Last updated: 31 October 2026
Who we are. BehindLink is run by Neshys, MB, a company registered in Lithuania (company code 307595831), Vytauto g. 72-7, LT-21116 Trakai, Lithuania. For anything about your personal data, write to hello@behindlink.com.
BehindLink finds websites, ads and accounts that impersonate a brand, collects evidence, and gets them taken down. This page explains what personal data that involves, why we use it, how long we keep it, who else sees it, and what you can ask of us.
For most of what is on this page we decide why and how the data is used, so we are the controller: this website, the free check, signing up online, our contact with prospects, the evidence we collect about fake sites, our correspondence with abuse desks, and billing and payments.
For our customers we are also a processor. The people a customer signs up to the portal, the people and addresses that receive its alerts, and the reports, emails and requests its team sends us are handled on the customer's behalf and on its instructions, under our data processing agreement. For that data the customer is the controller and its own privacy notice applies as well. If you are one of those people and ask us about your data, we will help, and we will involve the customer where the request is theirs to decide.
This website runs on our own server at Hetzner in Falkenstein, Germany. Like any web server it logs each request: your IP address, the time, the page, your browser's description of itself, and the page that linked here. We use the logs to keep the site secure and to fix errors, which is our legitimate interest. They are deleted after 14 days.
By default this site sets no cookies. It keeps a few small values in your browser's local storage, which never leave your device:
| Name | What it remembers | How long |
|---|---|---|
bl-theme | Light or dark theme, if you chose one | Until you clear it |
bl-analytics | Your answer to the analytics question | Until you change it (button below) or clear it |
bl-hero | Which version of the home page you saw, only while we compare two versions | Until you clear it |
A small banner asks whether we may use Google Analytics to see which pages help. Nothing loads unless you choose
"Allow". If you do, Google Analytics (provided by Google Ireland Limited, with processing by Google LLC in the United
States) sets its _ga cookies (they last up to two years) and records the pages you view, roughly where
you are, your device and browser, which version of the home page you saw, and whether you sent the free-check form. Google receives your IP address to do
this; it says Analytics does not store it. We have turned off Google signals and ad personalisation, so this data is not
used for advertising or to follow you across other sites. We see only totals. Google keeps the data for the period set
in our account, at most 14 months. The legal basis is your consent, which you can withdraw at any time:
The site loads no fonts, scripts or images from other companies, apart from Google Analytics when you allow it.
The form on our home page asks for your website and an email address, and, if you want to give it, the address of a fake you have already seen. We use these to run the check you asked for and to write to you about it, as a step you asked us to take before any contract. The form also records which version of the page you used it on, the name of the website that sent you to us (not the page) and any campaign tags in the link you followed. Those tell us which page and which link brought you; we use them, in our legitimate interest, only to count where requests come from. We don't add you to mailing lists and we don't sell or share your details.
The form goes straight to our own server at Hetzner in Helsinki, Finland. We email you the report through Resend (section 5). To stop misuse, we count requests by IP address and email address, keeping only a scrambled form of each, and delete the counts after two days. If we decline a request, we delete it 30 days later. Otherwise we keep your request and our conversation while it is useful to it; if you don't become a customer we delete them within 12 months of our last exchange, or sooner if you ask.
To start Domain watch online you give us your brand's web address, your work email at that address, your name, your company's name and its billing country, and you accept our terms of service. We use them to set up the account you asked for, as a step before a contract. We email you a link to confirm the address. The link works for 24 hours and we delete it, with what you typed, 30 days after it expires.
When you confirm, we create your account (section 6) and record which version of our terms your company accepted, and when. You pay on Stripe's page (section 5a). If you don't pay within 7 days, we delete the account and what you typed; we keep only the web address, the country and the dates, to count signups. If we need to set your brand up with you by hand, we keep your email address to write to you, and delete it after 30 days.
To stop misuse, we count signup attempts by IP address, email address and web address, keeping only a scrambled form of each, and delete the counts after two days.
