Privacy Policy

InBio, Inc., a Delaware C Corporation (file number 10284507, EIN 32-0822351), 1111B S Governors Ave STE 39177, Dover, DE 19904, United States. We are the controller of the data described here, except where this page says a creator is.

Questions, requests and complaints: hello@in.bio. We answer within 30 days.

On a creator’s page, the creator decides what to collect from their visitors. What a visitor sends them — a booking, an order, a form — is theirs: they are the controller of it and we hold it on their behalf, as their processor. That is why a request about something you sent to a page is quickest made to the creator. You can always write to us too, and we will pass it on.

• Account: your name, email address, the country you signed up from, and a hashed password. We never store the password itself. If you sign in with Google we receive your Google account id, name and email; with Apple, your Apple id, email, and a token we use only to revoke the sign-in when you delete your account.
• Your page: everything you put on it — handle, display name, description, avatar, links, offerings, prices, files, and the knowledge and instructions the assistant answers from.
• Setting up: when you give us your social handles or a website during onboarding, or ask the page assistant to build from them, we read those public profiles and pages to fill in your page. Profile look-ups go through SearchApi (section 7).
• Billing: your plan, subscription status and the brand and last four digits of your card. Full card numbers never reach our servers — they go from your browser to Stripe. If you subscribe in our iPhone app, Apple takes the payment and RevenueCat tells us the subscription’s status.
• Payouts: if you connect Stripe to sell, we store your Stripe account id and whether it can take charges. Your identity documents and bank details are held by Stripe, not by us.
• Connected Instagram (where offered): your Instagram username and id, an access token we keep encrypted, and the keywords and replies you set. When somebody comments on your posts or messages you, we receive it from Instagram to decide whether to send your reply; we do not keep the message.
• The app: if you use our iPhone app, a push-notification token for your device, and — if you arrived from an Apple Search Ads ad — the campaign Apple tells us about. The app does not ask for or read your advertising identifier (IDFA).
• How you use InBio: what you set up, which emails we sent you and whether they were opened or clicked, and product analytics from the dashboard (section 8). We use these to decide which emails are worth sending you — for example, not telling you how to get your first lead after you have had one.
• Support: if you chat with us, the conversation, and your name and email so we know who we are talking to.
• Technical: server logs, which include IP addresses, for security and debugging.

No advertising tag runs on a creator’s page, and nothing about you is sent to an advertiser from one. Our product analytics (PostHog) does not run there either. What does happen:

• Page analytics for the creator: the page and offering viewed, the referring site, your country, rough device type, and how long the page was in front of you. We do not store your IP address for this. It is combined with a secret salt, your browser’s user agent and the day’s date and hashed one way, so the same person can be counted once in a day and is unrecognisable the next. A random id is also kept in your browser’s storage (inbio-vid) so a return visit is counted as one. The creator sees totals in their dashboard.
• The assistant: if you chat with a page’s assistant, your questions — with up to the last twelve turns of the conversation — are sent through our servers to xAI, which writes the answer from the creator’s page material. We do not store the conversation. It is kept in your own browser (so it is there when you come back) and you can clear it from the chat. To stop one person flooding a page, we count questions per IP address and page for an hour, then discard the count.
• What the creator embeds: if the page uses a Google font, your browser fetches it from Google; if it shows a map, the map is Google Maps. Google receives your IP address when that happens, as with any site using them.
• Your choices on the page: if the page is marked 18+, your confirmation is remembered in your browser so you are not asked on every visit.

• What you submit: whatever the form asked for — typically your name, email, sometimes a phone number, your answers, and for a booking the time you chose. It goes to the creator, who is told by email and, if they use our app, by a push notification.
• Payments: your card details go from your browser to Stripe and are charged on the creator’s own Stripe account. We store the payment’s id, amount and status — never the card. Stripe sends your receipt.
• Downloads: if you bought a file, a private link that lets you fetch it.

The creator is the controller of what you submit to them. They decide what to do with it — reply, deliver, keep or delete it — and their own privacy terms apply to what they do outside InBio. We store it for them, use it only to run the service, and never use it to market InBio to you. To have it removed, ask the creator, or write to us and we will pass it on.

