Skip to content
2a.qa

Privacy & compliance

What 2a.qa stores about you, what it does not, and what you can make it delete. Written against Qatar's Personal Data Privacy Protection Law (PDPL); every claim below is something you can check from your own account.

What we collect

  • Your account: email and name.
  • Content you create: short links, your bio page, and any files you upload.
  • Minimal analytics: page and link visits. The visitor IP is kept for abuse prevention only and deleted after 90 days.
  • No third-party advertising or tracking pixels.

Right of access (data export)

  • Download a complete copy of your data as JSON at any time from Settings → Export my data.
  • The export excludes secrets (password hashes, API-key hashes, signing secrets).

Right to erasure

  • Deleting your account permanently removes your records from the database AND your uploaded files from disk — not just the account row.
  • Encrypted backups are kept on a rolling schedule and the oldest expires after 6 months, so a deleted record can remain in a backup until then; backups are only ever used to restore the service.
  • You can edit or correct your profile and content at any time.

IP minimisation

  • Page owners never see visitor IP addresses — only statistics (country, device, browser, referrer).
  • Full IPs are visible only to platform administrators for abuse investigation, and are removed entirely after the retention window.

Retention

  • Visit analytics: 90 days. Error logs: 30 days.
  • Pruning runs automatically every day; personal data is not kept beyond its purpose.

Encryption

  • All traffic is encrypted in transit (TLS).
  • File uploads support optional end-to-end (zero-knowledge) encryption — the server never sees the key.

Tamper-evident audit log

  • Every administrative action is recorded in a cryptographic hash chain.
  • Any later edit or deletion of a historical record breaks the chain and is detectable — integrity can be verified on demand.

Who else sees it

  • Maps on business cards are rendered on our own servers — visitors are never silently exposed to external map providers.
  • Encrypted off-site backups are taken hourly so your data survives hardware loss.
For any privacy request, reach us through your account settings or the “Report” link shown on every public page.
2a.qaLast updated: 2026-06