Privacy Policy

This Privacy Policy applies to LookMyBio and lookmybio.com (the "Platform").

The service provider and controller of personal data is Verstand Technologies, LLC, a Delaware company in the United States. Because we offer the Platform to people in Brazil, we follow the LGPD (Brazilian General Data Protection Law) for their data.

This policy applies to users and to visitors of public profiles. When you use the Platform to collect other people's data (for example, leads and contact messages on your bio page), you are the controller of that data and we process it on your behalf.

Our data protection officer (encarregado) is named in section 17.

We collect information to provide and improve the Platform. The types of information we collect include:

Account and profile data: name, email, username, profile details, images, links, themes, and team invitations.

Authentication and integrations: identifiers and tokens from authentication providers and connected accounts (including Google, Facebook, Instagram, Threads, X, TikTok, YouTube, LinkedIn, Pinterest, Bluesky, blog platforms, and email marketing tools).

Content and communications: content blocks you create, AI prompts and outputs, chat messages, uploads, contact form submissions, and email leads (for example, name, email, message, custom fields, tags, path, and referrer).

Biometric data: if you create your digital twin ("You", in UGC Studio), the video and audio recordings of your face and voice. See section 5.

Payment and subscription data: Stripe customer IDs, subscription status, invoices, and transaction metadata. Payment card details are handled by Stripe. In-app purchases are confirmed with Apple or Google.

Usage and device data: IP address, user agent, pages visited, interactions, and referrers, plus coarse location (country/region/city) derived from IP (from Cloudflare headers, or the geoip-lite database on our own servers). In bio page analytics, we store the visitor's IP truncated (/24 for IPv4, /48 for IPv6), not the full address.

Cookies and similar storage: session and security cookies, preference cookies (such as locale, theme, and profile selection), referral and onboarding cookies, and analytics or marketing identifiers (such as PostHog and Facebook Pixel).

We use the information collected to:

• Provide, operate, and maintain the Platform;

• Create and manage accounts, profiles, and team access;

• Process payments, subscriptions, and credit usage;

• Deliver emails and notifications (such as login links, confirmation codes, and profile invites);

• Generate text, images, voices, and videos with AI when you ask;

• Measure usage, run analytics, and improve features (including AI);

• Prevent fraud, abuse, and security incidents;

• Communicate with you about product updates and marketing when permitted.

When applicable, we process personal data under the following legal bases:

• Performance of a contract (to provide the Platform);

• Consent (for certain communications, cookies, or marketing);

• Specific and highlighted consent, for sensitive personal data such as the biometric data in section 5 (LGPD, art. 11, I);

• Legitimate interests (to secure, operate, and improve the Platform);

• Compliance with legal or regulatory obligations.

The digital twin ("You", in UGC Studio) makes a copy of your voice and your image to create videos you ask for and approve yourself. Voice and face are biometric data, which the LGPD treats as sensitive personal data. We only process them with your specific and highlighted consent.

Before any recording is uploaded, you must tick two boxes, which start unticked: one for your voice and one for your face. Unless both are ticked, the Platform does not accept the upload. You then read aloud, on camera, a phrase with your name, today's date, and a code.

We record the consent on our servers with its purpose, the date and time, the version and hash of the text you accepted, the hash of the recording, your IP address, and your user agent.

We use the recordings only to create your twin and the videos you ask for in your account. Your voice is processed by ElevenLabs and your image by HeyGen, which also checks that the person consenting is you. No one else can use your twin without your permission. We do not use biometric data to identify you elsewhere or for advertising.

Recordings are kept in private storage. You can delete your twin at any time. When you do, we delete the voice, the twin, and the recordings at the providers and here, and keep only the record of the consent (without the recording) as proof, as the law requires.

Characters made with "Design a character" are generated by AI and do not use photos of your face.

We share personal data with service providers (processors) that process it on our behalf to operate the Platform. Each one receives only what the feature you use needs. The list below shows the provider, the purpose, the data involved, and the country where the data is processed:

• DigitalOcean: hosting for our servers, database, and queues. All Platform data. Country: United States.

• Cloudflare: content delivery, attack protection, coarse location from IP, file storage (R2), email delivery, spam checks (Turnstile), AI moderation of blog posts and comments and AI ad review (Workers AI), and custom domains. IP address, browser data, uploaded files, email address and message content, post and comment text. Country: United States, with a global network.

• Stripe: payments and subscriptions. Name, email, payment details, and billing history. Country: United States.

• Apple and Google: confirming purchases made in the mobile app. Purchase receipt. Country: United States.

• Expo: push notifications in the mobile app. Device token and notification text. Country: United States.

• PostHog: product analytics, feature flags, and feedback surveys. With your consent to analytics: user identifier, usage events, browser data. Without it: usage events with no cookie, no identifier stored on your device and no profile, counted under an anonymous id that PostHog derives from your IP address and browser and that changes every day. Country: United States.

• Sentry: error monitoring. Technical error data, without the personal data we strip before sending. Country: United States.

• Meta (Facebook Pixel and Conversions API): campaign measurement, only with your consent to marketing. Browser identifiers (_fbp, _fbc), IP address, user agent and, hashed, email, phone, name, and location. Country: United States.

