1. Who is responsible for your data
The data controller is Stellar Group SAS, [to be completed], 13480 Cabriès, France, publisher of netlinking.si (see the legal notice).
For any question about your data or to exercise your rights: [email protected].
2. Controller or processor
Stellar Group SAS acts as data controller for the data of your account, your organization, billing, support, the emails we send you, the free tool, the affiliate program and browsing on the website.
Stellar Group SAS acts as processor (Article 28 GDPR) for the data you process with netlinking.si for your own business: contacts of the sites you reach out to, emails sent and replies received, data imported from your Google or Bing accounts, reports for your clients. For this data, you, the customer, are the data controller: you decide whom to contact and why, and you must have a legal basis, inform the people you contact and honor their objections. Our processor commitments are set out in the terms.
3. The data we process
- Account: email address, name, profile picture if you sign in with Google, interface language, organization, role and preferences.
- Billing: name or company name, billing address, VAT number, plan, payment and credit history. Card numbers never go through our servers: they are handled by our payment provider.
- Use of the service: projects (sites, competitors, markets, questions asked to AI engines), actions taken, credits used, the organization activity log, messages sent to the assistant.
- Technical data: IP address and browser, processed for security and abuse prevention; to attribute an affiliate link, a fingerprint computed from these two items, not the address itself.
- Connections: Google authorizations (encrypted tokens), SMTP passwords and Bing API keys (encrypted), and the imported data described below.
- Prospecting and outreach, as a processor: names, business email addresses and contact pages of sites, email content, replies received and the status of each case.
- Free tool: the site analyzed, the email address left to see the result and, if you accept, your consent to receive our news.
- Support and feedback: your messages, ideas and reports.
4. Why, and on what legal basis
- Creating and managing your account, providing the service and its features, sending service emails (sign-in, trial, invoices, alerts you turned on): performance of the contract.
- Invoicing, bookkeeping, answering requests from public authorities: legal obligation.
- Securing the service and preventing fraud and abuse (including the rule of a single free trial per organization and per card, checked with a card fingerprint supplied by the payment provider): legitimate interest.
- Sending tips and summaries related to your use, which you can turn off category by category: legitimate interest.
- Sending our news after the free tool: consent, which you can withdraw at any time with the unsubscribe link.
- Measuring product use to improve it, as internal statistics: legitimate interest.
- Attributing a sign-up to the affiliate whose link you followed and computing their commissions: legitimate interest, and performance of the affiliate agreement for the affiliate.
- Importing data from your Google or Bing accounts, at your request: performance of the contract.
We do not sell your data, we do not use it for targeted advertising, and we do not use it to train AI models.
5. Google, Search Console, Google Analytics and Bing
These connections are optional and only made at your request. With a Google account, netlinking.si may request:
- sign-in: your email address, name and profile picture;
- sending Gmail messages: only sending the emails you approve, from your mailbox; netlinking.si cannot read your inbox;
- Search Console, read-only: up to 16 months of daily clicks and impressions, for the site and its 500 most viewed pages (plus the pages your links target), and the top 1,000 queries of the last 28 days;
- Google Analytics, read-only: aggregated figures, with no personal data about visitors (no identifier, no IP address): visits per page over 90 days, traffic sources per day over 400 days.
With Bing Webmaster Tools, you enter an API key, which is stored encrypted: we import the site traffic, its pages, its queries and up to 10,000 links to the site.
Imported data is stored per project, visible only to authorized members, and deleted together with its tokens or keys when you disconnect the account or delete the project. Search Console data older than 16 months is deleted on a rolling basis.
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Who receives your data
Your data is accessible to authorized members of your organization and to the Stellar Group SAS staff who need it. We use the following service providers, which act only on our instructions:
- Payments: Stripe, for payments, invoices and fraud prevention;
- Hosting: [to be completed], for servers and databases;
- Generative AI model provider: drafting emails, sorting sites, the assistant and translations; it receives the text each task needs (pages read, questions, excerpts of project data), never your payment data;
- SEO data and AI engine answer provider: it receives domain names, keywords and questions, never your email address or account data;
- Email delivery service: service emails, emails sent from the shared netlinking.si sending domain, and receipt of replies;
- Google and Microsoft: only if you connect a Google, Search Console, Google Analytics or Bing Webmaster Tools account.
We may also disclose data to public authorities when legally required.
7. Transfers outside the European Union
Some providers are established, or use subprocessors, outside the European Union, notably in the United States. These transfers rely on an adequacy decision of the European Commission (including the Data Privacy Framework, for certified companies) or, failing that, on the European Commission Standard Contractual Clauses, supplemented where needed by additional security measures. You can request a copy by writing to us.
8. How long we keep it
- Account, organization and projects: as long as the account exists. You can delete your account at any time (Settings, Account): your data is then erased, and disappears from backups as they are rotated.
- Invoices and accounting records: 10 years, as required by the French Commercial Code.
- Sign-in session: at most 30 days without signing in again.
- Search Console data: a rolling 16 months; Google Analytics: a rolling 400 days; all imported data is deleted when the account is disconnected or the project deleted.
- Prospecting and outreach data: as long as you keep it in your project; deleted with the project or the account.
- Email address left on the free tool: 3 years after the last contact, or until you unsubscribe.
- Affiliate program: as long as needed to attribute the sign-up and pay the commissions, then archived for the legal limitation period.
- Technical logs: 12 months at most.
9. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time, and the right to give instructions on what happens to your data after your death.
Most of them can be exercised directly in the application (profile, notifications, CSV exports, account deletion). Otherwise, write to [email protected]: we reply within one month. We may ask for proof of identity if there is reasonable doubt.
Were you contacted by a netlinking.si user? That user is responsible for the contact: please reach out to them first. You can also write to us and we will forward your request.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.
10. Security
Traffic is encrypted (HTTPS). You sign in with a link sent by email or with Google: no account password is stored. Tokens, SMTP passwords, API keys and webhook URLs are encrypted in the database. Access to data is limited to members of the organization according to their role.
12. Minors
netlinking.si is intended for professionals and adults. We do not knowingly collect data about children under 15.
13. Changes
We may update this policy. If a change is significant, we will let you know by email or in the application. The date of the last update is shown at the top of this page.