We sometimes write to people at a company when we have found sites impersonating its brand. We find a suitable work contact from public sources, such as the company's own website. Our message may carry a link to a private page showing the evidence. When that page or its access code is used, we record the time, IP address, browser and referring page, so we know the evidence reached you and can protect the page from misuse. These records are deleted automatically after 12 months.
We do this in our legitimate interest in offering our service to businesses whose brands are being misused. You can object at any time: reply to our message or write to hello@behindlink.com and we will stop contacting you.
When you write to us (hello@, support@ or any other behindlink.com address), your email is kept in our mailboxes at Proton in Switzerland. We use it to answer you and keep it while the conversation or your contract lasts, and afterwards only as long as our records or the law require (for example, invoices are kept in our accounts and by Stripe for the period Lithuanian accounting law sets; see section 5a).
When we write to you, service email (sign-in links, invitations, alerts, daily and weekly summaries, monthly reports, receipts for reports, and the free check's report) is sent through Resend (United States), which handles the recipient address and the message on our behalf. If a customer adds a webhook, its alerts are also posted to the web address it chose, such as its own Slack; what happens to them there is up to the customer. Replies to that email come to our support mailbox, and replies to the free check's emails to the person running the check. Other email from us is written and sent by a person from our own mailboxes.
Customers pay us through Stripe, or by bank transfer straight to our account. For our Lithuanian account the Stripe company is Stripe Payments Europe, Limited, in Ireland. Billing is our own business as the seller, so for this data we are the controller (section 1), even where the email address is also one the customer's team uses to sign in to the portal.
What Stripe holds. To bill a customer through Stripe we give Stripe the work email address of its Owner or of its billing contact, and the company's name, address and VAT or tax number. The customer can also type or change these on Stripe's own pages. Whoever pays by card types the card details on Stripe's own page: they go to Stripe only, and we never see or store a card number. Stripe keeps the billing details and the payment history, and can email receipts and invoices.
Stripe's role. Stripe handles this data on our behalf to take payments and send receipts and invoices. It also uses it as an independent controller for its own purposes, such as preventing fraud, meeting its legal duties and choosing the banks and payment networks it works with; its privacy notice explains those. Stripe may transfer the data to the United States, relying on the Standard Contractual Clauses and the EU-US Data Privacy Framework.
What we keep. In our own system we keep a short billing record for each customer organisation: how it pays (by card, by invoice, or nothing to pay), Stripe's reference numbers for its customer and subscription, the dates it is paid through and renews, what a payment covers (how many brands on which plan), the invoice or order number, the billing country, and whether Stripe accepted the VAT number. It holds no card detail, no name, no email address and no street address. When we check a payment on our own console we read the customer's details from Stripe; they are shown to us there and not stored.
How long. We delete the billing record with the rest of the customer's data at the end of the contract (section 6), and our record of Stripe's notices about it after 35 days. Invoices are kept in our accounts for the period Lithuanian accounting law sets; Stripe keeps its own copies under its privacy notice. We use this data to perform the contract and to meet our legal duties as the seller (Neshys, MB).
People at our customers sign in to the portal with their work email, a link we email them and, for some roles, a second step from an authenticator app. For each person we keep:
Opening a guest link (a link that shows the portal without a sign-in) records the time, IP address and browser in the same activity log.
One cookie. The portal sets a single cookie, __Host-bl_session, which holds a random
identifier that keeps you signed in. It is strictly necessary, so it needs no consent. It ends when you sign out, and
lasts at most 30 days. The portal also keeps three small values in your browser: whether you came in by a guest link,
the page to return to after signing in (removed once used), and your paper size for printing evidence and reports.
How long we keep it.
We handle this data as the customer's processor (section 1). The customer decides who has access; we use the sign-in records also to keep the portal secure.
Customers can send us an address they think is fake, through the portal, our API, or by forwarding an email to their own report address. For each report we keep the address, when it was sent and by whom, and any reference or note the sender added.
