Privacy Policy

LeadInBio (leadin.bio) is operated by [operating entity], [address], based in Israel (“we”, “us”). Questions about this policy or your data go to [contact email].

• Your account — your email, your pages, the photo you upload. We decide how this is handled, so we are responsible for it (the “controller”).
• Leads submitted through your page belong to you. We store and deliver them on your instructions, so you are responsible for them and we act on your behalf (the “processor”). We don't use anyone's leads for our own purposes, and we never sell data.
• Visitors to published pages are counted, not profiled. We don't store their IP addresses and don't track them across pages or sites.

If you have an account

• Your email address and a securely hashed password — never the password itself.
• The invite code you signed up with, linked to your email address and account.
• The content of your pages: titles, bios, links, text, videos, social profile links and the photo you upload. Uploaded photos are stored as public files, because they are shown on your public page.
• Private settings, such as a webhook URL or the address lead notifications go to. These are stored separately from your public page and are never shown to visitors.
• Your plan, and a record of when you reach a plan limit — so we can see which features matter to people.
• The page links (“slugs”) you have used. When you rename or delete a page, its old link stays reserved for you for 30 days.

When you add a link, we fetch that web page to show its title and preview image.

When someone visits a published page

• That the page was viewed, which link was tapped, and whether a form was seen or submitted.
• The referring website and the browser's user-agent string, so the page owner can see where visits came from and roughly what device was used.
• Any campaign tags in the link (utm_source, utm_medium, utm_campaign), so the owner can see which channel or campaign brought the visit.

We don't store visitors' IP addresses in our database. Our hosting provider processes them briefly to deliver pages, block automated abuse and limit repeated requests.

If you submit a form on someone's page

Whatever you type into it — usually a name, email address, phone number or message — is stored for the owner of that page, together with the referring website, your browser's user-agent string and any campaign tags in the link. It is sent to the owner by email and, if they have set one up, to their own systems through a webhook. The owner decides what happens to it next: contact them to access, correct or delete it. You can also contact us, and we will pass your request on.

If you join the waitlist

Your email address, the page you signed up from and the referring website. We use it only to send you an invite.

• Published bio pages set no cookies of their own and load no analytics or advertising scripts.
• The dashboard uses essential cookies to keep you signed in. The service can't work without them.
• Security checks. Our hosting provider may set a short-lived security cookie on any page, including published pages, after checking that a visitor isn't an automated bot. It is strictly necessary and isn't used for tracking.
• Our own site — the homepage and similar pages, but not published bio pages — uses Vercel Web Analytics and Speed Insights, which measure visits and page speed without cookies and without identifying individuals.

We use a small number of providers to run LeadInBio:

• Supabase — database, sign-in and file storage. Stored in Tokyo, Japan.
• Vercel — hosting. Our application servers run in Tokyo, Japan, and pages are delivered through Vercel's global network. Also provides the cookie-free analytics described above.
• Resend — sends email, such as lead notifications and password resets. Emails are processed in Ireland (EU).
• Sentry — error monitoring, so we find out when something breaks. Stored in Germany (EU). We configure it to leave out form contents, cookies and IP addresses, and to mask email addresses.
• [payment provider or merchant of record — once billing exists]

This means your data is stored and processed outside Israel, including in Japan and the European Union, and some of these providers are based in the United States. Each provider processes data only to deliver its service to us.

If you set up a webhook, we send lead data to the address you choose. What happens to it there is governed by that service, not by us.

• Account data: for as long as you have an account. You can delete your account yourself under Account in the dashboard. That immediately and permanently deletes your account, pages, uploaded photos, leads, analytics and any waitlist entry under your email. The invite code you used is kept, marked as used, without your email address.
• Pages: until you delete them. Deleting a page permanently deletes its content, leads and analytics.
• Analytics: while the page exists. If our storage runs short, analytics older than 180 days may be deleted.
• Leads: while the page exists. On paid plans, leads are never removed to save space. On the free plan, if our storage runs short, leads beyond your 25 most recent may be deleted.
• Old page links: reserved for you for 30 days after a rename or deletion.
• Waitlist emails: until you receive an invite or ask to be removed.
• Error reports and email logs: for the limited periods set by Sentry and Resend.

Depending on where you live, you may have the right to access, correct, export or delete your data, to object to how it is used, and to complain to a regulator. In Israel that is the Privacy Protection Authority; in the EU or UK, your national data protection authority.

Paid plans can export leads to CSV from the dashboard at any time. For anything else, email [contact email] and we will respond within 30 days.

• Data is separated per account at the database level, so one customer can't read another's pages, leads or settings.
• All traffic is encrypted over HTTPS.
• Private settings such as webhook URLs are kept apart from the data public pages can read.
• Webhooks can't be pointed at private or internal network addresses, and sign-in attempts are rate-limited.

No system is perfectly secure. If we learn of a breach affecting your data, we will tell you and the relevant authorities as the law requires.

LeadInBio isn't intended for anyone under 16, and you must be at least 16 to hold an account.

If we change how we handle data, we will update this page and the date at the top. For significant changes we will also email account holders. See also our Terms of Service.