Privacy Policy

1. Introduction

Biotree (“we”, “us”, “our”) is a bio link tool operated by Wes Thomson, based in South Africa. This privacy policy explains how we collect, use, store, and protect your personal information when you use biotree.bio.

For the purposes of the Protection of Personal Information Act (POPIA), we are the “responsible party”. For the purposes of the EU General Data Protection Regulation (GDPR), we are the “data controller”.

2. Information We Collect

Account information

When you create an account, we collect your email address. Your password is securely hashed by Firebase Authentication — we never store it in plain text.

Profile information

You voluntarily provide your display name, bio text, profile photo, and links. This information is displayed publicly on your Biotree page.

Usage data

We collect analytics data about your Biotree page, including page views, link clicks, referring URLs, browser type, device type, and IP addresses. This data is used to power the analytics dashboard in your account.

Payment information

Payments are processed by Stripe. We do not store your credit card number, expiration date, or CVC. We store your Stripe customer ID and subscription status to manage your Pro subscription.

Cookies

We use cookies for authentication and may use analytics cookies. See our Cookie Policy for details.

3. How We Use Your Information

We use your information to:

• Provide the service — display your public page, manage your account, and process your settings
• Process payments — manage Pro subscriptions via Stripe
• Display your page publicly — this is the core function of Biotree. Your profile name, photo, bio, and links are visible to anyone with your page URL
• Provide analytics — show you page views and link clicks in your dashboard
• Improve the service — analyse usage patterns to improve features and performance
• Send transactional emails — account-related emails such as magic link sign-ins and subscription changes
• Send marketing emails — only if you have explicitly opted in. You can unsubscribe at any time
• Feature your page — on our showcase, only if you have opted in via your settings

4. Legal Basis for Processing

Under POPIA and the GDPR, we process your personal information on the following bases:

• Contract — processing necessary to provide the service you signed up for (account management, page hosting, payment processing)
• Consent — marketing emails and showcase featuring (you opt in, and can withdraw at any time)
• Legitimate interest — analytics, service improvement, fraud prevention, and security
• Legal obligation — where we are required to retain or disclose data by law

5. Data Sharing

We share your data with the following third-party service providers, strictly to operate the service:

• Firebase (Google Cloud) — hosting, authentication, and database. Firebase Privacy
• Stripe — payment processing. Stripe Privacy

We do not sell your personal data to anyone.

We do not share your data with advertisers. We do not run ads on Biotree.

We may disclose your information if required by law, court order, or governmental authority.

6. Data Retention

Active accounts. We retain your data for as long as your account is active.

Account deletion. When you delete your account (via Settings), your personal data — including your page, profile information, and analytics — is deleted within 30 days.

Anonymised data. We may retain anonymised, aggregated analytics data (e.g. total page views across the platform) after account deletion. This data cannot be linked back to you.

7. Your Rights

Under POPIA and the GDPR, you have the following rights as a data subject:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data (you can also edit your profile directly)
• Deletion — delete your account and all associated data from the Settings page, or request deletion by emailing us
• Withdraw consent — opt out of marketing emails or the showcase feature at any time via your settings
• Data portability — request an export of your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Lodge a complaint — with the Information Regulator (South Africa) or the relevant supervisory authority in the EU

To exercise any of these rights, email us at hello@biotree.bio. We will respond within 30 days.

8. Children’s Privacy

Biotree is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

9. International Transfers

Biotree is operated from South Africa, but your data may be processed and stored in other countries where our service providers operate (e.g. Google Cloud servers in the US and Europe, Stripe in the US).

Where data is transferred outside South Africa or the EU, we ensure appropriate safeguards are in place, including the service providers’ compliance with applicable data protection frameworks.

10. Security

We take reasonable measures to protect your personal information, including:

• All connections use HTTPS encryption
• Passwords are securely hashed (via Firebase Authentication)
• Authentication tokens are used for session management
• Payment data is handled entirely by Stripe (PCI DSS compliant)
• Access to production systems is restricted

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via email or an in-app notification. The “Effective date” at the top of this page indicates when the policy was last updated.

12. Contact

For privacy-related questions or to exercise your rights, contact:

Wes Thomson
Biotree
hello@biotree.bio