Privacy Policy

Biofront (“we”, “us”) is operated by Biofront in Australia. We provide a link-in-bio storefront that lets creators publish a page, sell digital products and memberships, and take bookings.

This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers creators (people with a Biofront account) and visitors and customers (people who view a creator’s page, buy from them or book with them).

When you buy from or book with a creator, you are dealing with that creator. They receive your name, email and any details you provide so they can deliver what you bought, and they handle that information under their own privacy practices. We process it on their behalf to run the checkout, deliver files and send receipts.

Creators are responsible for how they use their customers’ information, including any marketing they send and any third-party tracking pixels they add to their page.

Creators

• Account details: email address, name, and your profile photo if you sign in with Google.
• Page content you publish: handle, display name, bio, photos, links, products, files you upload, booking types and availability.
• Payout and billing details. These are collected and verified by Stripe (including identity checks for payouts). We receive status information and identifiers, not your full bank or card details.
• If you connect Google Calendar: an access token for your calendar, your Google email, free/busy times, and the events we create for bookings.
• Settings such as tracking pixel IDs and webhook URLs you add.

Visitors and customers

• Name and email address when you buy, download a free product, join a membership or make a booking.
• Answers you give to a creator’s booking questions, and the time you book.
• Payment details, entered directly into Stripe’s checkout. We never see or store your full card number.
• Basic page analytics: that a page was viewed or a link was clicked, which link, and the referring website’s domain. We don’t store IP addresses or set tracking cookies for these analytics.

• To provide the service: host pages, process orders and bookings, deliver downloads and member access.
• To send transactional emails such as sign-in links, receipts, booking confirmations and sale notifications.
• To bill creators for their plan and calculate platform fees.
• To show creators their sales, bookings and page analytics.
• To keep the service secure, prevent fraud and abuse, and meet our legal obligations.
• To provide support and improve the product.

If you sign in with Google we receive your name, email address and profile photo. If you connect Google Calendar we request permission to read your free/busy times and to create, update and delete the calendar events for bookings made through Biofront (including Google Meet links). We use this access only to prevent double-bookings and to manage booking events.

Biofront’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or to comply with the law. You can disconnect Google Calendar at any time in Dashboard → Bookings, which deletes our stored access token, and revoke access at myaccount.google.com/permissions.

We share personal information only as needed to run Biofront, with:

• The creator you buy from or book with.
• Stripe: payments, subscriptions and creator payouts (stripe.com/au/privacy).
• Vercel: hosting and file storage.
• Neon: our database.
• Resend: sending email.
• Google: sign-in and calendar features you choose to use.
• Services a creator connects themselves, such as webhooks to Zapier or Make, which receive order and booking details.
• Authorities where required by law.

We do not sell personal information.

Our database and uploaded files are hosted in Sydney, Australia. Some of our providers process information overseas — for example email delivery (Resend, in Japan and the United States), payments (Stripe) and Google services (the United States and other countries). We take reasonable steps to ensure these providers protect personal information consistently with the Australian Privacy Principles.

We use a single essential cookie to keep creators signed in. Our own page analytics don’t use cookies.

Creators can add third-party tracking pixels (Meta, TikTok, Google Analytics) to their pages. When they do, those providers may set cookies and collect information about your visit under their own privacy policies.

We keep account information while the account is active. When a creator asks us to close their account (email hello@biofront.io) we delete their page, products, files and calendar connection, and their customers’ order and booking records, except where we need to keep transaction records to meet tax, accounting or legal obligations (generally up to 7 years). Sign-in links expire after 15 minutes.

Data is encrypted in transit, downloadable files are kept in private storage and served only through purchase-specific links, payment details are handled by Stripe, and access to production systems is restricted. No system is perfectly secure; if a data breach is likely to cause serious harm we will notify affected people and the OAIC as required by the Notifiable Data Breaches scheme.

You can ask to access or correct the personal information we hold about you, or ask us to delete it. Creators can update most details directly in their dashboard. Customers should usually contact the creator first; you can also contact us at hello@biofront.io. We’ll respond within 30 days and may need to verify your identity.

We don’t send marketing emails. The emails we send — sign-in links, receipts, booking confirmations and sale notifications — are part of the service.

Biofront accounts are for people aged 18 and over. Visitors under 18 should only buy with a parent’s or guardian’s involvement.

Questions or complaints about privacy: email hello@biofront.io. We’ll respond within 30 days. If you’re not satisfied with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy from time to time; we’ll post the new version here and, for significant changes, let creators know by email. See also our Terms of Service.