biolink.my

Privacy Policy

Effective 2 November 2026 · Last updated 2 November 2026

This policy explains what personal data biolink.my collects, why, who we share it with and what you can do about it. In short: we collect as little as we can, we never sell data, and visitors to bio pages are not tracked with cookies.

It is written to meet Malaysia's Personal Data Protection Act 2010 (PDPA) and to be easy to read wherever you are. biolink.my is operated by Dayabumi Creative Network (202203302149 (PG0534996-W)), which is the data user for the purposes of the PDPA. "biolink.my", "we" and "us" mean Dayabumi Creative Network. "You" means anyone who uses it: page owners (account holders) and visitors to their pages.

1. If you have an account

  • Sign-in details. When you continue with Google we receive your name, email address and the address (URL) of your Google profile photo. We never see your Google password. A small number of site-owner addresses can also sign in with a one-time email link; for those we store the email address, a scrambled (hashed) copy of the link and a hashed IP address for rate limiting, and delete them after about a day.
  • Your page. Your username, display name, bio, blocks (links, text, products, embeds, payment links, tip-jar QR codes and so on), template and theme choices, page category, and whether your page is a draft or published.
  • Images you upload. Avatars, product photos, QR codes and image blocks. They are converted to WebP in your browser and stored in Cloudflare R2. Published images are public.
  • Account records. When you joined and last signed in, your email preferences, and whether your account is active or suspended.
  • Moderation records. If your page is hidden or removed, the reason we gave you; if you request a review, your message, our decision and any note we add.

2. If you visit someone's page

  • We count page views and clicks on blocks so the page owner can see their stats. For each view or click we record: the page and block, where the visit came from (for example TikTok, Instagram or "direct"), your approximate country (from Cloudflare, based on your IP address), your device type (mobile, tablet or desktop) and a visitor code.
  • The visitor code is a one-way hash of your IP address combined with a secret random value that changes every day and is deleted after about 2 days, so codes from different days can't be linked and nobody can work out your IP address from them. It lets us count unique visitors without storing your IP address. We never store raw IP addresses in our database.
  • Visits from known bots and link previews, and the page owner's own visits, aren't counted.
  • Page owners only ever see totals (views, clicks, sources, countries and devices per day), never individual visitors.
  • Videos and music embedded on a page (YouTube, TikTok, Spotify, SoundCloud and similar) only load when you press play. From then on that service's own privacy policy and cookies apply.

3. If you send something through a form

  • Lead forms on bio pages. The name, email, phone number and message you enter are stored for the page owner, who sees them in their dashboard and may get them by email. The page owner decides what to do with them and is responsible for using them lawfully; we store and deliver them on the owner's behalf. Contact the page owner about their use of your details.
  • WhatsApp orders. When you send a cart to WhatsApp, we log the items and total (not your name or phone number) so the owner can see what was ordered. The message itself is sent by you through WhatsApp, and WhatsApp's own privacy policy applies.
  • Abuse reports. The page reported, the reason, your description, your email address if you choose to give it, and a hashed visitor code to limit spam.
  • Brand partner inquiries. Your name, company, email, budget range and message.

4. Cookies

  • bl_session keeps you signed in. It holds a random token (we store only a hash of it) and lasts up to 30 days. It is only set when you sign in.
  • bl_oauth_state, bl_oauth_verifier and bl_oauth_next protect Google sign-in and expire after 10 minutes.
  • Some forms (lead forms, abuse reports, partner inquiries and creating a page) use Cloudflare Turnstile to tell people from bots. Turnstile may set its own short-lived cookie or read browser signals for that check only.

We don't use advertising or analytics cookies, and visitors who don't sign in get no cookies from us at all.

5. Why we use your data

  • To run the service: sign you in, save and publish your page, and show it to visitors.
  • To show page owners their stats, leads and WhatsApp carts.
  • To keep the platform safe: checking links for phishing and malware, handling abuse reports and review requests, stopping spam and enforcing our Terms.
  • To send the emails listed in section 7.
  • To choose which sponsored card to show (section 8) and count its views and clicks.
  • To comply with the law and respond to lawful requests.

