LinkExchange Privacy Policy
Last updated: 20 July 2026
nandbox Inc. (the “Company”, “we”) respects your privacy and is committed to adhering to applicable Canadian privacy laws and industry guidelines relating to the protection of personally identifiable information. This privacy policy (“Privacy Policy”) describes how we handle information collected through LinkExchange (linkexchange.ai) and its related websites, web applications, APIs and plugins — including the LinkExchange plugin for WordPress — (together, the “Service”).
This Privacy Policy applies only to the Service, and not to any other company or third-party website that may be linked from it. It is incorporated into and forms part of the Terms & Conditions. After reading it you will know:
- What information the Company collects from you
- What the plugin transmits from your website
- How the Company uses your information
- How the Company protects your information
- Third-party websites and service providers
- Your rights and choices
- How to contact the Company
By using any part of the Service, or submitting information through it, you consent to the collection, use and disclosure of that information as described here and as permitted or required by law.
This Privacy Policy may change from time to time, and your continued use of the Service following the posting of a revised version constitutes acceptance of the change. Please check periodically for updates.
1. Information the Company Collects From You
Information you provide
When you register for and use the Service, you provide:
- Account information — your email address, and the password or verification code used to secure the account.
- Website information — the domain name and home URL of each website you connect, and the ownership-verification token we ask you to publish on it.
- Billing information — the details required to process a payment. Payments are handled by our payment providers, Stripe and PayPal. Card and PayPal account details are entered into, and held by, those providers; we receive only a token or transaction identifier, the amount, and the outcome. We do not store your full card number. Their own handling of your information is governed by their privacy policies — Stripe and PayPal. Where PayPal is offered as a payment option, PayPal’s JavaScript SDK is loaded from PayPal’s servers to render its payment button, which allows PayPal to observe that request.
- Campaign and placement information — the target URLs, anchor text, budgets, topical and geographic preferences, and other settings you configure.
- Support correspondence — anything you send us when you contact us.
Information transmitted by the LinkExchange plugin
If you install the LinkExchange plugin on a WordPress website, it transmits the following to our servers. This is the core of how the Service works: without it we cannot match your pages with relevant counterparties.
- On connecting the site — the site’s domain, its home URL, and the WordPress administrator email address used to create or link your LinkExchange account.
- When an article is scanned — either on demand from the plugin’s screens, when you open a post in the editor, or via the plugin’s background indexing job — the post ID, the permalink, the title, the publication date, the detected language and category, the article’s text content, its focus keyword and tags, its word, heading and image counts, and the list of links the article already contains, both outbound and internal.
- When you host or request a link — the URLs, anchor text, prices and campaign settings involved in the placement.
The plugin transmits only content that is already published, or intended to be published, on your public website. It does not read your WordPress users, comments, customer records, e-commerce orders, or any other data outside the posts and pages you index. It loads no remote scripts, stylesheets or fonts, and sends nothing to any party other than LinkExchange.
Information collected automatically
As you use the Service, certain information is collected passively — navigational data, pages and features used, the type of browser and operating system you use, your internet service provider, and IP address. We use this to generate statistics and measure activity, so we can understand which parts of the Service are most used and which need improvement, and for security purposes, to detect and block abuse and to keep the Service safe.
Cookies and local storage. The Service uses cookies and browser local storage to keep you signed in and to remember your preferences. You may decline or clear these through your browser, but doing so may affect your ability to use certain features.
Log files. Our servers log requests made to the Service, including timestamps, the endpoint requested and the account involved.
Public pages we fetch
To confirm that an agreed link is live and correctly configured, our systems periodically fetch the public URL of the page carrying the link, and record what was found. We fetch only publicly accessible pages, in the same way a search engine crawler would.
2. How the Company Uses Your Information
Your use of the Service is conditional on your consent to the collection, use and disclosure of information as described in this Privacy Policy and the Terms & Conditions.
We use the information described above to:
- Operate the Service — index your pages, generate and price matches, execute and verify placements, and maintain your credit balance and transaction history.
- Show your pages to prospective counterparties. When you offer a page as a host, other Users considering a placement may see that page’s URL, title, topic, language and derived quality metrics.
- Process payments, issue invoices, and manage subscriptions.
- Provide support, and respond to your enquiries.
- Detect, investigate and prevent fraud, abuse, and breaches of our Terms.
