Privacy Policy

1. Introduction

Biqli LLC ("Biqli," "we," "us," or "our") provides link management, QR codes, biolinks, analytics, workspaces, APIs, and related services. This Privacy Policy describes how we collect, use, disclose, retain, and protect Personal Data and the choices available to individuals.

Biqli LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA is the controller for Account, website, direct billing, support, security, and business-contact data described here.

2. Definitions

"Personal Data" means information that identifies, relates to, describes, or can reasonably be linked to a person or household. "Customer" means an Account holder or organization using the Services. "Customer Personal Data" means Personal Data Biqli processes on a Customer's behalf under the DPA. "Services" means Biqli websites, applications, APIs, and related products.

3. Scope of This Policy

This Policy applies to Biqli's websites, Account administration, direct communications, billing, support, security, and product telemetry. It does not govern third-party sites or services linked from Biqli. For Customer Personal Data, the Customer's privacy notice applies and requests should ordinarily be directed to that Customer.

4. Information We Collect

• Account and business information: name, email, organization, role, workspace membership, authentication information, and preferences.
• Billing and contract information: billing contacts, legal entity and address, tax and purchase-order details, invoice status, plan, signatures, and contract audit records. Payment processors handle full payment-card details; Biqli generally receives tokens, status, brand, and limited payment metadata.
• Service and content data: links, aliases, domains, QR-code and biolink configurations, tags, files, API keys, integration settings, and support content.
• Usage and analytics data: clicks, scans, events, timestamps, referrers, device and browser type, approximate location derived from IP, and aggregate performance data.
• Technical and security data: IP address, user agent, request IDs, authentication events, logs, cookies, safety results, abuse indicators, and diagnostic data.
• Browser extension data: when an Account holder connects a Biqli browser extension, we process the Account identity and authentication credentials needed to connect it, the URLs the user deliberately submits for shortening or QR-code creation, and the IP address and approximate city or region derived from it for session security. If the user separately permits optional technical data, the extension also sends its installation identifier, version, browser, platform, and device type so Biqli can display and secure the extension session. Firefox users can change that optional permission in Firefox's Permissions and Data settings without losing core link-management functionality.
• Integration data: data received from or sent to services Customer chooses to connect, such as identity, commerce, payment, or signing providers.
• Communications: support requests, sales inquiries, feedback, and notification preferences.

5. How We Use Information

We use Personal Data to provide and operate the Services; authenticate users; process payments and contracts; deliver redirects, analytics, and integrations; provide support; communicate service and legal updates; secure the Services; prevent fraud and abuse; enforce agreements; comply with law; improve reliability and usability; and establish, exercise, or defend legal claims.

We do not use Customer Personal Data for unrelated advertising or to build profiles for third-party targeted advertising.

6. Legal Bases

Where the EEA, UK, or similar laws apply, we rely on: performance of a contract for Account and Service delivery; legitimate interests for security, fraud prevention, support, product improvement, and business operations; consent where required for optional cookies or marketing; and legal obligations for tax, accounting, sanctions, and lawful process. Individuals may object to processing based on legitimate interests as described in Section 9.

7. How We Disclose Information

We disclose Personal Data only as reasonably necessary:

• to service providers and subprocessors that host, secure, monitor, email, sign, support, analyze, or bill for the Services;
• to an Account owner or organization administering the relevant workspace;
• to an integration provider at Customer's direction;
• to professional advisers under confidentiality obligations;
• to comply with law, legal process, or valid government requests, or to protect rights, safety, and security; and
• in a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice where required.

Biqli does not sell Personal Data or share Personal Data for cross-context behavioral advertising as those terms are defined by the CCPA. We have not done so in the preceding 12 months. We do not knowingly sell or share Personal Data of individuals under 16.

Our current service providers are listed at biq.li/subprocessors.

8. Cookies and Similar Technologies

We use necessary cookies for authentication, security, preferences, and core functions. With consent where required, we may use analytics technologies to understand use and improve the Services. Details and controls are in the Cookie Policy. Browser signals such as Global Privacy Control are honored where legally required and technically applicable.

9. Your Rights and Choices

Depending on location, you may have rights to know or access Personal Data, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, opt out of targeted advertising, sale, or sharing, and appeal a denied request. You also may complain to a supervisory authority.

Submit a request to contact@biq.li. We may verify identity and authority before responding. An authorized agent may submit a request where permitted by law. We will not discriminate for exercising privacy rights. Because Biqli does not sell or share Personal Data for cross-context behavioral advertising, no separate sale/share opt-out is ordinarily needed.

