Privacy Policy
BacklinkMastery places paramount importance on protecting your personal data. This policy describes how we collect, use, store and protect your information in compliance with the General Data Protection Regulation (GDPR) and applicable laws in France and Europe.
Data Controller
Visicrea, with its registered office at 180 Lotissement du Stade, 42140 Grammond, France, operating under the BacklinkMastery brand, is the controller of your personal data. For any questions about your data, contact us at florent@visicrea.fr or contact@backlink-mastery.com.
Data Collected
We collect the following data when you use BacklinkMastery:
- Account data: full name, email address, password (encrypted), country, preferred language
- Professional profile data: company, monitored domains, site URLs, configuration data
- Usage data: login history, IP addresses, browser, devices used, pages visited, actions performed
- Billing data: tokenized bank details via Stripe, invoice history, subscription plan
- Support data: support messages, screenshots, technical logs (limited and secured)
- Analytics data: monitored backlinks data, page screenshots, verification results (statuses, dates, HTTP errors)
Processing Purposes
We process your data for the following purposes:
- Creation and management of your user account
- Provision and optimization of the backlink monitoring service
- Billing and payment management (via Stripe)
- Customer support and technical assistance
- Fraud prevention and service security
- Service improvement and statistical analysis (anonymized data)
Legal Basis for Processing
The processing of your data is based on the following legal grounds: - Execution of the service contract you have signed - Compliance with our legal obligations (accounting, taxation, legal retention periods) - Our legitimate interests (security, fraud prevention, service improvement) - Your explicit consent (marketing, non-essential cookies)
Data Retention Period
We retain your data for the strictly necessary duration: - Active account: as long as your account remains active - After account deletion: 30 days (soft deletion), then permanent hard deletion - Security and audit logs: 180 days - API logs: 90 days - Invoices and accounting data: 10 years (legal requirement) - Backups: 30 days minimum, then deletion - Session cookies: end of session or maximum 30 days
Your Rights
Under GDPR, you have the following rights: - Right of access: receive a copy of your personal data - Right to rectification: correct inaccurate data - Right to erasure (right to be forgotten): request deletion of your data - Right to restrict processing: limit the use of your data - Right to data portability: receive your data in a structured, transferable format - Right to object: refuse certain processing (marketing, profiling) - Right to withdraw consent: withdraw your consent at any time - Right not to be subject to automated decision-making: refuse purely automated processing
How to Exercise Your Rights
To exercise any of your rights, write to us at florent@visicrea.fr providing: - Your identity (full name, account email) - Your specific request (right being exercised) - A copy of your ID if necessary We will process your request within one month of receipt. This deadline can be extended by two months for complex requests.
Sub-processors and Partners
BacklinkMastery uses recognized sub-processors to provide certain services. All sub-processors are contractually required to respect the confidentiality and security of your data.
| Provider | Purpose | Country of Operation |
|---|---|---|
| Stripe Inc. | Payment processing and subscription management | USA (EU-US DPF Adequacy Decision) |
| Crisp IM SAS | Customer support and chat | France (EU servers) |
| Brevo (Sendinblue SAS) | Sending transactional emails and alerts | France (EU) |
| Hetzner Online GmbH | Hosting of the application and its database | Germany (EU) |
| Mangools (CodeCat s.r.o.) | Backlink discovery and SEO metrics | Slovakia (EU) |
| DataForSEO Inc. | Indexation data and SEO analysis | Cyprus / USA |
| SEObserver | Monitoring and additional backlink analysis | France |
| Ahrefs Pte. Ltd. | Domain authority metrics (Domain Rating) | Singapore (Standard Contractual Clauses) |
| IsIndexed (QUIRECHERCHE) | Checking page indexation on search engines | France (EU) |
| SemScraper (MONITORANK SAS) | Checking page indexation on search engines | France (EU) |
| PostHog Inc. | Product usage analytics | Germany (EU hosting) |
An up-to-date list of sub-processors is maintained and can be provided upon request.
AI assistant connections (MCP)
If you connect an AI assistant (Claude, ChatGPT, Le Chat, Cursor…) to your account through our MCP connector, we process the following data to run and secure that connection:
- Connection details: the name and return address the assistant declares when it registers, and the creation date of each access.
- The tokens themselves are not stored: for each one, we only record an identifier, its expiry date and its status (active or revoked).
- Call log: for each action your assistant runs, we record your account, the connection used, the name of the action, whether it succeeded or failed, its duration and the time. Neither the content of the request nor the response is recorded. We use this log to secure the connector and investigate errors; each entry is deleted after 90 days.
The assistant receives the data you have it look up: account name and email, plan, sites, backlinks and their check history, discovered backlinks and client report links.
Legal basis: performance of the contract (the connection you request) and legitimate interest (security).
Tokens are kept until they expire (1 hour for an access token, 30 days for automatic renewal, 1 year for an AI connection token) or are revoked, then erased within 7 days. They are revoked as soon as you ask for your account to be deleted.
You can revoke a connection or a token at any time in your profile, under AI connections.
The assistant you connect is operated by its provider (for example Anthropic, OpenAI, xAI, Mistral AI or Perplexity). That provider is not our processor: it processes the data it receives from your account, at your request, on its own behalf or, with a business plan, on behalf of your organization, under its own privacy policy. We do not send your data to AI providers on our own initiative.
Data Transfers Outside the EU
Some of your data is transferred to the United States for payment processing (Stripe) and SEO data (DataForSEO), and to Singapore for domain metrics (Ahrefs). These transfers are secured by: - EU-US Data Privacy Framework for Stripe - Standard Contractual Clauses (SCC) approved by the European Commission You have the right to know about the safeguards applicable to these transfers. Contact us for more information.
Cookies and Tracking Technologies
BacklinkMastery uses essential cookies for platform functionality (authentication, session preferences). Product analytics (PostHog, hosted in the EU) and the support chat (Crisp) are only enabled if you accept them in the cookie banner; you can withdraw that consent at any time via "Manage cookies" at the bottom of each page. Please see our cookie policy for details.
Data Security and Protection
We implement comprehensive security measures to protect your data: - TLS 1.3 encryption in transit (HTTPS) - Password encryption via bcrypt - Limited and authenticated data access (2FA for admin accounts) - Audit logs of all sensitive access - Automatic backups and server redundancy - Compliance with security standards (ISO 27001 in progress) - Access policy and least privilege principle Despite these measures, no system is 100% secure. If you suspect a breach, alert us immediately.
Right to Lodge a Complaint with CNIL
You have the right to lodge a complaint with the National Commission for Computing and Freedoms (CNIL) if you believe your rights have been violated: CNIL 3 Place de Fontenoy 75007 Paris, France Phone: +33 1 53 73 22 22 Website: www.cnil.fr
Data Protection Officer (DPO)
A Data Protection Officer can be contacted for any questions regarding the protection of your data: DPO: Florent PEREZ Email: florent@visicrea.fr Address: 180 Lotissement du Stade, 42140 Grammond, France The DPO is available to ensure compliance with this policy and applicable laws.
Changes to This Policy
We may modify this privacy policy to reflect changes in our practices, technology, legal conditions or other factors. Material changes will be notified by email at least 30 days before they take effect. Continued use of the service after this notification implies your acceptance of the modifications.