3way.social

    Privacy Policy

    Last updated: 8 October 2026

    This policy explains what personal data 3way.Social collects, why, who receives it and what rights you have. It covers 3way.social, its blog, the app at app.3way.social, our support chat and our Help Center.

    Who we are

    3way.Social is the controller of your personal data. 3way.Social is the trading name of Ian Naylor, a sole trader, at The Old Granary, Church Street, Whatton, Nottingham NG13 9EL, United Kingdom.

    For any question about privacy, or to use your rights, email ian@3way.social.

    We follow the UK General Data Protection Regulation (UK GDPR) and, for people in the European Economic Area (EEA), the EU General Data Protection Regulation (GDPR).

    What data we collect

    • Account data: your name, email address, password (stored only in hashed form), company details if you add them, and how you sign in. If you sign in with Google, Google gives us your name, email address and account identifier.
    • Domains and site data: the websites you list, with their category, anchor texts, guidelines, prices and services, metrics such as rating, traffic and spam score, and screenshots and icons of the sites. We also read and analyse public pages of listed websites to find link opportunities.
    • Deals and messages: the requests and deals you make with other members, the links and guest posts involved, the results of our link checks, and the chat messages you exchange with other members.
    • Payments and cash-outs: your credit purchases and balance, your Stripe customer ID and the brand and last four digits of your card, your invoices, your PayPal email address and your cash-out history. Stripe holds your full card details; we never see them.
    • SEO package orders: when you order a package on 3way.social, your name, email address, company, target website, keywords and the brief you give us.
    • Support: what you write in the support chat, and the calls you book with us.
    • Invitations: if you invite someone by email, their email address, which we use to send the invitation.
    • Usage and analytics: how you use our website and the app, collected with cookies and similar tools as described under Cookies below, and events in your account that our server records.
    • Logs and security records: IP address, browser type, the pages you request and when, and a record of important actions in your account (such as sign-ins, changes to settings and failed attempts), some with your IP address.
    • To provide the service (contract): to create and run your account, list your domains, suggest link partners, run deals, lock and release credits, check links, take payments, pay cash-outs, create invoices, deliver SEO packages, and send you service emails such as deal updates, chat notifications and new link suggestions.
    • Our legitimate interests: to keep 3way.Social secure and prevent fraud, spam and abuse (our sign-up form uses Google reCAPTCHA for this), to fix errors, to enforce our rules, to answer support requests, to understand how members use the app so we can improve it, to receive internal alerts about important account events, and to establish or defend legal claims. We balance these interests against your rights, and you can object (see Your rights).
    • Your consent: for analytics and marketing cookies and similar tools, and for passing visits to advertising networks. You can withdraw consent at any time with Cookie settings.
    • Legal obligations: to keep accounting and tax records and to respond to lawful requests from authorities.

    Automated tools and AI

    We use automated tools and AI to value domains, suggest link partners, pages and keywords, and check whether placed links are still live. Domain values and suggestions are about websites, not about you as a person.

    If you think one of these checks is wrong, contact us and a person will review it.

    Our support chat may first be answered by an AI assistant. You can ask to speak to a person at any time.

    Who receives your data

    We share personal data only where needed for the purposes above. Most of the providers below process it on our behalf and on our instructions. Payment providers such as Stripe and PayPal also use some data for their own legal duties, under their own privacy policies.

    • Hosting and backups: Hetzner, in Germany, hosts our website, the app and our database backups.
    • Payments: Stripe processes card payments for credits and SEO packages. Supabase runs the checkout functions for SEO packages on 3way.social and passes your order details to Stripe. PayPal receives the cash-outs we send to your PayPal email address.
    • Invoices: Invoice-Generator.com receives your email address and company details to create invoices.
    • Email: Resend sends our account and notification emails.
    • App features: Pusher delivers live updates in the app, such as new messages. Sentry records technical errors so we can fix them.
    • Support and analytics: SaaS Toolkit runs our support chat, call booking and visit analytics, and receives the account events described under Cookies. With your consent, it passes visits to advertising networks such as Google, Meta and Reddit.
    • Analytics and advertising, only with your consent: Google (Google Analytics and Google Ads), Hotjar (in the app) and PageTest.AI.
    • Sign-in and security: Google, for Sign in with Google (its sign-in prompt loads on the app's signed-out pages, so Google receives those visits even if you do not use it), and Google reCAPTCHA on the sign-up form.
    • SEO data and AI: to analyse websites and value domains we use Zyte (page crawling), Brave Search, Serper, Google Custom Search, DataForSEO, Moz metrics through RapidAPI, OpenPageRank, and AI providers such as OpenAI and Google Gemini. They mainly receive website content, domain names and keywords, not your account data.
    • Team alerts: Slack, where our team receives alerts about some account events, for example a cash-out request with your name and email address.
    • Other members: members you deal with see your listed domains and their details, your deal requests and the messages you send them.
    • Others, when needed: our professional advisers, authorities or courts where the law requires it or to protect our rights, and a buyer of the business if it is sold.

