Privacy Policy

Last updated: March 4, 2026

At Bio Studio ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. Please read this policy carefully.

1. Information We Collect

1.1 Personal Information

When you create an account, we may collect the following personal information:

  • Account Information: Username, email address, display name, and password (stored as a bcrypt hash).
  • Profile Information: Avatar, bio, and other optional profile details you choose to provide.
  • Communication Data: Messages you send to us through our contact form or support channels.

1.2 Usage Data

We automatically collect certain information when you use our service, including:

  • IP address and approximate geographic location
  • Browser type and version
  • Operating system
  • Referring website addresses
  • Pages viewed and links clicked
  • Date and time of visits
  • Device information

1.3 Analytics Data

We collect analytics data about your bio page visitors, including page views, click-through rates, and geographic distribution. This data is aggregated and presented to you through our analytics dashboard.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Delivery: To create and maintain your account, provide our services, and process transactions.
  • Communication: To send you account-related notifications, security alerts, and updates about our services.
  • Improvement: To analyze usage patterns, improve our services, and develop new features.
  • Security: To detect, prevent, and address fraud, abuse, and security issues.
  • Compliance: To comply with legal obligations and enforce our terms of service.

3. Data Encryption & Security

We implement industry-standard security measures to protect your data:

  • AES-256-GCM Encryption: Sensitive data is encrypted at rest using AES-256-GCM encryption.
  • SSL/TLS: All data in transit is encrypted using TLS 1.3.
  • Secure Passwords: Passwords are hashed using bcrypt with a cost factor of 12.
  • CSRF Protection: All forms are protected against cross-site request forgery attacks.
  • Session Security: Sessions use secure cookies with HttpOnly and SameSite flags.

4. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

  • Essential Cookies: Required for the service to function (session authentication, CSRF protection).
  • Analytics Cookies: Help us understand how visitors interact with our service.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of our service.

5. Third-Party Services

We may use third-party services that collect, monitor, and analyze data:

  • Hosting Provider: For secure server hosting and infrastructure.
  • CDN Provider: For content delivery and performance optimization.
  • Payment Processor: For processing Pro plan subscriptions securely.

These third parties have their own privacy policies and we encourage you to review them.

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

  • With your explicit consent
  • To comply with legal obligations
  • To protect our rights, privacy, safety, or property
  • In connection with a merger, acquisition, or sale of assets

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data.
  • Portability: Request transfer of your data in a machine-readable format.
  • Objection: Object to the processing of your data for specific purposes.
  • Restriction: Request restriction of processing in certain circumstances.

To exercise any of these rights, please contact us using the information provided below.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. When you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal reasons.

9. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete such information immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our service after such changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: