1Who we are
Biolinko is operated by Meek Media LLP, 16 Cross Street. We are the data controller for your account data. Contact us at [email protected].
2What we collect from you
- Account: name, email, password (stored hashed), timezone, and optional billing name and address.
- Content: everything you add to your page: links, text, images, files, form settings.
- Payments: plan, amount, currency, invoice details and a payment reference. Card and UPI details are handled by our payment processors and never touch our servers.
- Usage: logins, IP address at login, browser and device type, to keep your account secure.
- Email verification: new accounts confirm their email address with a one-time link before the account is activated. We store the time it was confirmed.
- Directory listing (optional): if you list a page in the Biolinko directory, a card for it is shown publicly on the directory pages and, if we feature it, on the showcase page. The card shows the page's title (or username), profile picture, bio, the titles of a few of its links, its category (for example Café or Coach) and city if you set them, its address, its theme colours and any Verified or Featured badge. The page is also included in our sitemap. You can unlist it at any time in page settings.
3If you connect Instagram
The Instagram feed block can show your latest posts automatically. This works only for Instagram Business and Creator accounts, through Meta's official Instagram API, and only after you connect your account and approve it on Instagram. We never ask for your Instagram password and we never scrape instagram.com.
- What we store: your Instagram account ID, username and account type; an access token, encrypted at rest and refreshed before it expires; and for your 12 most recent posts, the post ID, type, link, date, the first 160 characters of the caption and a small thumbnail image saved on our servers.
- How it is used: only to show those posts on your own page. We check for new posts about every 45 minutes. Posts that drop out of your latest 12, or that you delete on Instagram, are removed from our servers at the next check.
- How to remove it: choose Disconnect in Biolinko, or remove Biolinko under the apps and websites settings in Instagram. Either way we delete the token, the stored posts and their thumbnails. Meta can also send us a data deletion request on your behalf; we act on it automatically and give you a confirmation code to check its status. We keep that code, with no personal data, for 180 days.
4If you use a custom domain
When you connect your own domain (a Pro feature) we store the hostname, the page it points to, a verification token for the DNS TXT record and the setup status. We look up your DNS records and fetch one verification file from your domain to check the setup. The hostname is registered with Cloudflare, our network provider, so it can issue the HTTPS certificate. If you remove the domain or delete your account, we delete it from Cloudflare too.
Visits to a page on a custom domain pass through a Cloudflare Worker that we run. It forwards the visitor's IP address and approximate location (country, city and coordinates rounded to about 10 km) to our servers in a signed header, so that visits are counted and spam limits work exactly as on Biolinko addresses. This is not stored anywhere beyond the normal visitor analytics described below. Pages on custom domains set no cookies, except a short-lived one after a visitor enters a page password or confirms an age check.
5What we collect from your visitors
When someone opens your page we record a view, and a click when they tap a link. For each we store the country and city, device type, browser, operating system, referring site and any UTM tags. We store a one-way hash of the visitor's IP and browser for the day to count unique visits. We do not store the full IP address, and we do not track visitors across other websites.
We may also store approximate coordinates for the visitor's city, rounded to about 10 km, to show you where visits come from on the Pro live globe. If you add the Audience map block to your page, it shows countries only, and only countries with several visits; it never shows individual visitors.
If a visitor fills in a form on your page (email, phone or contact), that information is stored for you as a lead, together with the time and the visitor's IP address, which we use to prevent spam and abuse. You are responsible for how you use it and for telling your visitors what they are signing up for.
6Appointment requests and event RSVPs
If your page has an Appointment or Events block, visitors can send you a request or an RSVP. We store what they enter, for you, as a lead:
- Appointment requests: name, phone number and/or email (you choose which are required), an optional note, and the service, date and time they picked.
- RSVPs: name, email, an optional phone number, the event and the number of guests, and whether they are on the guest list or the waitlist.
We send the page owner an email about each new request or RSVP. If the owner has it switched on, we also email the visitor a copy, and later a short message when the owner confirms or declines an appointment or moves them off the waitlist. These emails are sent in the page's language, and we limit how many can go to one address per day. If the owner allows replies, the visitor's reply goes to the owner's account email, so the visitor will see that address; otherwise replies come to us. The page owner decides what happens next and is responsible for how they use these details. Requests and RSVPs stay in the owner's Leads until the owner deletes them or their account.
7Pages we fetch for you
Two features read a public web page on our server, only when a signed-in user or a visitor of our tools asks for it, using our BioLinkoBot user agent: Import links (you paste the address of your own Linktree, Beacons, bio.link, Lnk.Bio or other page) and the link in bio SEO checker (you paste any public page address). We fetch that one page and do not follow links or crawl. Import previews are kept for 30 minutes so you can choose what to copy; only what you select is saved to your page. SEO checker results are cached for up to 1 hour so repeat checks of the same address are fast. We can only read pages that are publicly available, and we do not keep the fetched page beyond these times.
8QR codes
The QR code generator runs in your browser. If you leave Track scans on for a Biolinko page, the code holds a short /q/ link. When someone scans it, we count a page view tagged with source qr, medium print and the campaign name you chose, using the same anonymous visitor data as any other view, and then send them to the page. Scans of codes for other websites never pass through us.
9Embedded players, maps and fonts
Videos, music players, maps and other embeds on a page come from third parties such as YouTube, Spotify or Google Maps. To protect visitors and keep pages fast, these load only when a visitor taps them or scrolls near them; until then, nothing is requested from those services. When they load, the third party receives the visitor's IP address and may set its own cookies under its own privacy policy. A YouTube video shows its preview image from YouTube's image server (i.ytimg.com) before it is played, and the Instagram feed block shows thumbnails stored on our servers.
Fonts on Biolinko pages and on our site are served from our own servers. We do not load Google Fonts, so no font requests go to Google.
10How we use it
- To run the service, show your page and your analytics, and send you the emails you asked for.
- To send account emails (verification, password resets, receipts, lead and booking alerts), the weekly report, and occasional product news, such as an invitation to list your page in the directory. Every weekly report and product news email has a one-click unsubscribe link, and you can turn both off in Account settings. Account emails cannot be turned off while you have an account.
- To bill you and issue invoices.
- To keep the service safe, prevent abuse and enforce our terms.
- To improve the product, using aggregated, anonymised statistics.
We do not sell personal data, and we do not use your content or your visitors' data for advertising.
13How long we keep it
- Account and content: until you delete them.
- Visitor analytics: 30 days on the Free plan; longer on Pro, and at most 13 months in detail. Daily totals are kept indefinitely in aggregate.
- Payment records: 8 years, as required by tax law.
- Leads, appointment requests and RSVPs: until you delete them or your account.
- Instagram connection: until you disconnect; only your latest 12 posts are kept.
- Custom domain records: until you remove the domain or delete your account. If Pro ends, we keep the record so the domain works again when you renew.
- Import previews: 30 minutes. SEO checker results: up to 1 hour.
- Sent emails in our mail queue: 30 days.
- Server logs: 30 days.
14Your rights
You can access, correct, export or delete your data at any time from Account settings, or by emailing [email protected]. Account deletion removes your pages, blocks, leads and analytics within 30 days; invoices are kept as the law requires. You can also object to processing or complain to your local data protection authority.
15Security
Passwords are hashed with bcrypt, connections are encrypted with HTTPS, and access to production systems is limited to staff who need it. No system is perfectly secure; if we discover a breach that affects you, we will tell you without undue delay.
16Children
Biolinko is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has an account, contact us and we will remove it.
17Changes to this policy
We will notify you by email or in the dashboard before material changes take effect. The date at the top shows the current version.