• RD Station: marketing automation for our own contacts, only with marketing consent. Name and email. Country: Brazil.

• OpenAI and xAI (Grok): text generation, the assistant, support chat, and brand research. Prompts, content, messages, and brand information. Country: United States.

• fal.ai, WaveSpeed, Runware and Sume: AI image and video generation and editing. Prompts and the images or videos you upload. Country: United States.

• HeyGen: avatar videos and the digital twin. Avatar image, script, audio and, for the twin, the recordings of your face. Country: United States.

• ElevenLabs: AI voices and the copy of your voice in the digital twin. Script and recordings of your voice. Country: United States.

• Firecrawl: reading the websites and public profiles you give us during onboarding and brand research. Addresses and public content of those pages. Country: United States.

• Geo-location: we use Cloudflare headers and the geoip-lite database on our servers; your IP is not sent to a separate geo provider.

Services you connect: if you sign in with Google or connect social networks (Facebook, Instagram, Threads, X, TikTok, YouTube, Google Business Profile, LinkedIn, Pinterest, and Bluesky), blog platforms (such as WordPress, Blogger, Tumblr, Ghost, dev.to, Hashnode, and beehiiv), or email marketing tools (Mailchimp and Kit), we send them the data you choose to publish or sync, such as posts, media, and leads. Those companies process the data under their own privacy policies. Most are in the United States.

We may also share information to comply with the law, enforce our Terms, or protect rights, safety, and security. We do not sell personal data.

If you connect a TikTok account, we use TikTok's Login Kit, Display API and Content Posting API only to provide the features you use. With your authorization we access:

• Your TikTok profile: open ID, display name, username and avatar, so you can see which account is connected and which account a post goes to;

• Your account and video statistics: follower, following, like and video counts, and your public videos (title, description, cover image and duration) with their view, like, comment and share counts, to show your TikTok analytics in your dashboard;

• Your posting settings: the audiences, interactions and maximum video length TikTok allows for your account, read each time you prepare a post;

• Posting: we upload the photos or videos you choose, with the caption, audience, interaction and disclosure settings you pick for each post, at the time you choose.

We store your TikTok access and refresh tokens encrypted, your TikTok open ID and username, and the posts you publish through the Platform with their publishing status and statistics. We do not sell TikTok data or use it for advertising, and we do not add our branding to content you post.

You can disconnect TikTok at any time in your dashboard, which deletes your TikTok access and refresh tokens, and you can revoke our access in the TikTok app under Settings and privacy → Security → Manage app permissions. When access is revoked, TikTok notifies us and we stop using the connection. To delete the rest of your TikTok data, contact us at [email protected].

If you connect a YouTube channel, the Platform uses YouTube API Services, Google's YouTube Data API and YouTube Analytics and Reporting APIs, only to provide the features you use. By connecting YouTube you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's Privacy Policy applies to the data Google processes: https://policies.google.com/privacy.

With your authorization we access:

• Your Google profile and YouTube channel: Google account ID, name and picture, and your channel's ID, name, handle, picture, banner and subscriber count, so you can see which channel is connected and, if you add a YouTube block, show it on your bio page;

• Your videos and their statistics: titles, descriptions, thumbnails, publish dates, and view, like and comment counts, plus channel and video reports such as thumbnail impressions and click-through rate, to show your YouTube analytics in your dashboard;

• Comments on your videos: to show them in your inbox and to post the replies and moderation actions you choose. Automatic replies or moderation only run after you turn them on for a specific rule;

• Uploading and managing videos: we upload the videos you choose, with the title, description, tags, category, privacy, made-for-kids answer, disclosures, thumbnail, playlist and captions you set for each post, at the time you choose, and delete a video from YouTube only when you ask us to.

We store your Google access and refresh tokens encrypted, your channel details, and the videos you publish through the Platform with their publishing status and statistics. We refresh stored YouTube data at least every 30 days and delete what we can no longer refresh, and we delete data about channels that never connected after at most 30 days. Numbers we calculate ourselves, such as engagement rate, are labelled as calculated by LookMyBio and are not YouTube's metrics.

We share YouTube data only with the service providers listed in section 6 that host and process it for us, and with you and the people you give access to your profile. We do not sell YouTube data, use it for advertising, or let third parties serve ads on the Platform using it. We send your text to YouTube exactly as you wrote it and do not add our branding.

Bio pages can embed YouTube videos. Embedded videos use YouTube's privacy-enhanced mode (youtube-nocookie.com), so YouTube does not store cookies on a visitor's device until the visitor plays the video; once played, YouTube's own cookies and Google's Privacy Policy apply.

You can disconnect YouTube at any time in your dashboard, which deletes your Google tokens, and you can revoke our access in your Google account's security settings: https://myaccount.google.com/connections. If you revoke access or we can no longer refresh your connection, we delete your stored YouTube data within 7 days. To delete it sooner, contact us at [email protected].

