Privacy policy

This policy explains the data collected when you use BulkMetrik, why it is used, and how it is protected. Data collection is based on the operational needs of the service.

Information we collect

When you register with email or Google, we store the following data:

• Name and email address — for account identification and communication
• Password — stored as a hash for accounts that use a password (hash).
• Domain check history — so you can revisit previous results
• Transaction history — to record purchases and your token balance

Free checks do not require account registration. The system processes checked domains, IP addresses, and session information to provide results, enforce quotas, and perform security verification.

The contact form stores your name, email, topic, message, IP address, and browser information. When signed in, messages may also be linked to your account.

To complete their account, users answer a survey about their role, usage goals, and how they discovered BulkMetrik. Answers are stored with the account and used by administrators for internal analysis and service development.

How we use information

We use your data only for the following purposes:

• Providing domain metric checks
• Managing your account and token balance
• Processing incoming payments
• Evaluating and improving service quality
• Answering questions you submit through the contact form

Data storage

Metric results are stored and may be reused while they remain within their validity period. Separately, signed-in users’ check history is linked to their accounts to display activity and record token usage.

Domain results, registration summaries, check logs, shared links, and detail access follow a shared seven-day period. Daily summaries for the annual calendar are stored separately and are not deleted when result periods change. They contain the date, type, and count of activities linked to an account. Account and transaction records are retained to operate the service and handle payment inquiries. Deletion requests can be submitted through the contact page. The team will explain which records can be deleted and which are still needed, with reasons.

Data sharing

We will never sell or trade your data to third parties.

Data needed to operate features may be processed by the following service providers. Use of third-party services is also subject to each provider’s privacy policy.

• Payment providers — to process token transactions
• Metric data providers — receive checked domain names through integrations, including intermediary services used to retrieve metrics.
• Google authentication services — handle sign-in if you choose Google. We store the Google account ID, name, email, and profile picture URL received.
• Country.is — the dashboard browser requests api.country.is to determine the country from your public IP and display a flag. The service receives the public IP and technical request information. This feature does not send your name, email, or account data. The country code and lookup time are temporarily stored in browser sessionStorage for five minutes.
• Device notifications — if you allow notifications, we store the push subscription endpoint and technical keys needed to send notifications through your browser’s push service. You can disable them in profile settings or browser notification permissions.
• Cloudflare Turnstile — is used for form security verification. Your browser communicates with Cloudflare to complete verification.
• Asset and icon services — Google Fonts, icon CDNs, and favicon services receive browser requests. These requests may include your IP address and technical browser information.

We may also disclose data when required by applicable law.

Platform security

We apply several layers of protection:

• Encryption using SSL/TLS for HTTPS web connections
• Passwords are stored as a hash, which cannot be reversed to read the original password
• Session checks and sign-in attempt limits

However, no system is completely immune to threats. We recommend using a unique password and not sharing it with anyone.

Cookie use

We use session cookies to maintain sign-in, device cookies to manage access, and a language cookie to remember ID/EN for up to one year. Light or dark theme preferences are saved in browser local storage. You can remove these preferences through your browser settings.

Your data rights

You control your personal data and have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your account and its personal data
• Withdraw consent by stopping your use of the service

To make any of the requests above, please contact us. Please note that deleting your account does not refund your remaining token balance.

Policy changes

We may update this privacy policy at any time. Changes take effect when published on this page, and the update date at the top will be adjusted accordingly.

We recommend reviewing this page periodically for the latest updates.