Privacy Policy

Last updated: June 16, 2026

This Privacy Policy explains how codemarket OÜ ("we", "us") collects, uses, stores, and protects personal data when you visit https://forumbacklinks.org, create an account, or use the Conversational Backlinks service. We process personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Estonian data protection law.

1. Data Controller

The data controller responsible for your personal data is:

• codemarket OÜ
• Harju county, Tallinn, Lasnamäe district, Sepapaja tn 6, 15551, Estonia
• Registration code: 16234616
• VAT number (EU): EE102376140
• Privacy contact: [email protected]

2. Scope

This policy applies to personal data processed through the Website, dashboard, authentication flows, subscription billing, customer support, and analytics on https://forumbacklinks.org. It does not apply to third-party websites linked from our pages or to forums where placements are published.

3. Personal Data We Collect

3.1 Data you provide

• Account data: email address, authentication provider (Google, Apple, or email link), display name or profile photo if shared by the provider, Firebase user ID
• Project data: target domain, keywords, anchor text, publication schedule, onboarding preferences, and URLs you submit for link placement
• Billing data: subscription status, Stripe customer ID, payment history metadata (we do not store full card numbers; Stripe processes payment details)
• Support communications: messages you send to [email protected]

3.2 Data collected automatically

• Technical data: IP address, browser type, device type, operating system, referring URL, timestamps, and basic session information
• Usage data: pages viewed, clicks, and interactions collected through Google Tag Manager, Google Analytics 4, and Firebase Analytics (where enabled)
• Local storage: onboarding draft data stored in your browser for project setup (see our Cookie Policy)

4. Purposes and Legal Bases (GDPR Article 6)

Where we rely on legitimate interests, we balance our interests against your rights and expectations. You may object to processing based on legitimate interests as described in Section 8.

5. Recipients and Processors

We share personal data only as necessary with:

• Google / Firebase — authentication, analytics, and infrastructure (USA / global)
• Stripe, Inc. — payment processing and subscription billing (USA / global)
• Cloudflare, Inc. — website hosting, CDN, and security (global)
• Our application backend (hosted on Heroku / Salesforce) — account, project, and subscription data necessary to operate the Service
• Professional advisers — lawyers, accountants, or auditors when required
• Authorities — when required by law or to protect legal rights

Processors act on our instructions under data processing agreements or equivalent contractual safeguards where required by GDPR.

6. International Transfers

Some providers process data outside the European Economic Area (EEA), including in the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the EU-US Data Privacy Framework (where applicable), or other mechanisms recognized under GDPR Chapter V.

7. Retention

• Account and project data: kept while your account is active and for a reasonable period afterward to resolve disputes, enforce terms, or comply with law
• Billing records: retained as required by Estonian accounting and tax law (typically up to 7 years)
• Support messages: retained as long as needed to handle your request and maintain service records
• Analytics logs: retained according to each provider's settings, generally between 14 months and 26 months unless shortened

When data is no longer needed, we delete or anonymize it unless retention is required by law.

8. Your Rights Under GDPR

If you are in the EEA, UK, or another jurisdiction with similar rights, you may have the right to:

• Access — request a copy of personal data we hold about you (Art. 15)
• Rectification — correct inaccurate or incomplete data (Art. 16)
• Erasure — request deletion in certain circumstances (Art. 17)
• Restriction — limit processing in certain circumstances (Art. 18)
• Data portability — receive data you provided in a structured, commonly used format (Art. 20)
• Object — object to processing based on legitimate interests or direct marketing (Art. 21)
• Withdraw consent — where processing is based on consent, without affecting prior lawful processing (Art. 7(3))

To exercise your rights, email [email protected] with the subject line "GDPR Request" and enough information to verify your identity. We respond within one month, extendable where permitted by law.

You also have the right to lodge a complaint with a supervisory authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.

9. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Internal tools may assist with matching keywords to discussion sources, but placements involve human review and moderation.

10. Security

We implement appropriate technical and organizational measures to protect personal data, including encrypted connections (HTTPS), access controls, and reputable infrastructure providers. No method of transmission or storage is 100% secure.

11. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Material changes will be posted on this page.

13. Contact

Privacy questions and GDPR requests: [email protected]