If you connect a Pinterest account, the Platform uses the Pinterest API only to provide the features you use, and follows Pinterest's Developer Guidelines (https://policy.pinterest.com/developer-guidelines). Pinterest's Privacy Policy applies to the data Pinterest processes: https://policy.pinterest.com/privacy-policy.

With your authorization (boards:read, boards:write, pins:read, pins:write and user_accounts:read) we access:

• Your Pinterest account: username, account type and profile picture, so you can see which account is connected;

• Your boards and board sections: so you can pick where each Pin goes, and to create a board or section when you ask us to;

• Publishing Pins: we publish only the Pins you choose, one at a time, with the image or video, title, description, link, alt text, board and AI disclosure you set for each Pin, at the time you choose. We never create, save or edit Pins, follow accounts or take any other action on Pinterest without you choosing that action;

• Your Pins' statistics: read from Pinterest when you open your analytics, to show them in your dashboard.

We store your Pinterest access and refresh tokens encrypted while your account is connected, and the IDs of the Pins you publish through the Platform with their publishing status. Anything else we read from Pinterest, such as your profile, boards and Pin statistics, is kept for at most one day and then read again from Pinterest when you need it.

We do not sell Pinterest data or share it with anyone other than you, the people you give access to your profile, and the providers in section 6 that host the Platform. We do not use it for advertising, combine it with data from other people's accounts, or use it to train or improve AI models. Bio pages can show your Pins with Pinterest's official widget, which loads only after the visitor accepts marketing cookies or chooses to show the Pins.

You can disconnect Pinterest at any time in your dashboard, which deletes your Pinterest tokens and the Pinterest data we hold, and you can revoke our access in your Pinterest settings, under Security and logins. For help, contact us at [email protected].

We are based in the United States, so when you use the Platform from Brazil, we collect your data directly in the United States, and most providers in section 6 also process it there. We apply the same LGPD protections to your data wherever it is processed, and we only use providers bound by contract to protect it, along with technical and organizational measures. If we pass data to a provider in another country, we do so under article 33 of the LGPD, with safeguards recognized by the Brazilian data protection authority (ANPD) where they apply.

You can ask for more information about the safeguards for a transfer through the data protection officer contact in section 17.

We keep personal data only as long as its purpose needs it. After that, we delete it. An automatic process runs every night and deletes what is past its period:

• Contact form messages: 2 years after they were sent;

• Email sign-ups that were never confirmed: 30 days after the last confirmation request;

• Email leads that unsubscribed: 12 months after their last change;

• Support chat and assistant conversations: 12 months after the last message;

• Support tickets: 2 years after they were opened;

• Page views and link clicks (raw analytics events): 90 days. The daily totals we keep do not identify anyone;

• Visitor IP addresses in analytics: stored truncated (/24 for IPv4, /48 for IPv6) from the start.

Bio pages, links, posts, generated media, brand kits, connected accounts, the digital twin, and consent records are kept while your account exists and are deleted when you delete the account. Billing records are kept for 5 years, as tax law requires, and proof of a consent is kept as long as needed to demonstrate it.

Depending on your location, you may have the right to:

• Confirm whether we process your data and access it;

• Correct, update, or delete your data;

• Request anonymization, blocking, or restriction of processing;

• Request data portability;

• Obtain information about sharing with third parties;

• Withdraw consent or object to certain processing activities.

You can do some of this yourself, in the dashboard, under Account and privacy:

• Download your data: we email you a link to a file with your account, your pages and their content, posts, leads, settings, and a list of your media. The link is valid for 7 days, and you can ask once a day;

• Delete your account: we send a 6-digit code to your email, valid for 15 minutes. Once you confirm, your subscription is canceled, you can no longer sign in, and we delete everything your account owns, except the billing records tax law requires us to keep;

• Consents: you can change your cookie choices at any time under Cookie settings, in the site footer, and delete your digital twin in UGC Studio.

For the other rights, or if you need help, contact the data protection officer at the address in section 17. We answer within the LGPD deadlines. You may also file a complaint with the ANPD.

We use cookies and similar technologies to keep you signed in, store preferences, and analyze usage. Examples include authentication cookies, preference cookies (locale and theme), profile selection cookies, and analytics or marketing identifiers (PostHog, Facebook Pixel, _fbp, _fbc).

You can manage cookies through your browser settings. Some features may not work properly if cookies are disabled. PostHog is configured to respect Do Not Track and Global Privacy Control: with Do Not Track on it sends nothing, and with Global Privacy Control on it sends nothing unless you consent to analytics.

We use commercially reasonable measures to protect personal data, but no method of transmission or storage is 100% secure.

Access tokens for connected accounts are stored encrypted. New AI generations are private by default and only you and your team see them unless you publish them. Digital twin recordings and archived media are kept in private storage and shown only through short-lived signed links. Visitor IP addresses in analytics are stored truncated.

The Platform is not intended for individuals under 18. We do not knowingly collect personal data from minors.

We may update this Privacy Policy from time to time. Changes take effect when posted on this page.

Data protection officer (encarregado): Leonardo Ribeiro, email [email protected].

Questions about this Privacy Policy or your data? Contact the data protection officer at the email above or support at [email protected].