Privacy policy

Last updated: October 17, 2026

The short version

• This website sets one cookie, and only if you arrive through a partner's link: it remembers which partner sent you, so they can be credited if you buy. It measures audience with Cloudflare Web Analytics, without cookies, without tracking you across sites and without storing anything on your device, to produce anonymous, aggregated statistics. It runs no advertising trackers, and you can use the site and buy without accepting this cookie: only the attribution to the partner will not work.
• Payments are processed by Paddle, our merchant of record, under the Paddle privacy policy. We never see your card details.
• The only place on this site where you type anything is the download page, which passes your license key to our license server to fetch your download and keeps nothing.
• Autolinker is bring-your-own-key. Your OpenAI API key and your content stay on your WordPress site and are never sent to our servers.

Who we are

Web & SEO Autolinker is a product of Web & SEO Ltd ("we", "us"), a company registered in Hong Kong under company no. 1826120, at Unit G, 15/F, Tal Building, 49 Austin Road, Jordan, Kowloon, Hong Kong. Web & SEO Ltd operates the autolinker.app website and is the data controller for the personal data described in this policy.

For any question about this policy or your data, write to [email protected], or to the postal address above.

The waitlist, now closed

Until the plugin shipped, this page carried a form to be told about the launch. That form is gone, and on 17 October 2026 we deleted the list it fed. Nobody was ever emailed from it, and it was never shared or sold. Encrypted copies made by our nightly backup between 23 July and 17 October 2026 were kept in the history of our backup repository, a private repository on GitHub. We deleted that repository on 17 October 2026. GitHub keeps a deleted repository for 90 days, during which only we could restore it, then erases it. The copies could only be opened with a key we keep offline, and we used them for nothing.

Server logs

Our web server keeps standard access logs: IP address, browser user agent, requested URL and timestamp. We use them for security and to keep the site running, and we delete them within 14 days.

Affiliate cookie: crediting the partner who sent you

This site sets one cookie, aff_ref, and only when you arrive through a link from one of our affiliate partners (a link that ends in ?ref= followed by the partner's code) and you click "Accept" on the banner shown on that first visit. It holds that code and nothing else, lasts 60 days, is sent back only to autolinker.app, and cannot be read by scripts (HttpOnly, Secure, SameSite=Lax). If you click "Refuse" or close the banner without choosing, no cookie is set and no affiliate-related request is made. When you buy, the code, if present and still valid (60 days), travels with your order to Paddle, our merchant of record, so that the partner who referred you can be paid a commission. You can withdraw your choice at any time via "Manage cookies" in the footer, which will delete the cookie if it was set.

On that first visit, and only after you click "Accept", your browser also loads a 1x1 image from partners.licenseos.net, our affiliate service, which counts the visit once per day. For that count it creates a daily pseudonymous fingerprint of your IP address (HMAC-SHA256 of the IP and the current date with a secret key we hold), never the IP address itself, and its server log keeps the page you came from (referrer) and your browser type (User-Agent) for 14 days. The fingerprint changes each day; without our secret key it cannot be linked from one day to the next, but with the key, which we hold, we could verify whether a known IP address visited on a given day. Arriving without a partner link, or declining the banner, sets no cookie and loads no such image.

When you click "Accept" or "Refuse" on that banner, or delete the cookie under "Manage cookies", we record the choice with its date and time and the version of the banner you saw, without your IP address or the partner's code, so that we can prove it. We keep each record for at least 6 months and delete it within 7 months.

Analytics without cookies: measuring the audience of autolinker.app

We measure audience with Cloudflare Web Analytics (Cloudflare, Inc., USA). Cloudflare acts as our processor under its Data Processing Addendum at https://www.cloudflare.com/cloudflare-customer-dpa/. That Addendum incorporates the EU Standard Contractual Clauses, and Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers to the United States are covered by that certification and, where it does not apply, by those Clauses.

The beacon (from static.cloudflareinsights.com) sets no cookie and uses no localStorage or sessionStorage, does not fingerprint you, and does not track you across sites. For our site it counts page views, page path, referrer, country-level location, browser and operating system, device type and Core Web Vitals, only to produce anonymous, aggregated statistics for us. Cloudflare keeps full-detail data for 7 days and then only a sample of about 10%; we can see the last 6 months of statistics.

You can object at any time: turn on Do Not Track or Global Privacy Control in your browser, or click "Object to analytics" below. Your choice is kept in this browser's local storage, and the beacon will not load on your next visits from this browser.

Cloudflare also collects and stores Network Data: models, observations, reports, analyses and statistics derived from traffic in the course of providing the service, including service uptime and availability, request volumes, error rates, cache rates and IP threat scores, for its own security and operations. That processing is done by Cloudflare as independent controller under its privacy policy and not as part of our audience measurement.

We do not use any other analytics, advertising or social-media trackers on this website.

When you buy Autolinker Pro

The checkout is run by Paddle, our merchant of record. Its script loads only when you click a buy button on the pricing page. Paddle collects your name, email address, billing address, payment details and the information required to handle taxes. Their processing is described in the Paddle privacy policy.

From Paddle we receive your name, your email address, the product you bought and the transaction reference. We use them to issue your license key, send it to you by email and provide support. We never see your full card number. We do not sell or share this data. When you tick the box giving consent to immediate delivery on the pricing page, that consent, the version of its wording (2026-10-07.1) and the time of purchase travel with your order to Paddle as custom data. On our side, our license server at licenseos.net records that consent, its version and the server time of the Paddle webhook, and retains it for as long as your license remains valid and for 7 years thereafter so that we can prove it; Paddle also stores the custom data as part of the transaction record subject to its own retention.

Your license lives on our license server at licenseos.net, run by Web & SEO Ltd. When you activate or deactivate Autolinker Pro, and once a week to validate it, the add-on sends it your license key, your site URL and the plugin version; when WordPress checks for updates, it sends your license key and your site URL. We store the site URL on your license to count activations; deactivating a site removes it. The download page sends your license key to the same server to get a download link, and keeps nothing. We retain the email, transaction reference, license key and activation records for as long as your license remains valid and for 7 years thereafter to handle renewals, proof of purchase and tax records, unless a longer retention is required by law. Site URLs removed on deactivation are deleted from active records within 30 days.

Third parties this site relies on

• Cloudflare proxies the traffic to this site, so your requests pass through their network. Their processing is described in the Cloudflare privacy policy.
• Paddle runs the checkout and the billing as our merchant of record, as described in "When you buy Autolinker Pro".

The plugin

Autolinker runs on your own WordPress site with your own OpenAI API key. The content it processes travels directly between your server and OpenAI, under OpenAI's terms. None of it passes through autolinker.app. The free plugin makes no calls to our servers at all; the Pro add-on only talks to our license server, as described above.

Your rights

You can ask for a copy of the data we hold about you, have it corrected or deleted, or object to its processing. Email [email protected] and we will answer within 30 days. You also have the right to lodge a complaint with a supervisory authority in the EU, for example in the Member State of your habitual residence, place of work or where you consider an infringement occurred.

Changes to this policy

Any change will be posted on this page with a new "Last updated" date.

Correction: until 6 October 2026, this privacy policy said the site measured no audience. In fact, Cloudflare Web Analytics had been added automatically by Cloudflare, our CDN, before that date and was already measuring the site's audience. The policy was corrected on 6 October 2026; the amount of data collected before that date is not known beyond the retention described in "Analytics without cookies".