Privacy Policy

This policy explains what bklink collects and why. The operator and data controller is Immortal Reality PA LLC, 6375 Penn Ave Ste B, Pittsburgh, Pennsylvania 15206, United States.

When we are the controller, and when we are not

This distinction decides which rules apply, so it is worth stating before anything else:

• Your account, billing and usage data — we decide what to collect and why. We are the controller and this policy governs it.
• Material you submit for audit — backlink lists, URLs and uploaded documents. You decide what goes in; we act on your instructions. You are the controller and we are your processor. If you are a business, our Data Processing Addendum governs that relationship and applies automatically.
• Domain data we buy from vendors — ratings, metrics, reach estimates. We obtain this independently of you, about domains rather than about people, so we are an independent controller of it.

What we collect

Account data. Your email address and a hashed password. We never store your password itself — it is hashed with PBKDF2-SHA256 and cannot be reversed.

Data you submit. The backlink URLs, domains, publication names, campaign names and any spreadsheets or documents you upload for auditing.

Data we generate. Audit results, report snapshots, and the valuation figures derived from them.

Billing data. Your wallet balance, a record of each charge, and Stripe payment and session identifiers. We never see or store your card number — that is handled entirely by Stripe on their own pages.

Activity data. A log of actions taken in your account: sign-ins, audits started and finished, and the vendor cost of each. Sign-in records include your IP address, which we use to rate-limit password guessing.

Usage data. We use DataFast, a privacy-focused analytics service, to count page views and understand which pages people find useful. It is cookieless — it sets nothing on your device and does not follow you across other websites. It receives the address of the page you viewed, your approximate location from your IP address, and your browser type.

We deliberately do not load it on two kinds of page, because their web address is itself a secret: a shared report link (/share/…) and a password reset link. Those addresses are never sent to DataFast or anyone else.

Google Analytics on mxverify.uk, with cookies only if you agree. mxverify.uk uses Google Analytics 4 to see how visitors find and use its pages. It runs in Google's Consent Mode: until you choose, and if you choose No, it sets no cookies and sends Google only cookieless signals — the address of the page, the page you came from, your browser and device type, and your IP address, from which Google estimates your approximate location (Google Analytics 4 does not store IP addresses). If you choose Allow in the small "Allow analytics cookies?" pill, it also sets the cookies _ga and _ga_7B1W78CBHJ, which last up to two years and let Google recognise a returning visit. Advertising features stay off: we never allow ad storage, ad user data or ad personalisation. Google Analytics is not loaded at all if your browser sends Global Privacy Control. We remember your answer for six months in a cookie called mx_consent, which holds only "analytics" or "none"; "Cookie choice" at the foot of every mxverify.uk page lets you change it, and choosing No deletes Google's cookies. bklink.uk does not load Google Analytics.

Advertising measurement (X), only if you agree. We advertise on X (formerly Twitter) and would like to use X's conversion tracking pixel to measure whether those ads lead to visits and sign-ups. When you first visit bklink.uk, a banner asks. Only if you choose Accept does your browser load X's script from static.ads-twitter.com on the pages of bklink.uk — including pages you see when signed in — except shared report links and password reset links. It sends X the address of the page, your IP address, your browser's details and X's own identifiers, and it sets two cookies on bklink.uk, _twpid and _twsid, which last about 13 months. X uses this under its own privacy policy and may link it to what it already knows about you if you use X. mxverify.uk does not load it. From 22 September 2026 until this version of the policy, the pixel loaded for every visitor without asking.

If you have accepted and you create an account, we also set a cookie called bk_x_signup. It holds your bklink account identifier — a random code, not your email address — for at most 10 minutes. The next page you open reports the sign-up to X with that identifier and deletes the cookie. We never send X your email address, your reports or any payment amount. The page addresses X receives are the ones in your browser's address bar, so a published report's address, which can carry the report's name, reaches X when you open it.

