Privacy.
What we collect, why, and how to make us stop.
Who we are
Theylink is operated by Linkos (the "data controller"), a company registered in Greece. Linkos also operates Linkrot and Stillinked on the same backlink index. Contact: [email protected].
What we collect when you use the site
- Comparisons you run — the two domains, when, and a one-way hashed IP used only for rate limits (10 comparisons a day for anonymous visitors). We never store the raw IP.
- Account data — your email address. There are no passwords; you sign in with a link we email you. We keep the sign-in tokens until they're used or expire.
- Payments — handled by Stripe. We store the payment id and the email you paid with; we never see or store card numbers.
- Analytics — first-party page views: page, referrer, device type, approximate country. No cross-site tracking, no advertising pixels.
- Email — sent through Resend: sign-in links, receipts, "your comparison is ready", and the weekly digest if you're on Unlimited. Every automated email has an unsubscribe link except receipts and sign-in links.
What we collect from the web
Our crawler, LinkosBot, reads public pages and stores link data: which page links to which URL, the anchor text, rel attributes, page titles, and when we last checked. We do not store page bodies. LinkosBot honors robots.txt and identifies itself as LinkosBot/1.0 (+https://linkos.bio/bot). Site owners can block it or ask us to remove a domain on the remove a domain page; we act within 48 hours.
Editor contacts
Paid comparisons show a contact for some linking pages: an email address found on that page's author byline or on the site's public about or contact page. This is personal data and we process it under legitimate interest (GDPR art. 6(1)(f)) — the interest being ordinary business-to-business outreach to a person who has published that address for exactly that purpose. We limit it as follows:
- Sourced only from public pages on the linking site. Never from LinkedIn, never from purchased lists, never guessed from name patterns.
- Shown only on unlocked rows, only to the buyer of that comparison, with a confidence score.
- Export is capped to the unlocked comparison. Contacts are never sold or licensed in bulk.
- Any address can be removed on the contact opt-out page. We delete it within 48 hours and add it to a suppression list so it is never re-extracted.
- Contacts we haven't re-verified on the source page in 12 months are deleted.
Who we share data with
Only processors that run the service, under contracts limiting them to our instructions: Hetzner (hosting, EU), Cloudflare (CDN and abuse protection), Stripe (payments), Resend (email). Page-type classification uses an AI provider; it receives page titles and URLs from the public crawl, never your account data or contacts. We disclose data otherwise only when the law requires it.
How long we keep it
- Account data: while the account exists, then deleted within 30 days of deletion.
- Comparisons: public comparison pages persist; they contain domain names, not personal data.
- Rate-limit hashes: 7 days. Analytics events: 13 months.
- Editor contacts: until opt-out, or 12 months without re-verification.
Your rights
You can ask for access, correction, export or deletion of your data, and object to processing based on legitimate interest — including having your address removed as an editor contact. Email [email protected] or use the forms linked above; we respond within 30 days. If you're in the EU/EEA or UK you can also complain to your supervisory authority; ours is the Hellenic Data Protection Authority.
Cookies
One session cookie when you're signed in, one Cloudflare cookie for abuse protection. No advertising cookies, so no cookie banner.
Changes
We'll post changes here with a new date. Material changes to how contacts are processed are announced by email to account holders.