linkpreneur Who we are
Linkpreneur is a trading name of R.B. Projecten B.V., Slenterweg 3, 6905 DM Zevenaar, The Netherlands (Chamber of Commerce 59974907, VAT NL853716833B01), which is the controller for the personal data described here. For privacy questions, write to the address published on this website or reply to any message from us.
What we collect
Account data (name, email, company), billing data (invoices, payment status through our payment providers; we never store card numbers), usage data (pages visited inside the platform, actions in the audit log and in our own usage log, see below) and the campaign data you provide (domains, keywords, guidelines).
Why we process it
To deliver the service you pay for, to invoice you, to secure the platform, and to send you service messages about your campaigns. We do not sell personal data. The only personal data used for advertising is described under "Cookies and advertising measurement" below, and it is used only to measure our own ads.
Third parties
We use data processors for hosting (EU), email delivery, payment processing, SEO data providers and cookieless website analytics and session recording (Rybbit), and Google Ads and OpenAI (for its ads in ChatGPT) to measure our own advertising. Processors only receive what they need to perform their function and are bound by data processing agreements.
Remarketing
With your consent, we let Google Ads use your visits to our website to show our ads again to people who visited it (remarketing), on Google and on websites and apps that work with Google. We use up to three groups: people who viewed one of the pages our ads lead to, people who viewed our pricing page, and people who started signing up but did not pay. Google keeps someone in such a group for at most 180 days after their last visit; we never see who is in it. This only happens on our public website, the sign-in pages and the first steps after signing up: never inside a portal, never on a portal an agency offers on its own domain, and never with your Search Console or Analytics data. In the European Economic Area, the United Kingdom and Switzerland, and when we cannot tell your country, it only happens after you accept under Cookie settings. Elsewhere it happens unless you say no: choose Reject under Your privacy choices at the bottom of any page, or use a browser that sends the Global Privacy Control signal, which we treat as a no until you choose otherwise yourself. You can also turn off personalised ads for your Google account at myadcenter.google.com.
Website and portal analytics
To see which pages help and where people get stuck, we use Rybbit, a cookieless analytics service. It runs on our public website, the sign-in and signup pages and the payment screen, and since 24 October 2026 also inside the client portal, the agency workspace and the publisher portal, including a portal an agency offers on its own domain. It never runs in our staff panels, and never on a page you reach through a personal link: a shared report, a self-billing note, your mail preferences, a password reset, an email confirmation, the return from the card payment or the connection to Google. Rybbit's script and everything it sends pass through our own domain (or the agency's), which hands them on to Rybbit with your IP address so Rybbit can tell your country and count the visit; Rybbit does not store your IP address. It records the pages you view, the website you came from, the campaign details in the link you followed (such as utm tags and the Google click ID), your country, device type and browser, how fast each page loads, technical errors on the page, and which version of our website you saw. We also send it what you do on a page: which links and buttons you click and in which part of the page, how far you scroll and how long the page is in front of you, which questions you open, which forms you start, send or leave, which field a form refused and by which rule, repeated clicks on one spot and clicks after which nothing happened. On our public pages that includes the words on the link or button you clicked; inside the portals only the name it has in our code, never text from your screen. Never sent: what you type, text you copy, and inside the portals the addresses of the websites you open from there. We may also record your session: how the page looked and how you scrolled and clicked through it, so we can see where the site gets in the way. Everything you type into a field is masked in your browser before the recording leaves it. Inside the portals every word on the page shows as asterisks, and everything built from your Search Console or Analytics data, every chart and every figure, is left out of the recording entirely, so none of your Google data reaches Rybbit. Your name, email address, company, wallet balance, domains and profile photo are masked or left out wherever they appear, and so are the amounts on the payment screen. Never recorded: what you type, your card details (you pay on Stripe's own page, where our script does not run), and the pages named above; the recording stops before such a page appears. We only record your session after you accept, wherever you are: under Cookie settings, or Your privacy choices outside the European Economic Area, the United Kingdom and Switzerland, at the bottom of the website, and under Cookie settings in the menu of every portal. Until you accept, nothing of the page is recorded, and whoever rejects is not recorded. Once you are a client of ours directly, we link your visits and the steps of your account to a pseudonymous ID: a code starting with lp_ that we derive from your account number with a secret key, never your email address or your name. On the payment screen and in your portal, your browser keeps that ID in its local storage only after you accepted, wherever you are; signing out or rejecting removes it. Agencies, their people and their clients, and publishers, are never given such an ID. From our server we report these steps of your account to Rybbit under the same ID: your first payment, with its amount; your email address confirmed; a website added; the wallet topped up (that it happened and how often, never the amount); a link approved; a link live; a monthly membership payment, with its amount; a declined card; and your membership cancelled, each with your billing country. We report the first payment when you return from the card payment, passing on your IP address and browser details only so Rybbit can count it in the same visit; the other steps go without them. We never report our own test accounts. Rybbit sets no cookies and does not build a profile of you across websites; visits without an account are counted with a daily-changing identifier. When an agency offers its portal to its own clients, we measure and record the use of that portal for the agency, as its processor, under the same rules. Our legal basis for recording your session and for keeping the ID in your browser is your consent; for the rest of this analytics it is our legitimate interest in understanding and improving our own website and service.
