Subprocessors
These are the third parties that process data on our behalf when you use bklink. The list is exhaustive for services that touch customer data. We keep it current because a subprocessor list that quietly goes stale is worse than none — it is a statement people rely on when deciding whether to sign up.
Current subprocessors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting, CDN, DNS, outbound email, backup storage (R2) | All request traffic, account email for transactional mail, encrypted database backups | Global edge network; backups in Cloudflare R2 |
| Neon, Inc. | Managed PostgreSQL — the primary database | Account records, projects, campaigns, backlink data you submit, wallet ledger | United States |
| Stripe, Inc. | Payment processing for wallet top-ups and mxverify purchases (ad pills and followed links) | Billing name, email, payment method, transaction records | United States and global |
| Functional Software, Inc. (Sentry) | Error monitoring | Error events, request paths and pseudonymous account identifiers. Email addresses, credentials and share tokens are stripped before transmission | European Union (Frankfurt region) |
| DataForSEO LLC | Backlink and domain metric lookups | Domains and URLs you submit for audit. No account or personal data | United States and European Union |
| Litescrape LLC | Google search lookups for index checks and indexing verification | URLs you submit, sent as search queries. No account or personal data | United States |
| TypeSafe AI, Inc. | Jev judgements: classifying audit failures, flagging pages unlikely to be indexed, matching a page to its canonical address | URLs you submit and text read from those pages or from search results (titles, opening words, snippets). No account or personal data | United States |
| Ahrefs Pte. Ltd. | Domain Rating lookups | Domains you submit for audit. No account or personal data | Singapore |
| NicheObserver | Publication reach and audience estimates | Domains you submit for audit. No account or personal data | United States |
| DataFast | Privacy-focused, cookieless product analytics | Page paths, referrer and coarse device information. Report and password-reset URLs are excluded. For an mxverify purchase, its amount, linked to the buyer's visit by an anonymous visitor id | European Union |
| Minilytics (our own analytics, minilytics.app) | Web analytics and revenue attribution on bklink.uk, for visitors who accept the consent banner | Page addresses, referrer, screen width, time on page, clicks on outbound links and on sign-up and top-up buttons, two first-party cookie identifiers (ml_vid, ml_sid); Stripe payment events (amount, currency, email and the identifiers attached at checkout); for a signed-in visitor, the account identifier and email address. Report and password-reset URLs are excluded. No IP address is stored | Operated by us; served through Cloudflare |
| Brevo (Sendinblue SAS) | Email about mxverify to buyers who ticked the opt-in box before paying | Email address, the product bought, the website it was for, the amount and date paid, and which opt-in wording was agreed to | European Union (France) |
| Privatus Analytics | Privacy-focused, cookieless web analytics on mxverify.uk, including on-site surveys | Page paths, referrer, coarse device information, page-load timings, clicks on links and buttons, and answers to a survey if you choose to give one. No cookies; IP addresses are not stored | United States (operator: Two Phase LLC) |
| Google LLC | Web analytics on mxverify.uk (Google Analytics 4 under Consent Mode v2; ad features off); Web Risk checks of the website addresses advertisers submit | Page addresses, referrer, browser and device type, IP-derived approximate location; cookie identifiers only after a visitor allows analytics cookies; advertisers' website addresses | United States and global |
| Mixpanel, Inc. | Product analytics — how the app itself is used | Pseudonymous account identifier and bucketed product events (audit started, completed, blocked). No email address, no submitted URLs or domains, no report contents, no payment amounts | United States |
| X Corp. | Advertising measurement: the X conversion pixel on bklink.uk, for visitors who accept it | Page addresses, IP address, browser details and X's own cookie identifiers from bklink.uk page views; on sign-up, a pseudonymous bklink account identifier. No email address, submitted domains or URLs, report contents or payment amounts | United States |
| GitHub, Inc. (Microsoft) | Source control and the scheduled database backup job | Encrypted database backups in transit during the backup run | United States |
What is deliberately not on this list
Websites we fetch on your instruction are not subprocessors. When you submit a URL for audit, we request that page the way any browser would. The site's operator receives our request and their own logs record it, but they are not processing data for us and we have no agreement with them. This is also why you must only submit URLs you have a legitimate interest in auditing.
Changes
We will update this page before a new subprocessor starts handling customer data, and the date at the top of the page changes with it. If you have a written agreement with us that requires advance notice of subprocessor changes, that agreement governs and we will notify you as it requires.
To be told when this page changes, email support@bklink.uk.
Objecting to a subprocessor
If you have a reasonable, documented objection to a new subprocessor on data-protection grounds, tell us. We will try to offer a workaround. Where we cannot, you may stop using the affected functionality and request a refund of your unspent balance under the Refund Policy. We are a small operation and cannot promise to remove a provider the service depends on.
bklink is operated by Immortal Reality PA LLC, 6375 Penn Ave Ste B, Pittsburgh, Pennsylvania 15206, United States. Questions about this page: support@bklink.uk.