Privacy Policy

Your email address. It is how you sign in; there is no password to store. Sign-in links and session tokens are stored only as hashes and expire.

API keys. Stored as a SHA-256 hash with a short non-secret prefix so you can recognise which key is which. We cannot recover a key, only replace it.

Your orders and ledger. What you bought, the target URLs and anchor text you supplied, what it cost, and every credit movement. This is the record of the transaction and we keep it.

API usage counts. Requests and rows returned per key, to enforce rate limits and allowances.

We do not store card details. Payments are handled by Stripe, which is PCI-DSS compliant. We receive confirmation that a payment succeeded and an identifier for it. Card numbers never reach our servers.

Purchase observations. When you use a tool built on our API to grade a link report or compare placements you have bought elsewhere, the placements, prices, and the target they pointed at are recorded as market observations. We keep the type of anchor (branded, exact match, and so on) and never the anchor text. Where a buyer is identified by email, only a salted hash is stored. These records are used solely in aggregate: nothing about one buyer is ever shown to another, every figure we publish from them covers at least three distinct buyers, and targets are never returned.

What we observe about your targets and placements. For each order we record the positions of the target page for the keywords you gave (from a third-party search index), re-check the delivered page at intervals for up to a year (whether the link is present, its attributes, and facts about the page around it), and keep the result as the order’s outcome. These are shown to you; per-publisher aggregates (never per-buyer) may inform the catalogue. Articles you supply or we write for you are stored with the order.

Our own crawling. We fetch a small sample of publishers’ public pages to describe them (posting rate, outbound links, sponsored marking) and re-check delivered links, with a plainly identified user agent and respect for robots.txt. This is about publishers, not about you.

We do not ask for a name, a phone number, a postal address, or anything about your clients beyond the URLs you choose to send us.

To run the service you asked for: authenticating you, placing and tracking your orders, keeping your balance correct, enforcing spend caps and rate limits, and meeting our tax and accounting obligations. Where a legal basis is required, ours is performance of our contract with you and our legitimate interest in operating and securing the service.

Suppliers receive the target URL and anchor text of the specific placement they are fulfilling, because it cannot be fulfilled without them. They do not receive your identity, your other orders, or your contact details. Purchase orders they see never include our margin.

Processors we rely on: Stripe (payments), Neon (database), Vercel (hosting), Resend (transactional email), PostHog (product analytics on the public pages, see Cookies), DataForSEO (domain and rank measurement; it receives domain names from the catalogue and the target URLs and keywords you ask us to track, never your identity), and Anthropic (when you ask us to write an article, the brief and the publisher’s requirements are sent to its model to draft it; nothing else about you is).

Google Search Console, only if you connect it. You grant us read-only access to the Search Console properties you choose; we store the refresh token encrypted and pull your search performance rows (page, query, clicks, impressions, position) each night into tables that belong to your account alone. They are shown back to you, used to measure the outcome of your own orders and to suggest pages worth a link, and for nothing else: never published, never pooled with other customers’ data, never used to build the catalogue or to train anything. Disconnecting revokes our access at Google and deletes every row we held. Our use of Google data complies with the Google API Services User Data Policy, including its Limited Use requirements.

We do not sell your data, do not share it with advertisers, and do not use it to train models.

One cookie, holding a signed session token so you stay signed in. It is HTTP-only, SameSite=Lax, and expires. There are no advertising cookies and nothing on this site is shared with advertisers.

We use PostHog for product analytics on the public pages: which pages get read, and which of them precede a signup. It stores an anonymous identifier in your browser’s local storage, not in a cookie, so that a second visit is not counted as a second person. No account or session is ever recorded, and it is switched off entirely on the pages behind a login: your dashboard, the operator console, and any page reached by a token in its URL.

Orders and ledger entries are kept for seven years, because they are financial records. Session and sign-in tokens expire within days. Quotes are deleted a day after they lapse. Revoked API keys are kept as hashes so an old key cannot be silently reissued.

Close your account and we delete your email address and keys, and retain the transaction record in the form required for accounting.

You may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@placementapi.com and we will respond within 30 days. If you are in the UK, EU or California you have these rights by statute; we extend them to everyone because operating two standards is worse than operating the better one.

Secrets are hashed, never stored in a form we can read back. Everything is served over TLS. Spend limits are enforced in the database rather than in application code, so a bug in the application cannot spend past them. If we discover a breach affecting your data we will tell you.

Material changes will be notified by email to your account address before they take effect.

Future Bets, Inc. · hello@placementapi.com. See also our Terms of Service.