Privacy Policy

Data we process

AssetLed Linkbuilding processes data needed to run account administration, asset-led link building operations, outreach, billing, reporting, and compliance workflows.

How we use data

• Provide account login, team management, API access, billing checkout, quota tracking, and support for customer-requested workflows.
• Analyze submitted websites, qualify linkable assets, enrich SEO metrics, prioritize prospects, draft outreach, send approved messages, process replies, and maintain unsubscribe or suppression records.
• Generate reports, cost dashboards, AI-visibility snapshots, Google Analytics and Google Search Console impact summaries, and live-link monitoring outputs.
• Secure the platform through tenant isolation, authentication, authorization, rate limiting, output-cache variation by credentials, API-key hashing, and audit-friendly operational logs.
• Detect and prevent repeated trial use, payment abuse, account evasion, and policy abuse using hashed, protected, and provider-derived identifiers where applicable.
• Comply with legal obligations, enforce the Terms of Service, investigate abuse, and honor export, deletion, and unsubscribe requests.

Third-party providers and integrations

AssetLed only sends data to configured providers when the corresponding feature is enabled or requested by an authenticated user or worker job. The public subprocessors page lists provider categories, purposes, data categories, transfer notes, and when each subprocessor is used.

Anthropic and configured AI answer engines

Used for analysis, prioritization, AI visibility, reactive PR matching, and message drafting. Prompts should avoid unnecessary personal data.

DataForSEO

Used to enrich SEO and prospect metrics for submitted websites, assets, and target domains.

Google Analytics and Google Search Console

Used only after OAuth connection to collect impact data for authorized websites. Refresh tokens are stored as protected ciphertext.

Stripe

Used for checkout, subscription identifiers, billing status, portal sessions, payment-method fingerprint retrieval, Radar blocklist support, and webhook processing. AssetLed does not store full payment-card details.

Mailgun

Mailgun processes product and site transactional email, optional product marketing email, delivery metadata, bounce events, complaint events, unsubscribe events, and webhook delivery state for the AssetLed product itself.

SMTP/IMAP mailboxes

Outreach mailbox providers are customer-configured or admin-configured SMTP/IMAP services that are separate from Mailgun and are used to send configured outreach, add unsubscribe links, classify replies, process follow-ups, and enforce bounce, suppression, and daily-mailbox guardrails.

Your choices and rights

Authenticated account users can use the compliance page to export account data, delete the authenticated account, and process unsubscribe tokens. Current users, former users, prospects, outreach recipients, and Google OAuth data subjects can submit deletion requests through the data deletion request page.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or port personal data. Use the privacy request page for access/export, correction, deletion, unsubscribe, objection, or restriction requests. AssetLed may need to confirm account authority before acting on account-level data.

Retention and deletion

AssetLed retains data while needed to provide the service, maintain security, support billing and audit obligations, honor suppressions and unsubscribe records, and resolve disputes. Account deletion removes account-scoped operational data through the implemented compliance workflow while preserving records that must be retained for legal, security, billing, or abuse-prevention reasons. Public deletion requests can be submitted at data-deletion.

Production retention settings

Production retention windows are seeded in SQL and managed through the authenticated privacy operations admin page with policy versioning, approval metadata, dry-run previews, cleanup run records, legal holds, and retention exceptions. The current baseline settings are:

• Crawled pages: 30 days for stored crawl text and page snapshots used by site analysis.
• Outreach emails: 365 days for sent messages, replies, SMTP responses, and mailbox-thread evidence.
• AI prompts and responses: 90 days for prompts, model responses, and generated analysis or drafting payloads.
• Proof screenshots: 365 days for link-placement screenshots and supporting proof artifacts.
• Google data: 400 days for Google Analytics, Google Search Console, and derived impact snapshots.
• Product email logs: 365 days for transactional and marketing delivery support.
• Mailgun webhook events: 365 days for delivery-event troubleshooting and idempotency protection.
• Marketing consent evidence: 1095 days for consent proof, unsubscribe enforcement, and regulatory defense.
• Deleted accounts: 30 days for deleted-account recovery, audit, and operational tombstone records where retained outside account-scoped cascade deletion.

Suppression records are governed separately by suppression settings because unsubscribe, bounce, complaint, and do-not-contact records protect recipients and prevent repeated outreach.

Security

Security controls in the current solution include HTTPS redirection, HSTS in non-development environments, secure authentication cookies, API-key hashing with a configured pepper, role-based authorization, tenant checks, rate limiting, output-cache credential variation, SQL parameterization, Data Protection key-ring configuration, resilient outbound calls, and compliance export/delete endpoints. See Trust Center and Security Practices for the public control summary.