On in.bio’s own pages — the home page, the blog, pricing, the legal pages, signing up, onboarding, the dashboard, and our own page at in.bio/inbio, which is where our ads point — we measure our advertising and how the product is used. Section 8 lists every tag and how to refuse them. Besides those:

• Where you came from: on arrival we set a first-party id (inbio_aid) and note the campaign that brought you, if any — the ad click’s identifier, the utm_ tags, the referring site, the landing page and your country. If you later sign up, it is linked to your account so we know which ads are worth paying for.
• If you write to us: an enquiry from our offer page, an application to the creator program, or a support chat — what you sent, and your email so we can answer.

• To provide the service you asked for (contract): your account and page, the assistant, bookings and checkouts, payouts, subscriptions, receipts and the emails the service depends on.
• Legitimate interests: keeping InBio secure and preventing abuse; fixing errors; counting visits in the privacy-preserving way described above; understanding how InBio is used in aggregate; and sending creators tips, reports and offers about InBio, which you can switch off (section 12).
• Consent: advertising and analytics tags, where the law requires us to ask first (section 8). You can withdraw it at any time.
• Legal obligation: tax and accounting records, and answering lawful requests.
• For creators’ visitors’ submissions, the legal basis is the creator’s to establish — we process them on the creator’s instructions.

We make no decisions about anybody by automated means that have legal or similarly significant effects. The assistant writes answers; it decides nothing about you.

We do not sell personal data for money. These services receive what they need to do their job for us:

• Laravel Cloud — hosts the application, its database and its background jobs.
• Cloudflare — every request to in.bio passes through it. It serves creators’ pages and runs the assistant from its network, stores uploaded files and published pages, and holds the per-hour question counts in section 3.
• Stripe — subscriptions on the web, and creators’ own sales and payouts through Stripe Connect. Stripe sets its own cookies on pages with a card form, to prevent fraud.
• Apple and RevenueCat — App Store subscriptions, Sign in with Apple, push notifications, and Apple Search Ads attribution, for people using the iPhone app.
• Google — Sign in with Google, if you choose it; Google Analytics (section 8); and fonts and maps a creator puts on their page.
• xAI — generates assistant replies, on creators’ pages and in the dashboard. It receives the creator’s page material and the conversation. We do not permit training on it.
• SearchApi — reads the public social profiles a creator gives us during set-up.
• Resend — sends our email, and tells us whether each one was delivered, opened or clicked.
• Crisp — the support chat. It loads in the dashboard, and on our other pages only when you press Support. It receives what you write and, if you are signed in, your name and email.
• Laravel Nightwatch — error and performance monitoring. It receives the fault and where in the code it happened, how long requests and jobs took, and which signed-in account was affected. Request bodies are not collected, and passwords, cookies and authorisation headers are stripped before anything is sent.
• PostHog — product analytics on in.bio’s own pages (section 8).
• Meta, TikTok and Tracklution — advertising measurement (section 8). Tracklution passes our conversions on to Google Ads.
• Instagram (Meta) — if a creator connects it, to send the replies they set up.

We will also disclose data where the law compels us to, or to protect somebody’s safety. If InBio is ever sold or merged, data moves with it and we will tell you before it does.

Necessary — always on, because the service does not work without them:

• Session and CSRF — keep you signed in and stop forged form submissions.
• Preferences — light or dark mode, the sidebar’s state, and your answer to the cookie question (consent, kept for a year).
• inbio_owner — tells the page counter that a creator looking at their own page is the creator, so they are not counted as a visitor.
• Stripe and Crisp set their own cookies when their card form or chat is on the page.

Measurement and advertising — on in.bio’s own pages only (listed in section 5), never on a creator’s page:

• Google Analytics — counts page views on our site. Sets _ga cookies.
• PostHog — product analytics: which pages were opened, which buttons pressed, which errors happened. If you are signed in, it knows your account, name and email. It does not receive the contents of a conversation, and there is no session recording. Sets ph_ cookies. Some events about what a creator’s account did — an assistant answer, a booking taken — are also sent to it from our servers.
• Meta pixel — measures our own ads on Facebook and Instagram. Sets _fbp, and _fbc if you came from an ad.
• TikTok pixel — measures our own ads on TikTok. Sets _ttp, and keeps ttclid if you came from an ad.
• Tracklution — collects our sign-ups, trials and first payments, from your browser and from our servers, and passes them to Google Ads (and may to other ad platforms we use), so each is counted once. It loads from addresses on in.bio.

