Privacy Policy

3.1 Data you provide to us

When you create a Bioflow account, we collect the following information:

• Name or username
• Email address
• Password (stored in encrypted form; never in plain text)
• Profile picture (optional)
• Bio or profile description (optional)
• Date of birth (optional; provided only to enable birthday rewards via the loyalty program)
• Links to your social media profiles and websites
• Registration method (email, Google, etc.)

3.2 Data collected automatically upon registration

At the time of registration, we automatically collect certain technical information:

• IP address
• Country and city (via IP geolocation)
• Device type (mobile, desktop, tablet)
• Operating system and version
• Web browser and version
• Browser language
• Time zone
• Exact date and time of registration
• Acquisition source (UTM parameters / referrer — the page you came from)

3.3 Usage data and in-platform events

Once your account is active, we record key events to improve the service:

• Date and time of your first added link
• Number of links in your profile and connected platforms
• Date of last profile update
• Login history (date, time, device, IP address)

3.4 Data about visitors to your public profile

When third parties visit your Bioflow profile page, we collect:

• Visitor IP address and country
• Device type and browser
• Date and time of the visit
• Link clicked
• Referring page (referrer)

This information is used to provide profile analytics to registered Bioflow users (you), and is not used to individually identify visitors.

3.5 Data about shortlink clicks (bflw.me)

When a visitor clicks a Bioflow short link (hosted on bflw.me), we record the following information to provide click analytics to the link owner:

• A one-way cryptographic hash of the visitor’s IP address (the original IP is never stored)
• Country of origin (derived from the IP address at collection time)
• Referring domain (e.g. “instagram.com”; full URLs are not stored)
• Date and time of the click

Because IP addresses are hashed before storage, it is technically impossible for Bioflow to recover the original IP from stored data. This information is used solely to provide click analytics to the shortlink owner and is never used to identify individual visitors.

3.6 Custom fonts (Pro profiles)

Pro users may select a custom Google Font for their public profile. When a visitor loads a profile with a custom font, their browser makes a direct request to Google Fonts (fonts.googleapis.com), which may result in Google receiving the visitor’s IP address and user agent. This is subject to Google’s Privacy Policy. Profiles using the default font do not trigger any Google Fonts request.

3.7 Loyalty program data

If you use the loyalty program feature as a creator, or enroll as a member in another creator’s program, we collect and store additional data to operate that feature:

• Creator: loyalty card configuration (name, stamp count, reward description), referral link, QR code identifier
• Member: email address, date of birth (optional, for birthday rewards), referral relationships (who referred whom), QR scan timestamps

Loyalty member data is processed on behalf of the creator who runs the program. Creators are responsible for obtaining appropriate consent from their members before enrolling them. Bioflow acts as a data processor for loyalty member data on behalf of the creator; the terms governing that processor relationship are set out in the Loyalty Program section of our Terms and Conditions.

4.1 Primary purposes (required for the service)

• Create and manage your Bioflow account
• Allow you to configure and publish your personalized profile page
• Ensure the security of your account and detect unauthorized access
• Provide technical support and handle customer service requests
• Comply with applicable legal obligations

4.2 Secondary purposes (service improvement and analytics)

With your consent or based on our legitimate interest, we also use your data to:

• Analyze aggregated usage metrics (registration country, device type, acquisition source) to improve the platform
• Understand which social networks are most connected to prioritize new feature development
• Send communications about service updates, new features, or important notices
• Send marketing communications (only with your explicit consent and with an opt-out option at any time)

7.1 Third-party data processors

In order to operate the Service, Bioflow shares certain data with the following third-party processors, each of whom acts under our instructions and is contractually bound to protect your information:

Each provider is subject to their own privacy policy and data processing terms, which we encourage you to review. We will update this list if we add or remove processors.

Some processors operate outside your country of residence (for example, in the United States), which may involve international transfers of data. Where required by applicable law, such transfers rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

10.1 Mexico (ARCO rights)

Under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) of Mexico, you have the rights of:

• Access: know what personal data we hold about you and how we use it.
• Rectification: request the correction of inaccurate or incomplete data.
• Cancellation: request the deletion of your data when it is no longer necessary.
• Opposition: object to the processing of your data for specific purposes.

We respond to ARCO requests within a maximum of 20 business days.

10.2 European Economic Area and United Kingdom (GDPR)

If you are in the EEA or the UK, under the GDPR and UK GDPR you have the right to:

• Access your personal data and obtain a copy of it;
• Rectify inaccurate or incomplete data;
• Erase your data (the “right to be forgotten”) where applicable;
• Restrict or object to certain processing, including processing based on our legitimate interest;
• Data portability — receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not carry out such decision-making).

The legal bases we rely on are described in section 5, and the safeguards for international transfers in section 7. You also have the right to lodge a complaint with your local data protection supervisory authority. We respond to GDPR requests within one month, which may be extended by two further months for complex requests.

10.3 California (CCPA / CPRA)

If you are a California resident, under the CCPA (as amended by the CPRA) you have the right to:

• Know the categories and specific pieces of personal information we collect, use, and disclose;
• Delete personal information we have collected, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information;
• Limit the use of sensitive personal information;
• Not receive discriminatory treatment for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. You may submit a request yourself or through an authorized agent; we may need to verify your identity before responding.