Privacy Policy — Exchange Backlink

1. Who We Are

Exchange Backlink ("we", "us", or "our") operates exchangebacklink.com, a platform that helps website owners build backlinks through intelligent 3-way matching. We are the data controller for the personal information collected through this platform.

If you have questions about this policy, contact us at contact@exchangebacklink.com.

2. What Data We Collect

Account Data

Name, email address, and password (hashed). If you sign up via Google OAuth, we receive your Google account name, email address, and Google user ID — we never see your Google password.

Website & Content Data

URLs, domain names, self-reported metrics (DR, DA, spam score, monthly traffic), niche categories, topic tags, and descriptions you enter for your websites.

Activity Data

Exchange deal activity, messages sent within deals, link submission URLs, verification attempts, and trust score changes.

Technical Data

IP address, browser type, and session data stored securely in our database. We use Cloudflare Turnstile for bot protection on public forms — it processes a minimal fingerprint without intrusive tracking.

Payment Data

If you upgrade to a paid plan, payment is processed by Stripe. We store only your Stripe customer ID and subscription status. We never see or store your card details.

3. How We Use Your Data

To create and manage your account
To run the matching algorithm and pair your website with compatible partners
To facilitate deal communication between exchange partners
To send transactional emails (match notifications, deal updates, link alerts)
To process subscription payments via Stripe
To detect and prevent fraud, spam, and abuse
To improve the platform based on aggregated usage patterns

We do not sell your personal data to third parties. We do not use your data for advertising.

4. Legal Basis for Processing

We process your data under the following bases:

Contract performance — to provide the service you signed up for
Legitimate interests — fraud prevention, platform security, improving matching quality
Legal obligation — to comply with applicable laws
Consent — for optional marketing communications (you can opt out at any time)

5. Data Sharing

We share limited data only with:

Exchange partners — your website URL, domain metrics, niche, and username are visible to other users you are matched with in a deal
Stripe — for payment processing (governed by Stripe's privacy policy)
Google — only if you use Google OAuth login (governed by Google's privacy policy)
Cloudflare — for Turnstile bot protection on public forms
Our hosting provider — server infrastructure only; no access to application data

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where required by law to retain it longer (e.g., billing records for up to 7 years for tax compliance). Anonymised aggregate data may be retained indefinitely.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access — request a copy of the data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of your account and associated data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Restriction — request we limit how we use your data

To exercise any of these rights, email us at contact@exchangebacklink.com. We'll respond within 30 days.

8. Security

Passwords are hashed using bcrypt and never stored in plaintext. All data is transmitted over HTTPS. Database access is restricted to application servers only. We apply industry-standard practices to protect your data, but no system is 100% secure — please use a strong, unique password.

9. Cookies

We use a small number of cookies to operate the platform. See our Cookie Policy for full details.

10. Changes to This Policy

We may update this policy as the platform evolves. We'll notify you of significant changes by email or a prominent notice on the platform. Continued use of the platform after changes take effect constitutes acceptance.