When your team asks us to change your brand's details (an official domain, store, social account or advertiser), we keep what was asked, the note, who asked, and our answer.
From a forwarded email we keep when it arrived, who forwarded it, a ticket number from the subject line, how many links it held and the suspicious links we filed, without anything after the "?". Nothing else from the email is stored by us: not the subject line, the message, its attachments or any email address in it. We name the person who forwarded it only when they are on your team in the portal and their email provider confirms the email came from them; otherwise we keep only whether it came from someone at your company's own domain, from a mailbox rule, or from someone else. If the email came from a domain that imitates your brand, we file that domain like any other suspicious link. We delete the record of each forwarded email after 365 days; the links we filed stay under Submissions, with the ticket number and who forwarded them, until the contract ends. The forwarded message is received for us by Resend, which holds it on our behalf.
If your team sets up automatic forwarding in Gmail, we keep only Google's confirmation code, for at most 7 days, so we can give it to an Owner or Admin. When we change your forwarding address at your request, the old one keeps working for 7 days, or less if you ask; after that, we count emails sent to it and keep nothing from them.
To judge whether a page is fake, we send its address, up to about 1,800 characters of its visible text and how we found it (which can include the note on a report) to OpenAI (United States). OpenAI does not use this data to train its models and deletes it after at most 30 days. We also use AI from Anthropic (United States) to review findings, both automatically several times a day and when our analysts work on them, and to prepare takedown reports; it sees the finding, its evidence and any note.
When we report a fake site, the report can quote how the site was found, including a note on a customer's report. Please don't put your own customers' personal details in report notes.
We monitor public sources (certificate logs, ad libraries, search results, social networks and the open web) for impersonations of the brands we watch, and keep evidence of what we find: the address, screenshots and copies of the page, hosting and registration records, and the public details of ads and accounts that pose as a brand. We collect registrar and hosting details, not the personal details of domain owners.
Evidence can contain personal data: the name or contact details a fraudster used, or names and photos copied onto a fake shop. We keep and share it in our legitimate interest, and our customers', in stopping fraud and protecting people from it. We keep it while a site or its operators may return and as a record of the fraud, and use it to measure and improve our detection. Each monthly report we issue to a customer is kept as it was issued: its numbers and the fake sites it lists. It names no one at the customer. If you are shown in our evidence and believe you should not be, write to us.
We do not make decisions about people by automated means. Our automated analysis judges web pages, not people.
Our takedown reports go to the companies that can act on a fake site: hosting providers, domain registrars, platforms, Google Safe Browsing, Microsoft, Netcraft, Cloudflare and national security teams (CERTs). Each report carries the evidence and the name and contact details of the BehindLink analyst who filed it.
Replies to our reporting address are received for us by Resend. We keep the sender's address, the subject and the text with the takedown record, to follow the case up, and for as long as we keep that record.
The service runs on our servers at Hetzner in Helsinki, Finland. Connections are encrypted; sign-in links, session identifiers and API keys are stored only as hashes; two-step secrets are encrypted; our operator console is reachable only over a private network. Our application's technical logs do not record visitors' IP addresses and roll over by size.
The database and evidence files are backed up daily to encrypted storage we control in Lithuania. We keep the last seven copies, so something deleted from the service leaves the backups within about a week.
We never sell personal data. It is shared only with:
Some of these providers are in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. Switzerland, where Proton is, is recognised by the Commission as protecting personal data adequately.
Under the GDPR you can ask us what personal data we hold about you and for a copy of it, and ask us to correct it, delete it, limit how we use it, or give it to you in a portable form. You can object to our use of it based on legitimate interest, including any contact about our service, and withdraw a consent at any time. Write to hello@behindlink.com; we answer within one month.
You can also complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt) or to the authority where you live or work.
If this page changes, we update the date at the top. Customers are told of material changes to how we process their data in advance.