Privacy Policy

This notice explains what personal data Win Backlinks handles and why. It takes effect on the effective date shown with this version.

The operator of winbacklinks.com is the controller for account, billing, security, and product-usage data. For the contact details and page material a user brings into the service, the user decides what is collected and who is contacted, and the operator processes it on the user's instructions.

Privacy questions, requests, and complaints go to hello@winbacklinks.com.

The free page check on the home page needs no account. The service uses the two page addresses to run the check. The job record that holds them is deleted within about two days. The result and the counters, keyed by page host and by IP address, expire after at most 24 hours, and the cache removes expired entries during its routine cleanup. A security log may record the IP address and path of a request that a rate limit stops.

The service may handle account and authentication data, site and campaign settings, public-page research, professional contact details, draft and message content, provider events, billing identifiers, security logs, and product usage events.

The service is designed for professional corporate contacts. Users must not upload sensitive personal data, and must not contact sole traders or individual subscribers unless a lawful basis and an enabled product rule permit it.

Data is used to authenticate users, operate research and drafting workflows, enforce quotas and safety controls, take payment, support users, detect abuse, secure the service, and understand product reliability.

The legal bases are performing the contract with the user, meeting legal obligations such as tax and opt-out records, and the operator's legitimate interests in securing the service, preventing abuse, and understanding reliability. Where processing rests on consent, that consent can be withdrawn at any time.

Data reaches a subprocessor only when the feature that uses it is enabled and used. The Subprocessor List names each vendor and what it receives. Personal data is not sold and is not shared for advertising.

Google is an optional sign-in provider. A user who chooses Google sign-in has their name, email address, and Google account identifier passed to the service by Google; Google is an independent controller for the account data it holds, under its own privacy policy. Signing in with an email address and password does not involve Google.

Raw content is kept for 30 days: provider webhook payloads, received message bodies, and fetched page bodies. Structured research evidence is kept for 12 months. Operational audit records are kept for 24 months. A shorter period applies when a deletion request is honored; a longer one applies only where a legal obligation or legal hold requires it.

Suppression entries are kept for as long as they are needed to honor an opt-out. They are stored as one-way keyed fingerprints rather than as readable addresses.

Backups of the service are encrypted and stored off the server for up to 35 days. Data deleted on request can remain in those encrypted backups until they expire, and a restore re-applies every deletion made after the backup's date before the data is used again.

Access controls, encryption in transit, logging minimization, backups, and incident procedures are used as appropriate, but no system can guarantee absolute security.

Users may request access, a copy, correction, or deletion of their personal data from the privacy page in the account, or by writing to hello@winbacklinks.com. Requests are answered within 30 days, and a prepared export download expires 7 days after it is created.

Where regional law grants further rights — objection, restriction, portability, withdrawal of consent, or a complaint to a supervisory authority — those rights apply, and a user may complain to their local data protection authority at any time.

Vendors and infrastructure may sit outside a user's own country, so personal data may be transferred internationally. Those transfers rely on the standard contractual clauses or equivalent safeguards in the operator's agreement with each vendor.

A person who receives outreach prepared with the service may ask what data is held about them, or opt out, by writing to hello@winbacklinks.com. An opt-out is recorded as a suppression that stops further outreach from the sending site, and a provider-confirmed complaint or hard bounce stops it across the service.

The service is not for children. It requires an adult account holder and must not be used to process data about children.