Privacy — Theylink

Who we are

Theylink is operated by Linkos (the "data controller"), a company registered in Greece. Linkos also operates Linkrot and Stillinked on the same backlink index. Contact: the contact page (theylink.app/contact).

What we collect when you use the site

Comparisons you run — the two domains, when, and a one-way hashed IP used only for rate limits (10 comparisons a day for anonymous visitors). We never store the raw IP.
Account data — your email address. There are no passwords; you sign in with a link we email you. We keep the sign-in tokens until they're used or expire.
Payments — handled by Stripe. We store the payment id and the email you paid with; we never see or store card numbers.
Analytics — first-party page views: page, referrer, device type, approximate country. No cross-site tracking, no advertising pixels.
Email — sent through Resend: sign-in links, receipts, "your comparison is ready", and the weekly digest if you're on Unlimited. Every automated email has an unsubscribe link except receipts and sign-in links.

What we collect from the web

Our crawler, LinkosBot, reads public pages and stores link data: which page links to which URL, the anchor text, rel attributes, page titles, and when we last checked. We do not store page bodies. LinkosBot honors robots.txt and identifies itself as LinkosBot/1.0 (+https://linkos.bio/bot). Site owners can block it or ask us to remove a domain on the remove a domain page; we act within 48 hours.

Editor contacts

Paid comparisons show a contact for some linking pages: an email address found on that page's author byline or on the site's public about or contact page. This is personal data and we process it under legitimate interest (GDPR art. 6(1)(f)) — the interest being ordinary business-to-business outreach to a person who has published that address for exactly that purpose. We limit it as follows:

Sourced only from public pages on the linking site. Never from LinkedIn, never from purchased lists, never guessed from name patterns.
Shown only on unlocked rows, only to the buyer of that comparison, with a confidence score.
Export is capped to the unlocked comparison. Contacts are never sold or licensed in bulk.
Any address can be removed on the contact opt-out page. We delete it within 48 hours and add it to a suppression list so it is never re-extracted.
Contacts we haven't re-verified on the source page in 12 months are deleted.

Only processors that run the service, under contracts limiting them to our instructions: Hetzner (hosting, EU), Cloudflare (CDN and abuse protection), Stripe (payments), Resend (email), and Google — Analytics, only if you allow it in the cookie banner, and Sheets when you choose to export a comparison to your own spreadsheet. Page-type classification uses an AI provider; it receives page titles and URLs from the public crawl, never your account data or contacts. We disclose data otherwise only when the law requires it.

How long we keep it

Account data: while the account exists, then deleted within 30 days of deletion.
Comparisons: public comparison pages persist; they contain domain names, not personal data.
Rate-limit hashes: 7 days. Analytics events: 13 months.
Editor contacts: until opt-out, or 180 days after we last saw the address on a page — then deleted automatically.
Agency early-access enquiries: 2 years. “Tell me when it’s ready” addresses: deleted once the email is sent, or after 90 days if the comparison never finished.
Opt-out and domain-removal records: we keep the record — it is how we prove we acted — but the address on it is deleted after a year, and an opt-out never stores the address at all.

Your rights

You can ask for access, correction, export or deletion of your data, and object to processing based on legitimate interest — including having your address removed as an editor contact. Email the contact page (theylink.app/contact) or use the forms linked above; we respond within 30 days. If you're in the EU/EEA or UK you can also complain to your supervisory authority; ours is the Hellenic Data Protection Authority.

Cookies

One session cookie when you're signed in, one Cloudflare cookie for abuse protection, and a short-lived one during checkout so a payment can only be claimed by the browser that made it. No advertising cookies and nothing sold. Because we use Google Analytics we do ask: a banner offers it, nothing analytics-related loads until you say yes, and your answer is remembered in a first-party cookie for twelve months. “Cookies” in the footer reopens the choice at any time.

Changes

We'll post changes here with a new date. Material changes to how contacts are processed are announced by email to account holders.

Privacy.