Effective date: February 28, 2026
At LeadMyBio, transparency is core to what we do — we help creators identify who visits their profile by requiring Google sign-in before links are shown. This policy explains exactly what data we collect, from whom, and how it is used.
Quick summary
LeadMyBio is a product of Bitcoin P2P Serviços Digitais LTDA, CNPJ 31.600.396/0001-31, headquartered in Centro, Florianópolis — SC, Brazil, operating the platform at leadmy.bio (“the Service”). For purposes of applicable data protection law (including GDPR and LGPD), LeadMyBio acts as the data controller for data we collect directly from users.
For data shared between creators and visitors through the lead capture mechanism, creators act as independent data controllers for the leads they receive. LeadMyBio acts as a data processor on their behalf for that data.
Contact: [email protected]
When you create a LeadMyBio account, we collect:
| Email address | From Google OAuth — primary identifier for your account |
| Full name | From your Google profile |
| Profile picture (avatar) | URL of your Google profile photo |
| Username / bio / theme | Set by you in dashboard settings |
| Stripe customer ID & subscription ID | Stored when you subscribe to Premium; no card data is held by us |
| Telegram chat ID | Only if you connect your Telegram account for notifications |
| IP address / device info | Standard server logs; not permanently stored beyond operational needs |
When you sign in through a creator's profile Gate, we collect from your Google account:
| Email address | Shared with the creator; stored in their lead list |
| Full name | Shared with the creator; stored in their lead list |
| Profile picture (avatar) | Stored; shown to the creator in the lead dashboard |
| Source / referral | The ?ref= or ?utm_source= value in the URL (e.g., "instagram", "tiktok") |
This data is shared with the creator the moment you sign in. The creator can view, export (Premium plan), and contact you based on this information. If you do not wish to share your name and email with the creator, do not proceed through the sign-in Gate.
We do not use your data for behavioral advertising, profiling, or resale to third parties.
Where GDPR applies, we process personal data under the following legal bases:
| Account creation & service delivery | Contract (Art. 6(1)(b)) — necessary to provide the service |
| Lead capture (visitor data shared with creator) | Consent (Art. 6(1)(a)) — given at the Gate sign-in screen |
| Payment processing | Contract (Art. 6(1)(b)) |
| Transactional emails | Legitimate interest / contract (Art. 6(1)(b)(f)) |
| Security & fraud prevention | Legitimate interest (Art. 6(1)(f)) |
To deliver a fast, reliable, and secure platform, LeadMyBio may use trusted third-party services for functions such as authentication, payment processing, notifications, email delivery, hosting, and infrastructure. These partners are carefully selected and are only given access to the data strictly necessary for their function. We do not sell or rent your data to any third party.
The following user-facing services are directly involved in how you interact with LeadMyBio:
Google OAuth (Google LLC)
Authentication for all users. Google provides us with your name, email, and profile photo upon sign-in. You interact with Google's login screen directly.
Privacy Policy →Stripe (Stripe, Inc.)
Payment processing for Premium subscriptions. You interact with Stripe's checkout directly. We store only your Stripe customer ID and subscription ID — card numbers are never stored by LeadMyBio.
Privacy Policy →Telegram (Telegram Messenger)
Optional notification service. If you choose to connect Telegram, your Telegram chat ID is stored to send you lead and link-click notifications. Visitor emails are sent in masked form (e.g., ab***@example.com). This integration is opt-in only.
Privacy Policy →For internal infrastructure — including hosting, database, and email delivery — LeadMyBio uses industry-standard cloud and SaaS providers operating under appropriate data processing agreements. Specific vendors are not disclosed to protect operational security, but all are compliant with applicable data protection regulations (GDPR, SOC 2, or equivalent).
LeadMyBio uses the following cookies:
| next-auth.session-token | Session authentication — expires when you sign out or after 30 days |
| locale | Your language preference — stored for 1 year |
| admin_token | Admin panel access — set manually; not a user-facing cookie |
We do not use advertising cookies or third-party tracking pixels.
| Creator account data | Kept until you request account deletion |
| Lead data (visitor name + email) | Kept until the creator deletes their account or you request removal |
| Telegram connection token | Deleted after 15 minutes (one-time use) |
| Stripe identifiers | Kept until subscription is cancelled and account is deleted |
| Server logs | Retained for up to 30 days for security and debugging |
There is currently no automatic data expiry. We plan to add self-service account deletion in a future update. Until then, contact us at [email protected] to request deletion.
Depending on your jurisdiction (GDPR in Europe, LGPD in Brazil, CCPA in California, etc.), you may have the following rights:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
As a visitor: if you want your lead data removed from a specific creator's account, please contact us with the creator's LeadMyBio username and we will facilitate the deletion.
We take reasonable technical and organisational measures to protect your data, including:
No system is 100% secure. In the event of a data breach that affects your rights or freedoms, we will notify affected users within 72 hours of becoming aware, as required by applicable law.
LeadMyBio is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
LeadMyBio is operated internationally. Your data may be stored and processed in the United States or other countries where our hosting provider (Railway) operates. By using the Service, you consent to these transfers. We rely on standard contractual clauses and equivalent safeguards where required by applicable law.
We may update this Privacy Policy periodically. We will notify you of material changes via email or via a notice on the platform. The effective date at the top of this page will always reflect the latest version.
For any privacy-related questions, data subject requests, or concerns: