Privacy Policy

Last updated: 1 May 2026

bio.page (the “Service”) is operated by Magic Crystal Limited, a company registered in Hong Kong with its registered office at 28 Wellington Street, Central, Hong Kong (“we”, “us”, “our”). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, with whom we share it, and the rights you have over it.

1. Data Controller and EU Representative

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR, the data controller is Magic Crystal Limited.

Pursuant to Article 27 GDPR, our appointed EU representative for data subjects in the EU and EEA is:

Financial Technology OÜ
Narva mnt 5, Tallinn 10117, Estonia
Email: [email protected]

EU/EEA data subjects may contact our representative directly in any official EU language regarding any matter relating to the processing of their personal data.

2. What We Collect

• Account data — email address, name, password (stored only as a one-way hash), and any profile details you choose to provide.
• Content data — the biolinks, blocks, images, files, and text you upload to your account.
• Payment data — if you subscribe to a paid plan, payment is processed by Stripe. We receive a customer ID, last-four card digits, country, and subscription status. We never see or store your full card number.
• Usage and device data — IP address, browser, operating system, language, referrer, and pages visited. We use a coarse country-level IP lookup (MaxMind GeoLite2) for analytics and abuse prevention.
• Cookies and similar technologies — see Section 7.

3. Why We Use It (Legal Bases)

• To provide the Service — account creation, authentication, hosting your biolink page, billing. Legal basis: contract (Art. 6(1)(b) GDPR).
• To keep the Service secure — rate limiting, fraud detection, abuse investigation, and security logging. Legal basis: legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
• To improve the Service — aggregate analytics to understand usage. Legal basis: legitimate interests.
• To send service communications — receipts, password resets, security alerts, and material change notices. Legal basis: contract and legal obligation.
• To send marketing — only with your consent (Art. 6(1)(a)), which you may withdraw at any time.

4. Who We Share It With

We share personal data only with service providers acting as our data processors, under written agreements that restrict use to the purposes we instruct:

• Stripe Payments Europe, Ltd. (Ireland) — subscription billing and tax handling.
• DigitalOcean, LLC (United States, Singapore region) — hosting and infrastructure.
• Cloudflare, Inc. (United States) — CDN, DDoS protection, and TLS termination.
• Google LLC — aggregate website analytics (Google Analytics 4) where consent permits.
• MaxMind, Inc. (United States) — offline GeoIP database (no live lookups; the database is downloaded and queried locally).

We do not sell your personal data, and we do not share it with advertising networks.

5. International Data Transfers

Where personal data is transferred outside the EEA or the UK to a country that has not received an adequacy decision, we rely on appropriate safeguards under Articles 46–47 GDPR — principally the European Commission’s Standard Contractual Clauses (2021/914). A copy of the safeguards in place for any specific transfer is available on request to our EU representative.

6. How Long We Keep It

• Account data: while your account is active, plus up to 30 days after deletion to allow recovery and clear backups.
• Billing records: seven years, where required by tax and accounting law.
• Security and access logs: up to 12 months.
• Aggregated, non-identifying analytics: indefinitely.

7. Cookies

We use:

• Strictly necessary cookies (session, CSRF, login) — required to operate the Service. No consent is required.
• Analytics cookies (Google Analytics 4) — loaded only where local law requires consent and you have given it.

You can manage cookies in your browser settings. Blocking strictly necessary cookies may break the Service.

8. Your Rights

Subject to applicable law you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data or completion of incomplete data;
• request erasure of your data (the “right to be forgotten”);
• request restriction of, or object to, certain processing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with a supervisory authority — in the EU, the authority of your habitual residence; in Estonia (where our representative is based), the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

To exercise any of these rights, email us at [email protected], or, if you are in the EU/EEA, contact our representative at [email protected]. We will respond within one month.

9. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Security

We use TLS for all traffic, hash passwords with a modern key-derivation function, isolate the database on a private network, encrypt backups at rest, and apply security patches on a defined schedule. No system is perfectly secure; if we discover a breach affecting your data, we will notify you and the relevant supervisory authority as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-product notice at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the current version.

12. Contact

Magic Crystal Limited
28 Wellington Street, Central, Hong Kong
Email: [email protected]

EU representative (Article 27 GDPR):
Financial Technology OÜ
Narva mnt 5, Tallinn 10117, Estonia
Email: [email protected]