Privacy Policy

The Service is operated by tomy.bio. For privacy requests, email hello@tomy.bio.

If you are in the EEA or UK, we are the controller of account data (your email, username, billing status). For form submissions and similar content your visitors send to you, you are the controller and we are the processor: we store that data on your behalf so it appears in your dashboard.

We collect:

• Account data: email address, username, optional display name, and sign-in method. If you use Google sign-in, we receive the email, name, and profile image Google shares with us.
• Content you create: profile layout and copy, extra pages, blog posts, forms, uploaded images, custom domain settings, and similar data you save in the builder.
• Visitor submissions: whatever people enter in forms on your public pages (we store this for you).
• Usage and analytics: page views, unique visitor estimates, and link clicks on public bios; a random visitor identifier in the browser; device and request metadata such as IP address, user agent, and approximate location derived from IP (used for security and aggregated analytics).
• Communications: emails you send us, and transactional mail we send you (sign-in codes, billing, product notices).
• Payment metadata: when you buy a paid plan, we receive confirmation that payment succeeded, subscription or order identifiers, plan, status, and renewal dates. We do not collect or store full payment card numbers. Cards are handled by a third-party payment processor.

We use information to:

• Create and secure your account, and send sign-in codes
• Host and publish your bio, pages, blog, and forms
• Show you analytics (views, visitors, clicks, form counts)
• Provide paid features, process subscriptions, and prevent fraud
• Run optional AI features you request (for example AI Writer or AI Translator), which means sending the text you submit to an AI provider
• Improve the Service, debug issues, and keep it secure
• Comply with law and enforce our Terms of Service

Where GDPR or UK GDPR applies, we rely on:

• Contract: to provide the Service you signed up for (account, hosting your bio, paid plans)
• Legitimate interests: security, product analytics, and improving the Service, balanced against your rights
• Consent: where required (for example certain analytics cookies, or optional AI features you choose to use)
• Legal obligation: tax, accounting, and responding to lawful requests

We do not sell your personal information. We share it with service providers who help us run tomy.bio, only as needed:

• Hosting and infrastructure
• Email delivery for sign-in codes and notices
• Google, if you choose Google sign-in
• Image hosting for uploads
• Analytics providers (including Google Analytics and our own event pipeline) for site and product measurement
• A payment processor, to take payment and manage subscriptions when you buy a paid plan
• AI providers, only when you use AI Writer, AI Translator, or similar tools

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or sale of the business (with notice where appropriate).

Your public bio is visible to anyone with the link. Content you publish (including usernames and public text) can be crawled by search engines.

Paid plans are billed through a third-party payment processor. The processor collects payment details directly from you. We receive enough information to know who paid, which plan, and whether the subscription is active, cancelled, past due, or refunded — not your full card number. The processor’s own privacy notice applies to data it collects as an independent controller or as described in its checkout.

We use:

• Essential cookies: to keep you signed in (session) and protect the account
• Local storage: a random visitor ID on public bios so we can estimate unique visitors without requiring login
• Analytics: Google Analytics and hosting-platform analytics, which may set cookies or similar identifiers on the marketing site and app

You can block non-essential cookies in your browser. Blocking essential cookies will prevent sign-in. Public-bio analytics still work at a basic level if local storage is disabled, but unique-visitor counts may be less accurate.

We keep account and content data while your account is open. After you delete your account, we delete or anonymize personal data within a reasonable period, except records we must keep longer (for example invoices, refund records, and security logs). Analytics events are kept in aggregated or event form for a limited period useful for the product, then deleted or aggregated. Form submissions stay until you delete them or close the account.

We use industry-standard measures (encryption in transit, access controls, hashed credentials where applicable). No method of storage or transmission is 100% secure. You should use a unique email you control and not share sign-in codes.

We and our providers may process data in countries other than yours, including the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers from the EEA/UK.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. You may also lodge a complaint with your local data protection authority.

To exercise these rights, email hello@tomy.bio from the address on your account. Visitors who submitted a form on someone’s bio should contact that page owner first; we can help if the owner asks us or if we must by law.

The Service is not directed at children under 13 (or 16 in the EEA/UK where that is the applicable age). We do not knowingly collect personal data from children below that age. If you believe we have, contact us and we will delete it.

We may update this policy. The “Last updated” date will change. If changes are material, we will provide additional notice (for example on the site or by email).

Privacy questions: hello@tomy.bio. Related: Terms of Service and Refund Policy.