By creating an account or sending a form you agree to this use. You can withdraw by deleting your account (section 11), but we can't run your page without the data in section 1.

6. Who helps us, and who we share data with

We never sell personal data. We use these service providers:

  • Cloudflare: hosting, databases (D1 and KV), file storage (R2), visitor analytics (Workers Analytics Engine), sending our emails (Email Service) and Turnstile.
  • Google: Google sign-in; Safe Browsing, which checks the web addresses (URLs) on pages and in sponsored cards for phishing and malware (only the URLs are sent, not who made the page); and Google Fonts, which serves the fonts on our site and bio pages, so your browser connects to Google's servers to load them.

Content you publish on your page is public. Apart from that, we only disclose personal data when the law requires it, to protect people from serious harm or fraud, or as part of a transfer of the service (in which case this policy keeps applying).

7. Emails we send

We only send emails needed to run the service, never marketing:

  • sign-in links (site-owner addresses only);
  • a welcome email when you create your page;
  • new-lead alerts to the page owner, which you can switch off in Dashboard → Settings → Email notifications;
  • the outcome of a review request about your hidden page;
  • alerts to our admins about abuse reports and review requests (these include the reporter's email if given, or the page owner's email for a review request).

If we ever want to send newsletters or tips, we'll ask first.

8. Sponsored content

Public pages show one clearly labelled "Sponsored" card, served by biolink.my itself. There are no third-party ad scripts, ad networks or tracking pixels, and we don't build advertising profiles. A campaign may be limited to certain countries (using your approximate country) or kinds of pages. We count views and clicks of each card as daily totals.

9. How long we keep data

  • Your account, page, uploads, leads and WhatsApp carts: until you delete your account, or until we close it after 12 months without a sign-in (see our Terms).
  • Raw view and click events: about 3 months (the Analytics Engine limit). After that only daily totals per page remain; they contain no personal data.
  • Email sign-in records: about a day. Sessions (staying signed in): up to 30 days after your last visit, then they are deleted automatically.
  • Abuse reports, review requests, partner inquiries and our admin audit log: 2 years, then they are deleted automatically. Reports and review requests that are still open are kept until we have dealt with them.
  • Backups: database backups (point-in-time recovery) roll over within 30 days.

10. Security

All traffic uses HTTPS. Session and sign-in tokens are stored only as hashes. Only a small number of admins can see account data, and every admin action is recorded in an audit log. We use rate limits, bot checks and link scanning to protect visitors. No system is perfectly secure, so if we learn of a breach that affects you, we'll tell you without undue delay.

11. Your rights and choices

  • Access and export: download your account details, page, blocks, products, leads and WhatsApp carts as a file from Dashboard → Settings → Export my data.
  • Correction: change your page, username and settings yourself in the dashboard. For anything you can't change there, email us.
  • Deletion: Dashboard → Settings → Delete account removes your account, page, blocks, sessions, review requests, uploaded images, leads and WhatsApp carts straight away, and your page goes offline. What remains: daily view totals without personal data, raw analytics events until they expire, backups until they roll over, and records in section 9 that we keep for safety (such as reports about your page and our audit log).
  • Emails: switch off lead alerts in Dashboard → Settings.
  • Anything else (including an access or correction request under the PDPA, or a question about this policy): email khai@webmaster.my. We'll reply within 21 days. We may ask you to confirm your identity first.

If you sent a lead to a page owner, ask that owner first: they control that data. We'll help where we can.

12. Where data is processed

Cloudflare and Google run global networks, so your data may be stored or processed outside Malaysia. We only use providers that protect personal data to a standard comparable to the PDPA.

13. Children

You must be at least 13 years old (or the minimum age in your country, if higher) to create an account. If you believe a child under that age has an account, email khai@webmaster.my and we'll remove it.

14. Changes to this policy

If we change this policy in a meaningful way, we'll email account holders before the change takes effect and update the date at the top of this page.

15. Contact

biolink.my is operated by Dayabumi Creative Network (registration no. 202203302149 (PG0534996-W)), a business registered in Malaysia (webmaster.my).

Send privacy questions and requests to khai@webmaster.my. To report a page, use the report form.