Privacy Policy

Who we are

Brokenlink is an automated broken link checker operated by Global Pioneers, 132 County Route 49, Slate Hill, NY, 10973. We are the data controller for the personal information described in this policy. This policy covers brokenlink.io and the Brokenlink application, and applies to visitors, trial users, and paying customers alike.

Information we collect

We collect information you give us directly, information generated by using the service, and a small amount of technical information collected automatically.

Account information

When you create an account we collect your name, your email address, and a password. Passwords are never stored in readable form — we store only a salted bcrypt hash. If you sign in with Google instead, we receive your name, your email address, and whether Google has verified that address. We never receive your Google password.

Monitoring data

This is the content you create in the product: your projects and their names and colors, the URLs you add to them, your labels, and the result of every check we run against those URLs — the HTTP status code, the status text, the resulting up or down state, and the time of the check. We keep this check history so you can see how a link has behaved over time rather than only how it behaves today.

Notification settings

We store whether you have enabled email and Slack alerts, how often you want to receive them, and when we last sent one. If you enable Slack alerts, we store the incoming webhook URL you provide so we can deliver messages to your channel.

Billing information

We do not store card numbers. Payments are processed by Stripe, and your card details are collected by Stripe directly. What we store is the identifiers and status Stripe returns to us: your Stripe customer, subscription, price, and item IDs, your plan, your subscription status, and your trial and renewal dates.

Support correspondence

If you contact us through the in-app support form or by email, we keep your message and our reply so we can help you and follow up later.

Technical information

Our hosting providers record standard technical information when you use the site, including your IP address, browser and device type, and the pages you request. Our analytics tags collect usage information as described under cookies and analytics.

What we send to the sites you monitor

Checking a link means requesting it. When we check one of your URLs, our servers make an HTTP request to that address, identified by a standard browser user-agent string. The operator of the destination site will see that request in their own logs, along with the IP address of our checking infrastructure. We do not send them your name, your email address, or any other information about you.

How we use your information

• To run the service. Checking your links on schedule, recording the results, and showing you their status and history.
• To alert you. Sending the email and Slack notifications you have enabled when a link breaks.
• To send transactional email. Password resets, account deletion confirmations, and other messages required to operate your account. These are not marketing emails and cannot be switched off while your account is open.
• To bill you. Starting your trial, managing your subscription, processing payments, and enforcing the link limit of your plan.
• To support you. Answering your questions and investigating problems you report.
• To keep the service secure. Detecting abuse, preventing fraud, diagnosing errors, and protecting our infrastructure.
• To improve the product. Understanding in aggregate which features are used and where people get stuck.

Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract — running the monitoring, sending your alerts, and billing your subscription.
• Legitimate interests — securing the service, preventing abuse, supporting customers, and improving the product, balanced against your rights.
• Consent — analytics and measurement cookies, where consent is required. You can withdraw it at any time.
• Legal obligation — keeping tax and accounting records for payments.

Cookies and analytics

We use browser storage for two purposes. The first is essential: when you sign in, your login token is stored in your browser so you stay signed in between visits, and the plan you picked before signing up is held briefly so we can apply it to your new account. Without this the application cannot work.

The second is analytics. We load Google Tag Manager on our site, which allows us to run measurement tags such as Google Analytics. These may set cookies and collect your IP address, device and browser information, and the pages you view, so we can understand how the site is used. This is not essential to the service — you can block these cookies in your browser settings or with a tracker-blocking extension, and the application will continue to work normally.

We do not use advertising cookies, we do not build advertising profiles, and we do not sell your personal information.

Who we share information with

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We do rely on a small number of service providers to operate Brokenlink, and each one receives only what it needs to do its job:

We may also disclose information when the law requires it — a valid legal request, a court order, or where disclosure is necessary to protect our rights, our users, or the public. If Brokenlink is ever involved in a merger, acquisition, or sale of assets, your information may transfer to the acquiring entity; we will notify you before it becomes subject to a different privacy policy.

How long we keep your data

We keep your account and monitoring data for as long as your account exists. Check history accumulates over time so that link behavior remains visible; you can delete individual links, projects, or labels at any time, which removes their data from our database.

When you delete your account from Settings → Account, we immediately and permanently remove your user record, your account record, and every project, link, label, and check history entry attached to it. This is not a soft delete and it cannot be undone.

Two things outlive that deletion. Stripe retains payment and invoice records for as long as tax and accounting law requires, under its own retention rules. And routine encrypted backups of our database are cycled out on a rolling schedule rather than edited, so deleted records may persist in backups for a short period before being overwritten.

How we protect your data

All traffic between your browser and Brokenlink is encrypted with TLS. Passwords are stored only as salted bcrypt hashes. Every query in the application is scoped to the signed-in user, so one customer's projects and links are never reachable from another customer's account. Access to production systems is limited to the people who need it.

No service can promise perfect security. If we ever become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Your privacy rights

Depending on where you live, you have some or all of the following rights over your personal information:

Access

Ask for a copy of the personal information we hold about you.

Correction

Correct anything inaccurate. Your name, email address, and notification settings can be changed at any time from your account settings.

Deletion

Delete your account and the data attached to it. You can do this yourself from Settings → Account, or ask us to do it for you.

Portability

Receive the data you provided to us in a structured, machine-readable format.

Objection and restriction

Object to or ask us to restrict processing that relies on our legitimate interests.

Withdrawing consent

Withdraw consent at any time where our processing is based on it, such as analytics cookies. Withdrawing consent does not affect processing that already took place.

Complaint

Lodge a complaint with your local data protection authority if you believe we have handled your data unlawfully.

To exercise any of these, email us at support@brokenlink.io from the address on your account. We will respond within 30 days. We will never charge you a different price or give you a worse service because you exercised a privacy right.

If you are a California resident, you also have the right to know what personal information we collect and disclose, the right to delete it, and the right to opt out of its sale or sharing. As described above, we do not sell or share personal information, so there is nothing to opt out of.

International data transfers

Brokenlink and our service providers operate internationally, so your information may be processed in a country other than your own, including the United States, where privacy law differs from the law where you live. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Children's privacy

Brokenlink is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy as the product changes or the law requires. When we do, we will update the "last updated" date at the top of this page. If a change materially affects how we handle your personal information, we will tell you by email or in the application before it takes effect.

Your use of the service is also governed by our Terms of Service.

Contact us

Questions about this policy, or about the data we hold on you, go to Global Pioneers, 132 County Route 49, Slate Hill, NY, 10973, or by email to support@brokenlink.io. This policy is governed by the laws of New York.