Privacy Policy
Effective 19 October 2026. This policy is a starting template: have it reviewed for your jurisdiction before relying on it.
1. Who is responsible
The controller of your personal data is the company that runs Backlink Monitor:
2. What we collect
- Account data: your e-mail address, your name if you add it, and a salted hash of your password (we never store the password itself). If you were brought by a referral link, the account of the person who sent you.
- Monitoring data: the linking-page and target URLs, anchors, projects and domains you add, and the results of our checks (state, HTTP status, robots and canonical values, a snippet of the link's HTML, timestamps).
- Alert channels: e-mail addresses, Telegram chat ids, Slack/Discord/webhook addresses you add so we can reach you.
- Billing data: your plan and the identifiers our payment processor gives us (customer and subscription ids). Your card details go to the processor, never to us.
- Support: the messages you send through the ticket system.
- Free checker: the two URLs you check and the result, kept so the result can be shared by its link.
- Technical data: your IP address, browser type and request times in server logs, used for security, abuse prevention and rate limiting.
We do not read the pages we check for anything other than the link, robots and canonical information described above, and we do not sell your data.
3. Why we use it
- To provide the service you asked for (contract): run checks, send alerts and summaries, show reports, handle billing and support.
- To keep the service safe and working (legitimate interest): prevent abuse, limit request rates, fix faults, count how many links each plan uses.
- To follow the law (legal obligation): tax and accounting records, answering lawful requests.
- Product e-mails: confirmations, alerts and the weekly and monthly summaries are part of the service; you can switch the summaries off under Notifications. We do not send marketing e-mail unless you ask for it.
4. Cookies
We use one cookie that is strictly necessary to sign you in, so it needs no consent. We use no advertising cookies. We use Google Analytics to count visits on every page of the site, including your account. It sets the cookies listed below from your first visit; Google receives the page address and basic technical data (such as your IP address and browser), and we only see aggregated counts. If you press Decline in the banner, it keeps running without cookies and without identifiers. Your choice is kept in your browser (local storage), not in a cookie, and you can clear it at any time to be asked again.
| Cookie | Purpose | Lifetime |
|---|---|---|
bm_session | Keeps you signed in and protects forms against forgery. HttpOnly, SameSite=Lax, Secure on https. Always on. | 14 days, or until you log out |
_ga, _ga_* | Google Analytics: tells visits apart and counts pages viewed. Set only after you accept. | Up to 2 years |
Referral links carry the referrer's code in the address while you sign up instead of in a cookie.
5. Who else handles data
We use a small number of providers (processors) to run the service, and give them only what they need:
- Our hosting provider (servers, database, backups).
- E-mail delivery for confirmations, alerts and support replies.
- Telegram, Slack or Discord if you connect them (we send alert text there).
- Our payment processor if you buy a plan.
- A search-results API provider, which receives linking-page URLs when Google index checks are enabled.
- Google Analytics (Google Ireland Limited and Google LLC), on our public pages: cookie-free counting for every visitor, cookies only for visitors who accept.
We disclose data to authorities only when the law requires it, and we never sell or rent personal data.
6. International transfers
Some providers are in other countries. Where data leaves the UK or the EEA we rely on adequacy decisions or standard contractual clauses.
7. How long we keep it
- Account, links, history, channels, reports, tickets: until you delete them. User settings → Delete account removes all of it; backups are overwritten on their normal cycle.
- Free checker results: 90 days, then deleted automatically.
- Server logs: up to 90 days.
- Invoices and payment records: as long as tax law requires.
8. Your rights
Depending on where you live (for example under the UK or EU GDPR) you can ask us to: give you a copy of your data, correct it, delete it, restrict or stop using it, and move it to another service. You can already export your links (CSV), correct your details and delete your account yourself in the dashboard. For anything else write to [email protected]; we answer within one month. You may also complain to your data-protection authority (in the UK, the Information Commissioner's Office).
9. Security
Passwords are hashed, API keys are stored only as hashes, sessions use signed cookies, forms are protected against forgery, connections use HTTPS, and our crawler cannot reach private network addresses. No system is perfectly secure; tell us at [email protected] if you find a problem.
10. Children
The service is for people aged 18 and over. We do not knowingly collect data from children; if you think we have, write to us and we will delete it.
11. Changes and contact
If we change this policy in a way that matters, we tell you by e-mail or in the dashboard before it applies, and update the date at the top. Questions about privacy: [email protected].