- Comply with legal obligations.
- Send you information about our products and services, and contact you about new features. You may opt out of marketing messages at any time.
De-identified data
We may use non-personally identifiable, de-identified or aggregated data collected through the Service (collectively, “De-Identified Data”) for any purpose. This data does not identify any individual and contains no personally identifiable information. The Company is the sole owner of the De-Identified Data and may copy, aggregate, distribute and otherwise use it.
Sharing with service providers
We may share some or all of your personal information, as necessary, with agents and service providers who provide services or administer activities on our behalf — including hosting, data processing and storage, payment processing, email delivery, analytics, and information technology services. We use contractual and other measures to restrict those providers from using your personal information for anything other than performing their services, and to require a level of security and privacy protection comparable to our own.
We do not sell your personal information, and we do not share it with other companies for their own commercial or marketing use without your consent.
Other disclosures
We may disclose personal information and non-personally identifiable information where we believe in good faith that it is appropriate or necessary to enforce our Terms, take precautions against liability, investigate and defend against third-party claims, assist government or law-enforcement agencies, protect the security or integrity of the Service, or protect the rights, property or safety of the Company, our Users or others. We will also disclose any information that we are required by law to disclose.
In the event of a sale, merger, liquidation or reorganisation of the Company, or a transfer of the assets relating to the Service, we may transfer some or all of the information we hold about you to the successor, subject to the terms of this Privacy Policy.
3. How the Company Protects Your Information
We work hard to protect your information. Traffic between the plugin, your browser and our servers is encrypted in transit. Access to production systems is restricted to personnel who need it.
The safety of your information also depends on you. Never share your password, and notify us promptly if you believe your account security has been compromised.
The Company may store and process your information at its offices in Canada or through third-party service providers, which may or may not be located in Canada. We employ commercially reasonable physical, managerial and technical safeguards appropriate to the sensitivity of the information. Nevertheless, because of the nature of the internet, security and privacy risks cannot be eliminated, and the Company cannot guarantee that your information will never be disclosed in a way not described in this Policy.
The Service is hosted in Canada. If you access it from a region whose laws governing personal data differ from Canadian law, please be aware that by continuing to use the Service you are transferring your information to Canada and consent to that transfer and to being governed by the laws of Ontario and Canada for these purposes.
4. Third-Party Websites
The Service matches you with, and links to, websites operated by third parties. We do not control those websites, which may collect information about you independently. We have no control over, and are not responsible for, their privacy practices or content. When you follow a link and leave the Service, you do so at your own risk. For information about another party’s privacy practices, contact that party directly.
5. Your Rights and Choices
Retention
We keep information for as long as it is necessary to provide the Service, or until your account is deleted, whichever comes first. This is a case-by-case determination that depends on the nature of the information, why it was collected, and any legal or operational retention needs. Records of completed financial transactions are retained for as long as required by applicable accounting and tax law. Indexed page content is deleted when you disconnect the website it belongs to or delete your account.
Managing your information
- Account settings. You can review and change your account details, connected websites, campaign settings and marketing preferences from within the Service at any time.
- Disconnecting a website. Deactivating or uninstalling the plugin stops any further transmission from that website. Disconnecting the website from your LinkExchange account additionally removes its indexed content from our systems.
- Deleting your account. You may request deletion of your account and its associated data by contacting us. On deletion we remove your account details, your connected websites and their indexed content, and any other information we no longer need to operate the Service. Please note that deletion does not affect information other Users hold about placements they transacted with you, and that we may decline requests that are unduly burdensome or repetitive, that cannot be honoured in light of legal obligations or ongoing disputes, or where retention is necessary to enforce our agreements or protect the rights, property or safety of the Company or another party.
European rights
If you are located in the European Economic Area, the United Kingdom or Switzerland, you may have the right to access, correct, erase, restrict or object to our processing of your personal information, and the right to data portability. You also have the right to lodge a complaint with a supervisory authority, including in your country of residence, your place of work, or where an incident took place. To exercise any of these rights, contact us using the details below.
6. How You Can Contact the Company
If you have questions about this Privacy Policy, about the Company’s practices, or about your dealings with the Company, or if you wish to know what personally identifiable information we hold about you, contact us at:
nandbox Inc., an Ontario corporation, Canada.