Your choice. We remember your answer for six months in a cookie called bk_consent, which holds only "ads" or "none", and then ask again. If your browser sends Global Privacy Control, we treat it as a no and do not ask. You can change your answer at any time, or use "Your privacy choices" at the foot of our pages. Declining deletes X's cookies from bklink.uk. You can also turn off ad personalisation in your X settings. The service works the same either way.

Cookies on bklink.uk. Clerk, our sign-in provider, sets cookies such as __client_uat and, once you sign in, __session, which tell our pages whether you are signed in; they are strictly necessary to deliver a service you asked for. bk_consent remembers your answer to the banner. The X cookies and bk_x_signup are described above.

From 24 to 29 September 2026 we also set a cookie, bk_lp, on a first visit to our homepage while we compared two versions of it. It held only the letter of the version shown ("a" or "b"), whether the visit came from one of our ads, and whether the sign-up page was opened afterwards; it contained no identifier and could not tell one visitor from another. That comparison has ended. We no longer set the cookie and we ignore one already in your browser; it expires 30 days after it was set, and you can delete it at any time in your browser settings. The records it produced — that a version was shown, and that the sign-up page was opened — were made without your IP address, and we keep them as they are.

DataFast is cookieless and stores nothing on your device. The X pixel, and Google Analytics on mxverify.uk once you allow its cookies, are not; see above.

Why we collect it, and our legal basis

Under the UK and EU GDPR every use of personal data needs a lawful basis. Ours:

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not — but you can object, and we will stop unless we have compelling grounds not to. Where we rely on consent, you can withdraw it at any time without affecting what came before.

Who we share it with

We share the minimum necessary with the following processors, and, if you accept its pixel, with X as described above. We do not sell personal data.

• DataForSEO — receives the domains you audit, to return backlink and authority data.
• Ahrefs — receives the domains you audit, to return Domain Rating.
• Litescrape — receives the URLs you check or ask us to index, as Google search queries, to tell us whether Google has indexed them.
• TypeSafe — receives URLs you submit and text read from those pages or from search results, so its Jev model can classify why a link failed, flag pages unlikely to be indexed, and match a page to its canonical address. It does not train on this input.
• Cloudflare — hosts the service and resolves DNS for the domains audited.
• Neon — hosts the database.
• Stripe — processes payments and receives your payment details directly from you.
• Sentry — receives error reports, which may incidentally contain account identifiers.
• DataFast — receives page addresses, approximate location and browser type for analytics. Cookieless; not loaded on share or password-reset links.
• Google — on mxverify.uk only: receives page addresses, the referring page, browser and device type and your IP address for Google Analytics, and, if you allow analytics cookies, its own cookie identifiers. Ad features are off. Not loaded under Global Privacy Control.
• Mixpanel — receives a pseudonymous account identifier and bucketed product events, so we can see where the product itself is confusing or failing. It never receives your email address, the domains or URLs you submit, your report contents, or any payment amount.
• X Corp. — only if you accept its pixel: through it, on bklink.uk, receives page addresses, your IP address, browser details and its own cookie identifiers, and, when you sign up, your pseudonymous bklink account identifier. X uses this under its own privacy policy as well as for us; it is not only our processor. Not loaded on mxverify.uk, shared report links or password reset links.

We also fetch the URLs you submit directly from the publications hosting them. Those sites will see a request from us, identified as a browser user agent, in the ordinary course of serving a page.

The full list, with each provider's purpose and location, is at /legal/subprocessors. We update that page before a new provider starts handling customer data.

International transfers

We are established in the United States and several providers are too. Where personal data originating in the UK, the EEA or Switzerland is transferred outside it, we rely on:

• the Standard Contractual Clauses approved by the European Commission — Module 2 (controller to processor) where a provider processes on our behalf, and Module 1 (controller to controller) where they act independently;
• the UK International Data Transfer Addendum for data originating in the United Kingdom;
• the equivalent Swiss provisions for data originating in Switzerland;
• the EU–US Data Privacy Framework where a provider is certified under it, in addition to the Clauses rather than instead of them.