    International transfers

    Some of our providers store or access data outside the UK and the EEA, mainly in the United States. When personal data is transferred, we rely on an adequacy decision (for example for providers certified under the EU-US Data Privacy Framework and its UK Extension) or on safeguards such as the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses. You can ask us for more information about these safeguards.

    How long we keep data

    • Account data, domains, deals and messages: for as long as your account exists. When you delete your account, we delete or anonymise this data, except what we need to settle an open dispute or legal claim.
    • Payment, invoice and cash-out records: for as long as tax and accounting law requires.
    • Logs, security records and analytics: for limited periods, after which they are deleted or kept only in aggregated form. Analytics providers keep data according to their retention settings.
    • Backups: for a limited time, after which they are replaced by newer backups.
    • Your cookie choice: 12 months.

    Your rights

    Under the UK GDPR and the EU GDPR you have the right to:

    • access the personal data we hold about you and get a copy
    • have inaccurate data corrected
    • have your data deleted
    • restrict how we use your data
    • receive data you gave us in a common machine-readable format, or have it sent to another provider (portability)
    • object to our use of your data based on legitimate interests, and to any direct marketing
    • withdraw your consent at any time, without affecting what we did before

    You can change most account details in the app and delete your account there. If the app does not let you delete it, for example because of your deals or a pending cash-out, or for anything else, email ian@3way.social. We may ask you to confirm your identity. We reply within one month, or tell you within that month if we need more time, as the law allows.

    Complaints

    If you are unhappy with how we handle your data, please contact us first at ian@3way.social. We acknowledge complaints within 30 days and tell you the outcome.

    You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live or work in the EEA, to the data protection authority in your country.

    Cookies

    3way.social, its blog and the app at app.3way.social share one cookie choice. In Europe (judged by your browser's time zone: the EU and its outermost regions, the EEA, the UK, Switzerland and the rest of Europe), nothing beyond the necessary cookies runs until you agree in the cookie banner. Elsewhere, analytics and marketing cookies run unless you reject them. Your choice is kept for 12 months in the cookie tw_consent.

    • Necessary: tw_consent (your cookie choice). In the app, the session and security cookies that keep you signed in. On the app's signed-out pages, Google's sign-in service (Sign in with Google) and, on the sign-up form, Google reCAPTCHA load and use their own cookies on Google's domains.
    • Analytics (only with your consent): Google Analytics 4 by Google (_ga, _ga_*, _gid, _gat_*), to see how the site is used. Hotjar, in the app (_hj*), to see how pages are used. PageTest.AI (ptai_*), to see which version of a page works better.
    • Marketing (only with your consent): Google Ads by Google (_gcl_au, _gcl_*, _gclid and its own cookies on Google's domains), to measure our ads. SaaS Toolkit (saas_analytics_* and sa_chat_* in your browser's storage, and the advertising-network identifiers _fbp, _fbc and _rdt_cid), for visit analytics, the support chat and booking a call, and to pass visits to advertising networks such as Google, Meta and Reddit. SaaS Toolkit runs only when both analytics and marketing are allowed, so the chat and booking buttons ask for both before they open.

    Separately from cookies, the app sends account events from our server to SaaS Toolkit for support and product analytics: signing up, domains, deals and guest posts (with the other member's account ID), credit purchases and balance, cash-outs and invitations.

    You can change your choice at any time with Cookie settings at the bottom of every page.

    Children

    3way.Social is for businesses and professionals and is not meant for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

    Changes to this policy

    We may update this policy from time to time. The date at the top shows the latest version. We will tell you about important changes by email or in the app.

    Credits

    Icons by Streamline (Freehand), licensed under CC BY 4.0.