data only to perform services on our behalf and are contractually required to protect it.
• Legal compliance. We may disclose information to law enforcement, regulators, or courts when required by law or to protect our rights, property, or safety.
• Business transfers. If MMX LLC is acquired, merged, or transfers substantially all its assets, your information may be transferred as part of that transaction. We will provide notice before such a transfer occurs.
• With your consent. We may share information for other purposes with your explicit consent.

4. Cookies

We use cookies as described in our Cookie Policy. Currently the Service sets only strictly necessary session cookies to maintain your logged-in state. We do not set advertising, tracking, or analytics cookies.

5. Your Rights and Choices

Access and portability

You may request a copy of the personal information we hold about you by contacting privacy@suppo.se. We will respond within 45 days.

Correction

You may correct or update your account information at any time through your account settings.

Deletion

You may request deletion of your account and associated personal information by contacting privacy@suppo.se or through account settings. Deleting your account does not deactivate your custom links — they continue to redirect indefinitely. Full log entries including IP addresses are deleted within 90 days of account deletion; aggregate click counts and geographic breakdowns are retained.

Opt-out of communications

You may unsubscribe from non-essential email communications using the unsubscribe link in any email. Transactional emails (security alerts, account verification) cannot be opted out of while your account is active.

European Economic Area (EEA), UK, and Swiss residents

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent laws, including:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten") in certain circumstances
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with your local supervisory authority

Our legal bases for processing are: contract (operating the Service for account holders); legitimate interests (security, abuse prevention, service improvement); and legal obligation (compliance with law enforcement requests).

California residents

Under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), California residents have additional rights. We do not sell or share personal information as defined under California law.

New York residents

MMX LLC is a New York entity. The New York SHIELD Act requires reasonable data security safeguards for New York residents' private information, which we maintain as described in Section 6.

6. Data Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest for sensitive credentials, and access controls limiting who can access production systems. No security measure is perfect; we cannot guarantee that data will never be accessed, disclosed, altered, or destroyed.

7. Data Retention

We retain account information and redirect event logs for the lifetime of your account. Upon account deletion, full log entries (including IP addresses) are deleted within 90 days; aggregate, anonymized click counts and geographic breakdowns are retained indefinitely. Records required for legal compliance are retained for up to seven years.

8. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, contact privacy@suppo.se and we will delete it promptly.

9. International Data Transfers

MMX LLC is based in New York, NY. The Service is operated on Amazon Web Services infrastructure primarily in the United States. If you are located outside the U.S., your information will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland to the U.S., we rely on Standard Contractual Clauses (SCCs) incorporated in AWS's Data Processing Addendum.

10. Third-Party Links

Custom links created on this Service point to third-party websites. We are not responsible for the privacy practices of those websites. This policy applies only to suppo.se itself.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page. For significant changes, we will provide additional notice such as an email notification. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

For privacy questions, requests, or complaints, contact us at privacy@suppo.se.

MMX LLC · 4704 E Bluff Dr · Penn Yan, NY 14527