Our own usage log
Inside the platform our server also keeps a short log of its own, in our own database, of what only the server sees: which actions you take and whether they went through, which field of a form was refused and by which rule (never what you typed), which requests failed, steps of your account such as a payment or a website added, and whether you followed the link in a reminder about paying your membership. Each entry holds the name of the screen or action, your account number, a code for your session made from it with a secret key, your device type (phone, tablet or computer) and the time. It is never shared with anyone, never holds your Search Console or Analytics data, and every entry is deleted after 90 days. Our legal basis is our legitimate interest in keeping the service working and finding where it gets in your way.
Call requests
When you ask for a 15-minute call, we keep your name, your email address and the website you name, and the answers you choose to give: your role, your monthly link budget, how many links a month, how you get links now, your main goal, when you want to start, and up to three times that suit you, with the time zone your browser reports (you can change it). We also note the country of your IP address (from the country database on our own server; your address is not sent anywhere for this), whether your email address is at the website's own domain, and the ad or campaign link you arrived through, as described above. To prepare the call and to decide which request to answer first, we look up publicly available search figures for the website you named, such as its estimated organic traffic, its number of ranking keywords, its referring domains and an authority rank, from the same SEO data provider as our free site check; when that check already has figures for the website, we use those. We use all of this to arrange and prepare the call, never for advertising, and we do not show the figures to anyone outside our team. You receive one short email confirming your request. We keep the request with our other enquiries until you ask us to delete it; our legal basis is your request to be contacted and our legitimate interest in preparing it well.
The price index by email
If you ask for the link price index by email on our website, we keep your email address, the page you asked on, when you asked, the IP address you asked from and which wording you agreed to. We then send you one email to confirm your address, and nothing else arrives until you confirm. Once you have confirmed, we send you one email a month with the index, which we check before it goes out; it holds figures from our own records and nothing about you. We use your address for this and for nothing else: it is not used for advertising and not shared with anyone but our email delivery processor. That processor is Postmark, a company in the United States, which delivers the emails for us and tells us whether each one was delivered, bounced or marked as spam, under a data processing agreement. Every edition has a link to unsubscribe in one click, without logging in, and you can also reply to any edition and ask. Our legal basis is your consent, which you can withdraw at any time. We keep your address while you are subscribed. An address that is never confirmed is deleted 30 days after the request. When you unsubscribe, your subscription is deleted 30 days later, and we keep only a note that the address unsubscribed, so that we never email it again.
Reminders to finish your signup
If you create an account and do not finish it (pay the membership, or on pay per link save a card or top up your wallet), we send you at most two short reminders by email, about two hours and about two days after signing up, with a link to the payment screen. They stop as soon as you pay or your account is removed, and you can unsubscribe from them with the link in each message. We note whether you followed the link (see "Our own usage log"). Our legal basis is our legitimate interest in finishing a signup you started.
Retention
Account and campaign data are retained while your account is active and for up to 24 months after closure. Invoices are retained as long as tax law requires.
Google user data
If you connect your Google account, we access your Google Search Console data (search queries, impressions, clicks and positions for the website you connect; scope webmasters.readonly) and, only if you separately connect it, your Google Analytics data (aggregated traffic metrics for that website; scope analytics.readonly). We use this data solely to show you your own search and traffic performance inside your Linkpreneur portal and in the reports we generate for you, and to measure the effect of link placements on your own pages. We only read; we never modify anything in your Google account. This data is stored on our EU servers for as long as your connection is active, is never sold, never used for advertising, never used to train machine-learning models, and never shared with third parties except the processors that host our infrastructure. You can disconnect Google at any time on the Domains page of your portal or via your Google account permissions (myaccount.google.com/permissions); on disconnect we stop reading, the stored tokens are deleted, and you can request deletion of any stored aggregates, which we honour within 30 days. The protection mechanisms described under "How we protect your data" below (encryption in transit and at rest, restricted key-based access, audit logging, EU hosting, encrypted backups and breach notification) apply in full to all Google user data. Google user data never reaches our website analytics: in a session recording it is left out in your browser, before anything leaves it (see "Website and portal analytics"). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we protect your data
All traffic to and from the platform is encrypted in transit (TLS 1.2 or higher, enforced with HSTS). Google OAuth tokens are stored encrypted at rest with per-application keys and are never written to logs; other sensitive fields are protected the same way. Production systems live on EU infrastructure, access is limited to authorised personnel using key-based authentication with no shared accounts, and administrative actions inside the platform are recorded in an audit trail. Google user data is processed server-side only, is never exposed to other customers, and is never used to train machine-learning models. Backups are encrypted and follow the same retention rules as the live data. If a breach affecting your personal data ever occurs, we will notify you and the supervisory authority without undue delay, as the GDPR requires.
Your rights
You can request access, correction, export or deletion of your personal data at any time by contacting us. You can lodge a complaint with your data protection authority.