Not everything leaves the EEA. Our error monitoring is hosted in the European Union, so error data stays there. DataFast, our analytics provider for both sites, is also EU-based; Google Analytics on mxverify.uk is not, and relies on the mechanisms above. Where we hold data in the United States — the primary database, payment records — the Clauses above are the transfer mechanism.

How long we keep it

Deleted data is not selectively removed from backups. It rolls off within 30 days as the backups age out. We do not restore deleted data from a backup on request, which is the same rule that stops it being resurrected by an unrelated restore.

Your rights

You can:

• Access your data — reports are downloadable from the app, and you can request a full export.
• Delete your data — individual campaigns and your entire account can be deleted from within the app, without contacting us. Deletion is permanent and we cannot restore it.
• Correct inaccurate data, or object to or restrict processing.

• Port your data — request it in a structured, machine-readable form.
• Withdraw consent where we relied on it, at any time.

We apply all of these to everyone, regardless of where you live, and we will not discriminate against you for exercising a privacy right — no worse price, no degraded service. To exercise any of them, email support@bklink.uk from the address on your account. We respond within 30 days, and will tell you if we need longer and why. We may need to verify who you are before acting, which for an account holder normally means emailing from the account address.

If we get it wrong, you can complain to a regulator. In the UK that is the Information Commissioner's Office; in the EEA it is the supervisory authority where you live or work. We would rather you came to us first, but you are not required to.

If someone contacts us about data a business customer controls — material they uploaded — we will not answer substantively. We will refer you to them and tell them you asked, unless the law prevents us.

California

We do not sell personal information for money. From 22 September 2026 until this version of the policy, the X pixel described above sent X identifiers and internet activity from bklink.uk for every visitor, to measure our advertising on X, which California law may treat as "sharing" for cross-context behavioural advertising. It now loads only if you accept it. To opt out of that sharing, choose Decline under "Your privacy choices"; we also treat a Global Privacy Control signal as an opt-out. We do not use or disclose sensitive personal information beyond what is necessary to provide the service.

The categories we collect are identifiers (email, IP address, cookie identifiers), commercial information (transactions and wallet activity), internet activity (pages viewed within the service), and the content you choose to upload. Why we collect each, who receives it, and how long we keep it are set out above and apply equally to California residents. California residents may exercise the rights listed above, including the right to know, delete, correct, and to appeal a refusal — email us and say you are appealing, and a different person will review it.

We are a small business and may fall below the thresholds at which some of these obligations formally apply. We honour the rights either way rather than work out whether we have to.

Security

Passwords are stored only as a salted one-way hash. Sessions are signed, HTTPS-only, expiring, and revocable by you at any time. All traffic is encrypted in transit and accounts are isolated at the database layer. Backups are encrypted and tested by restoring them rather than assumed to work.

The full description — including what we do not have — is on the Security page. It is kept separate deliberately: specific implementation details belong somewhere we can update them as we improve them, not frozen into a policy document that becomes inaccurate the moment we change an algorithm.

Two limits worth stating here anyway. Recovery granularity is about one day, so a worst-case restore would lose work done since the last nightly backup. And deletion is deliberately permanent — we do not restore deleted data from a backup on request. Keep your own copy of anything you cannot afford to lose.

If there is a breach

If we become aware of a security incident affecting your personal data, we will investigate and contain it, and notify you without undue delay. Our notice will say what happened, what data was involved, what we have done about it, and what we suggest you do. Where the law requires it we will notify the relevant supervisory authority — in the EEA and UK, within 72 hours of becoming aware where the incident is notifiable. For business customers whose data we process, the Data Processing Addendum sets a 48-hour notification commitment to you.

Children

The service is not directed at children and you must be at least 16 to hold an account. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

Changes

We will post any update here and change the date at the top. If a change materially affects how we handle your data, we will email the address on your account.

Contact

Immortal Reality PA LLC
6375 Penn Ave Ste B, Pittsburgh, Pennsylvania 15206, United States
support@bklink.uk