Privacy Policy
SEO Sink ("we", "us") helps site owners detect and stop negative SEO. This policy covers what we collect when you use the free checker, create an account, or connect your Google Search Console, and what we do with it.
What we collect
Free checker
The domain you submit, your IP address (for rate limiting, 5 checks/day), and the results we compute about that domain (DNS records, HTTP chain, backlink-snapshot metrics from third-party data providers). Checker results are cached for up to 7 days to control data-provider costs. The full checker report is unlocked with an email address; that address is stored (as an early-access contact), the report is emailed to it, and disposable/throwaway providers are rejected. Checker forms are protected by Cloudflare Turnstile bot screening.
Account
Your email address (used for magic-link sign-in — we do not store passwords), sign-in session tokens (30-day expiry), your plan and entitlement state, credit balance and ledger, and the domains you register with the service. Purchases activate via a one-time activation link emailed to the address you supply at claim; that address becomes the verified owner of the payment.
Google Search Console data (when you connect GSC)
With your explicit OAuth consent, we access your Search Console data read-only: the list of verified properties and your sites' backlink data (linking sites and pages). We use this solely to provide the service to you — scoring your referring domains, generating approve/sink recommendations, and preparing per-property disavow files.
Limited Use disclosure: SEO Sink's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use GSC data for advertising, do not sell it, do not use it to train models for other customers, and do not allow humans to read it except for security/compliance or with your explicit request for support.
Billing
Payments are processed by our merchants of record and payment processors (Lemon Squeezy for card payments, NOWPayments for cryptocurrency). We never see or store your full card number or wallet keys. We receive a payment confirmation, the plan purchased, the processor's invoice/payment IDs, and — after activation — the verified account email bound to that payment.
Service providers (subprocessors)
The third parties that process data strictly to operate the service: Cloudflare (edge hosting, database, Turnstile bot screening — request metadata), Resend (transactional email from send.seosink.com — recipient address and the service emails themselves: sign-in links, reports, activation links), NOWPayments (crypto invoices — amount, currency, invoice ID; no account email unless you supply one to them), Lemon Squeezy (card payments, when available), Ahrefs and Common Crawl (third-party reference data about domains submitted for checking — domains, not people), and Google (Search Console, only when you connect it). Each is bound by its own data-processing terms; we never sell or broker any of it.
What we never do
- Sell or rent your personal data, your domains' data, or your backlink data.
- Share your GSC data with third parties except infrastructure providers strictly required to operate the service (our hosting and database providers), bound by the same confidentiality.
- Use the collective attack graph against you. The hostile-domain intelligence we aggregate is attack infrastructure, not customer data.
Retention
Account and entitlement records persist while your account is active. Cached checker results expire within 7 days. Support-chat transcripts — your questions, the assistant's answers, and any security refusals — are logged in full and retained for security audit and abuse investigation; they are never used for marketing, never shared, and you can ask for yours to be exported or deleted at any time. If you disconnect GSC, we delete stored OAuth refresh tokens immediately and purge imported link data within 30 days. If you close your account, we delete personal data within 90 days — with one exception: the financial ledger (payments, credits, debits) is retained in pseudonymized form for tax, audit and fraud-prevention obligations. Erasure removes the link between the ledger and you; it does not rewrite the books.
Security
OAuth tokens and API credentials are stored encrypted at rest. Access to production data is limited to named operators. All traffic is TLS-only.
Your rights
You can export or delete your data, revoke our GSC access at any time from your Google permissions page, and close your account by emailing us. Residents of the EU/UK have the usual access, rectification, erasure, portability, and objection rights.
Contact
Privacy questions and requests: privacy@seosink.com.
Keep reading: terms of service · help & guides · contact us — privacy requests go to privacy@seosink.com