Gaf Bio

Draft template awaiting owner and legal review. This is not legal advice and is not yet in force.

Privacy notice

Version 2026-10-draft-5.

Who we are

Gaf Bio (gaf.bio) is run by [business name, address and ICO registration number to be confirmed], the data controller for the information described here. You can contact us about privacy at [privacy contact email to be confirmed].

Creators

We store your email address, a securely hashed password (managed by our authentication provider), the content of your page and links (including any images you upload or we copy from a link's preview image), and the date and version of the Terms and this notice you accepted. We don't send marketing emails. We only email you about your account, such as sign-up confirmation and password resets.

Why we can use it: we need this information to provide the service you signed up for (contract).

Payments

If you subscribe to Pro, payments are handled by Stripe. You enter your card details on Stripe's own payment page and we never see or store them. We share your email address and account ID with Stripe so it can bill you, and we store the Stripe customer and subscription IDs and your plan status so your account shows the right plan. Stripe keeps payment records as its own privacy policy and the law require.

Why we can use it: to take payment for the plan you chose (contract), and to keep records the law requires (legal obligation).

Visitors to creator pages

We count page views, link taps and handoffs to show creators basic totals. We don't store your IP address, browser details or a device fingerprint with these counts. We keep each individual count for 30 days. After that, only daily totals remain (for example, “12 page views on 3 March”), which can't identify anyone and are kept while the creator's page exists.

Why we can use it: giving creators simple statistics about their own page is in our and their legitimate interests, and the counts are designed not to identify you.

Security and abuse prevention

To stop spam and attacks, we limit how often requests can be made. We do this using a one-way scrambled (hashed) version of your IP address or email address, never the raw value, and these records expire within an hour. Our hosting provider also keeps short-lived technical logs, which may include IP addresses, to run and protect the site.

Why we can use it: keeping the service secure is in our and our users' legitimate interests.

Cookies

We only use cookies that are strictly necessary: one to keep creators logged in, and two short-lived ones that make the 18+ notice work. We don't use analytics, advertising or tracking cookies. See our cookie policy for the full list.

How long we keep it

We keep your account information while your account exists. When you ask us to delete your account, we delete your page, links, images and statistics [within 30 days, to be confirmed]. Payment records may be kept for up to six years where tax law requires it.

Who we share it with

We don't sell your information. We use these providers (processors) to run the service, and they may only use your information on our instructions:

Some of these providers are based in, or use systems in, the United States. Where your information leaves the UK, it's protected by the UK–US data bridge or the UK's approved contract clauses. [Each provider's data locations to be confirmed.]

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to object to or restrict how we use it, and to take it elsewhere. You can update your page and links at any time in your dashboard. For anything else, email [privacy contact email to be confirmed]. We'll reply within one month.

If you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to sort it out first.

Children

Gaf Bio is for people aged 18 and over. We don't knowingly collect information from children.

Changes

If we change this notice, we'll update the version number above and tell creators about significant changes by email.