Legal
Privacy Policy
Last updated:
September 8, 2026
Who we are
K-COMBO s.r.o. ("Redirect Supply," "we," "us," or "our") operates the Redirect Supply platform at redirect.supply. We are registered in the Commercial Register maintained by the Regional Court in České Budějovice, file no. C 29936/KSCB, with our registered office at Okružní 709, České Budějovice 4, 370 01 České Budějovice, Czech Republic, VAT ID CZ09264396.
For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), K-COMBO s.r.o. is the data controller for the personal data described in this Privacy Policy, unless stated otherwise.
Two roles we play
Redirect Supply processes personal data in two distinct capacities, and it matters which one applies to you. As controller: when you create a Redirect Supply account, contact us, visit our website, or subscribe to our newsletter, we determine why and how your personal data is used, and this Privacy Policy governs that processing. As processor: when you use Redirect Supply to redirect a domain, our systems handle requests from your website’s visitors — their IP address, browser information, and the URL requested — purely on your instructions, to deliver the redirect service you’ve configured. In that relationship, you (our customer) are the controller of your visitors’ data, and we act only as your processor. That relationship is governed by our Data Processing Agreement, not this Privacy Policy.
What personal data we collect
Account data: name, email address, and any company or profile details you provide. We don't use passwords — you sign in either via a one-time magic link sent to your email (delivered through Resend), or via Google Sign-In, in which case Google shares your name and email with us according to your Google Account permissions. Billing data: if you're on a paid plan, billing details are collected and processed by our payment provider, Polar; we retain only your subscription status, plan, and transaction history, not full card details. Configuration data: the domains, redirect rules, and settings you create within the product. Support and sales communications: anything you submit through our Contact, Support, or Sales forms, including your name, email, company size, and message. Technical and usage data: IP address, browser/device type, and activity logs generated when you log in and use our dashboard, retained for security and troubleshooting. Website analytics: when you visit redirect.supply (outside the app itself), we use Google Analytics and Google Search Console to understand traffic and search performance — this only happens with your consent via our cookie banner. Cookies and similar technologies: see our Cookie Policy for full details.
Why we process your data, and our legal basis
To provide the service you've signed up for (performance of a contract, GDPR Art. 6(1)(b)). To let you create and access your account, including via magic link email or Google Sign-In (performance of a contract, Art. 6(1)(b)). To process payments and comply with accounting and tax obligations (legal obligation, Art. 6(1)(c)). To respond to support and sales inquiries (legitimate interest, Art. 6(1)(f)). To send service-related updates while your account is active, and marketing communications you can opt out of at any time (legitimate interest and consent, Art. 6(1)(f) and (a)). To understand and improve our website through analytics (consent, Art. 6(1)(a)). To maintain the security and integrity of our platform (legitimate interest, Art. 6(1)(f)).
Who we share data with
We share personal data with the subprocessors necessary to run Redirect Supply, each bound by a data processing agreement and instructed to use your data only for the purpose we specify. As of this policy’s last update, these include Cloudflare, Inc. (DNS, redirect delivery, network security), Supabase (application database and authentication), Resend (transactional email delivery, including magic link sign-in emails), Polar Software Inc. (billing and subscription management, paid plans only), and Google LLC (authentication via Google Sign-In, if you choose that login method; and website analytics and search performance via Google Analytics and Search Console — analytics only on the website, never inside the app). A complete, current list, including country of processing, is maintained on our Subprocessors page. We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
International data transfers
Your account and application data is stored in Ireland (EU) via our database provider, Supabase, and stays within the European Union. Some of our other subprocessors — including Cloudflare, Resend, Google, and Polar — may process data outside the European Economic Area as part of delivering their services (for example, Cloudflare's global network, or Resend and Google's US-based infrastructure). Where this happens, we rely on recognized legal transfer mechanisms, including the EU-U.S. Data Privacy Framework, which Cloudflare, Resend, and Google are certified under, and Standard Contractual Clauses where applicable.
How long we keep your data
We retain account data for as long as your account is active, and for a limited period afterward to comply with legal, tax, and accounting obligations — Czech law generally requires financial and invoicing records to be kept for up to 10 years. Support and sales inquiries are retained only as long as needed to resolve them, typically no longer than 24 months. Website analytics data is retained per Google Analytics' standard retention settings, which you can configure in your GA4 property. You can request earlier deletion of your account data at any time, subject to these legal retention requirements.
Your rights
Under the GDPR, you have the right to access the personal data we hold about you, correct inaccurate data, request deletion ("right to be forgotten"), restrict or object to certain processing, receive your data in a portable format, withdraw consent at any time where processing is based on consent, and lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz) or your local supervisory authority if you're based elsewhere in the EU. To exercise any of these rights, contact us at daniel@redirect.supply.
Cookies
We use cookies and similar technologies on redirect.supply. Strictly necessary cookies keep the site functioning and remember your cookie preference, and don't require consent. We also use Framer Analytics to understand overall site traffic — it doesn't use cookies or any tracking technology, only collects anonymized aggregate data, and runs regardless of your cookie choice. In addition, we use Google Analytics (_ga, _ga_*, _gid cookies, retained up to 13 months) for more detailed traffic analysis — this only runs if you click Accept in our cookie banner. You can change your choice at any time via the "Cookie Settings" link in our footer.
Security
We use technical and organizational measures — encryption in transit, access controls, and vetted subprocessors — to protect your data. More detail is on our Security & Compliance page.
Children's privacy
Redirect Supply is a business tool and is not directed at, or knowingly used by, anyone under 16. We do not knowingly collect personal data from children.
Changes to this policy
We may update this Privacy Policy from time to time. If changes are material, we'll notify active customers by email before they take effect.
Contact us
K-COMBO s.r.o., Okružní 709, České Budějovice 4, 370 01 České Budějovice, Czech Republic
Email: daniel@redirect.supply