What the advertisers receive. When you register, start a trial or make your first payment, we tell them so — from your browser and from our servers. Meta and TikTok receive your email (Meta also your name and country) as a hash, a fingerprint they can only match against an account they already have, together with your IP address, browser, the ad-click identifier and their cookies, unhashed as they require. Tracklution receives your email, name, IP address, browser and click identifiers as they are, and hashes them before passing them on. Nothing about what a creator sells, what a visitor asked, or any conversation is ever sent.

How consent works. If you are in the EU, the EEA, the UK or the Crown dependencies — or we cannot tell where you are — a banner asks before any of these may store anything. Until you press Accept, the Meta and TikTok pixels load but send nothing and set no cookie, our servers send Meta, TikTok and Tracklution nothing about you, and PostHog does not load at all. Google Analytics and Tracklution are told storage is denied: they set no cookies, but Google’s tag still sends cookieless signals Google uses to model results, and Tracklution still records the page view without identifying you. Choosing Only necessary keeps it that way. Elsewhere, the tags run without asking, as the law there allows.

Changing your mind. There is no settings button for this yet. To withdraw consent, clear in.bio’s cookies in your browser: the banner asks again on your next visit, and you can choose Only necessary. Or write to us and we will exclude your account from everything we send advertisers from our servers. Withdrawing does not undo what was sent while you had agreed. Blocking the tags with a content blocker or your browser’s tracking protection changes nothing about the service.

We do not sell personal information for money. But California’s law calls it sharing when information such as an IP address, a cookie id or a hashed email is given to an advertising platform for advertising across other companies’ sites — and the Meta, TikTok and Tracklution (Google Ads) measurement in section 8 can fall under that. We do it only on in.bio’s own pages, never on a creator’s page, and we do not knowingly do it for anyone under 16.

To opt out of that sharing, write to hello@in.bio and we will stop sending your account to advertisers from our servers; blocking or clearing the advertising cookies stops the browser half. We do not yet act on the Global Privacy Control signal automatically. You also have the right to know what we hold, to correct it, to delete it, and not to be treated differently for using any of these rights. We do not use sensitive personal information for anything beyond providing the service.

InBio is run from the United States, and the services in section 7 are mostly US-based; Cloudflare serves pages from data centres close to the visitor. If you are in the UK or the EU, your data is therefore transferred to the US — under the EU–US Data Privacy Framework (and its UK extension) where the recipient is certified, or standard contractual clauses where it is not.

• Account data and your page stay while your account exists. Closing your account deletes it, your pages, their submissions and orders, and your uploaded files straight away, and takes the page offline; copies in our host’s backups age out on the host’s schedule. What tax law requires us to keep — invoices and payments — is kept for as long as it requires.
• Page analytics are deleted after 120 days.
• Assistant conversations are not stored by us; the per-hour question counts are discarded once the hour is up.
• Submissions and orders stay until the creator deletes them or closes their account.
• Unused uploaded images are removed once nothing references them.
• Marketing records — how you arrived, and that you registered, started a trial or paid — stay while your account exists. When it is closed they are unlinked from you and kept only as anonymous counts. The IP address and browser held with a pending advertising report are cleared once it is sent.
• Cookies: inbio_aid two years; consent one year; the others for the session or as their provider sets them.
• Data held by the services in section 7 is kept under their own retention terms.

Wherever you are, you can ask us to show you what we hold, correct it, delete it, or send it to you in a portable form. In the UK, the EU and similar regimes you can also object to processing — including, at any time and without giving a reason, to direct marketing — ask us to restrict it, withdraw consent you gave, and complain to your data protection authority. Californians have the rights in section 9.

Write to hello@in.bio. We answer within 30 days, and may ask you to confirm the request comes from you. Most of it you can do yourself: your page and its content are editable and deletable from the dashboard, the emails about InBio can be switched off from the preferences link at the foot of each one, and closing your account removes it all.

If you are a visitor asking about something you sent to a creator, we will pass your request to them, and help them answer it.

Traffic is encrypted in transit. Passwords are hashed with bcrypt. Connected-account tokens are encrypted. Card details never touch our servers. Access to production is limited to a small number of people.

No system is perfectly secure. We cannot guarantee that a breach will never happen. If one does that affects your data, we will tell you and the relevant authority as quickly as we can, and within any deadline the law sets.

InBio is not for under-16s — our terms require account holders to be at least 16 — and we do not knowingly collect their data. If you believe a child has given us information, write to us and we will delete it.

We will post any update here with a new date, and email creators if the change is material.

InBio, Inc., 1111B S Governors Ave STE 39177, Dover, DE 19904, United States — hello@in.bio.