Privacy policy

• Account data: name, email address, password (stored only as a secure hash), language, time zone, two-factor authentication settings and, if you sign in with Google, Microsoft or LinkedIn, the identifier that provider gives us.
• Company and tax data: company name, country, billing address, VAT number and the result of its check with the EU VIES service.
• Order data: what you buy, your projects and playlists, articles, briefs, images and files, anchor texts, target URLs, notes, reviews of drafts, disputes and the messages exchanged.
• Payment data: amounts, receipts, wallet movements and the payment references Stripe gives us. Card details are entered on Stripe's page and never reach us.
• How you found us: the referral page and campaign (UTM) parameters of your first visit and, if you tell us, how you heard about us.
• Security and usage data: IP address, browser, sign-in times, failed sign-in attempts and a log of actions taken on accounts and orders.
• For publishers, agencies and writers: contact details, the sites and orders you handle, the actions you take through order links (with IP address and time), and, for publishers, payment details you give us.

• To run your account and deliver what you order, including writing, publication, checks and link monitoring: this is needed to perform our contract with you.
• To invoice, keep accounting and tax records and check VAT numbers: this is a legal obligation.
• To keep the platform secure, prevent fraud and abuse and investigate disputes: our legitimate interest in a safe and reliable service.
• To understand which channels bring new customers, from referral and campaign data: our legitimate interest in running the business.
• To send you news and offers: only with your consent, which you can withdraw at any time. Emails about your account and orders are part of the service and are always sent.

We never sell personal data. We share it only with:

• Publishers, agencies and writers, who receive the materials needed for an order (article or brief, anchors, target URLs, notes and files) but not your name, contact details or the price you paid.
• Stripe, which processes payments and protects them against fraud.
• Cloudflare, which stores uploaded files and protects our forms against bots (Turnstile).
• Our hosting provider, which runs the platform in the European Union, and our email delivery provider.
• Google, Microsoft or LinkedIn, only if you choose to sign in with them.
• The European Commission's VIES service, to check VAT numbers.
• Have I Been Pwned, to check that a new password has not appeared in a known breach. Only the first five characters of a hash of the password are sent; the password itself never leaves our systems.
• Our accountants and advisers, and public authorities when the law requires it.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework.

• Account data, articles, briefs and order files: for as long as your account exists. They are deleted when the account is deleted.
• Receipts, the billing register, wallet and order records (without the attached files) and audit logs: for the period the law requires for accounting and tax records, currently 10 years in Italy, even after the account is deleted.
• Publishers and agencies can download order materials only until the order is closed or cancelled.
• Technical logs: up to 30 days. Backups: 30 days.
• Marketing consent: until you withdraw it.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or receive it in a portable format. You can withdraw any consent at any time without affecting earlier use. Write to our contact email (published before launch); we reply within one month and may ask you to confirm your identity.

If you believe we handle your data unlawfully, you can complain to the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it) or to the authority of the country where you live or work.

Guestpost.club uses only what the service needs to work, so no consent banner is shown today:

• a session cookie that keeps you signed in, and a longer-lived one if you choose "Keep me signed in for 30 days";
• a security cookie that protects forms against cross-site request forgery;
• a cookie that remembers your language and one that remembers whether the side menu is open;
• Cloudflare Turnstile, which may set a cookie to tell people from bots on sign-in and registration forms;
• for writers, unsent drafts are kept in the browser's local storage until they are delivered.

Payment happens on Stripe's own page, which uses its own cookies under Stripe's privacy policy. We do not use advertising cookies. If we add analytics or a chat widget, we will ask for your consent first, and rejecting will be as easy as accepting.

Data travels over encrypted connections. Passwords are stored as secure hashes, two-factor authentication is available to everyone and required for our staff, file downloads use short-lived signed links, and access to order data is limited to the people who need it for that order.

Guestpost.club is not intended for anyone under 18 and we do not knowingly collect their data.

We will update this page when our practices change and show the date of the last change at the top. If a change affects you significantly, we will tell you by email or in the app. The rules for using Guestpost.club are set out in our Terms of service.