Privacy notice

What we collect

• Account data: your email address, a hashed password, and — if you verify your phone — a hashed phone number.
• Page content: the username, titles, descriptions, links, block configuration, theme settings and images you upload.
• Leads you collect: the email addresses or phone numbers visitors give you, plus the consent text that was on screen at the time.
• Analytics events: page views, link clicks, referrer, device category, country, QR scans, and a rotating hash used to estimate unique visitors.
• Billing data: plan, invoice amounts and payment references. Card and wallet credentials are held by the payment provider, never by us.
• Support messages: what you send through the contact form, with a one-way hash of the sender's address for abuse control.

We do not collect IP addresses into our database, we do not use third-party advertising cookies on your page, and we do not attempt to identify individual visitors.

Why we collect it

Account and page data exist to run your page and let you edit it. Analytics exist so you can see what your audience does, in aggregate. Billing data exists to charge the correct amount and satisfy tax and accounting rules. Support messages exist so we can answer you. Nothing here is used to build advertising profiles, and we do not sell any of it.

Analytics in detail

A "unique visitor" is an estimate. We compute a hash from the visitor's address and browser string together with a secret salt, and rotate that salt daily; yesterday's hash cannot be linked to today's. The hash is not reversible and is not shared. Views and clicks are counted as separate events, and a click never implies a purchase.

If you configure an advertising pixel for your own page, that pixel is loaded from the provider's servers and is subject to their policies, not ours. We validate the identifier you enter, and we never inject a script we have not written ourselves.

How long we keep it

• Analytics events: 7 days on Free, 90 days on Creator Pro, 1 year on Business, unlimited on Agency. Expired events are deleted by a scheduled job.
• Leads: until you delete them or close your account.
• Contact messages: 24 months after they are handled.
• Invoices and payment records: as long as accounting law requires, even after account closure.
• Backups: up to 30 days, then overwritten on a rolling basis.

Who else sees it

• The payment provider, to process a subscription you started.
• Our hosting provider, which stores the servers and backups.
• The email service, if and when we enable transactional email.
• Authorities, only where we are legally required to disclose, and we will tell you unless prohibited.

We do not share your lead list with anyone, including advertisers.

Your choices

You can export your page content, analytics and leads, correct anything inaccurate, and delete the account from the dashboard — which removes the page and its analytics, while keeping only what accounting law requires. Visitors can report a page from the page itself. For any request you cannot complete yourself, contact us and we will answer within 30 days.

Cookies

One session cookie keeps you logged in; a CSRF cookie protects forms. Neither is used for advertising. Public pages set no tracking cookie of their own.

Security

Traffic is served over HTTPS. Passwords are hashed, secrets live outside the source code, and administrative actions are logged. If a breach ever affects your data, we will tell you what was affected and what we changed.

Contact

Use the contact form or write to support@biosy.com.bd. Privacy requests are answered by a person, not a template.