For Customer Personal Data, contact the Customer that controls the relevant workspace or site. We will assist that Customer under the DPA.

10. Data Retention and Deletion

We retain Personal Data only as long as reasonably necessary for the purpose collected, the agreement, security, or legal obligations. Typical periods are:

• Account and Customer Content: while the Account or workspace is active, then deleted from active systems within 30 days after a valid deletion or termination request unless law requires retention;
• click, scan, event, and analytics data: for the plan's configured retention period or until Customer deletes it;
• support communications and operational logs: generally up to 24 months, with shorter retention where feasible;
• contracts, invoices, tax, accounting, and payment records: for up to seven years where reasonably necessary or for the period required by law; in-application copies may be deleted sooner with the Account or workspace, while a payment, signing, or legally required record may be retained separately; and
• fraud, abuse, and security records: as reasonably necessary to protect the Services and establish or defend claims.

Deleted data may remain in encrypted, access-restricted backups until overwritten through the ordinary backup cycle, generally within 90 days. We do not use backup copies for ordinary business purposes. Data may be retained longer if subject to a legal hold, lawful request, dispute, or statutory obligation.

11. Security

We use administrative, technical, and physical safeguards designed for the nature and risk of the data, including encryption in transit, access controls, monitoring, secure development, backups, incident response, and vendor diligence. No system is perfectly secure. Customers must protect credentials, API keys, devices, and workspace permissions and promptly report suspected compromise.

12. International Transfers

Biqli and its providers may process data in the United States and other countries. Where a restricted transfer is not covered by an adequacy decision, we use appropriate safeguards. For Customer Personal Data, the DPA incorporates the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum where applicable, Swiss adaptations, and supplementary measures. We also perform transfer assessments where required.

13. Children's Privacy

The Services are intended for business users aged 18 or older and are not directed to children. We do not knowingly collect Personal Data directly from children. Contact us if you believe a child provided Personal Data, and we will investigate and delete it where required.

14. Shopify Integration

If a Customer connects Shopify, Biqli may receive store domain and settings, OAuth credentials, order and conversion events, customer identifiers and contact data, session identifiers, URLs, device data, and attribution information within the scopes authorized by the merchant. Biqli processes this data to provide conversion tracking, analytics, and connected features at the merchant's direction.

The merchant is responsible for its privacy notice, consent mechanism, legal basis, Shopify configuration, and responses to its customers. After disconnection, collection stops when the integration is disabled; active integration credentials are revoked or deleted, and Customer Personal Data is deleted under Section 10 and the DPA. We do not retain Shopify Customer Personal Data indefinitely merely for product improvement.

15. Google Services and Google User Data

Biqli offers Google Sign-In and an optional YouTube connection. These are separate features with separate permissions. Signing in with Google does not give Biqli access to a user's YouTube channel, videos, playlists, or YouTube Analytics. YouTube access occurs only when an authorized workspace owner separately chooses to connect YouTube and grants the requested permissions.

Google Sign-In

When a user chooses Google Sign-In, Biqli accesses the user's Google account identifier, name, verified email address, profile image, and the OAuth credentials Google supplies. We use this information only to create or locate the Biqli Account, authenticate the user, associate the Google login with that Account, display the selected profile image, prevent fraud, and secure the login process.

Biqli stores the Google account identifier, display name, email address, profile-image URL, and applicable OAuth connection credentials in access-controlled systems while the Google login remains linked or while the corresponding information is needed to maintain the Biqli Account. Disconnecting Google Sign-In removes the stored Google social-profile connection and its credentials. The Biqli Account and information already used as Account data, such as the email address or profile image, remain until the user changes them or requests Account deletion under Sections 9 and 10.

YouTube Connection

If a workspace owner connects YouTube, Biqli requests the read-only youtube.readonly and yt-analytics.readonly permissions. Depending on the features the user selects, Biqli may access:

• YouTube channel identifiers, titles, descriptions, URLs, and thumbnails;
• owned uploads, videos, Shorts, playlists, playlist items, and their metadata, including titles, descriptions, thumbnails, publication times, durations, availability, and embedding status;
• read-only YouTube Analytics information used by the connected feature, such as content classification and recent view metrics; and
• OAuth access tokens, refresh tokens, granted scopes, token-expiration information, connection status, and synchronization timestamps.

Biqli uses this data only to let the workspace owner browse and select their YouTube content, configure and publish Video blocks, display selected or automatically refreshed channel content, distinguish videos from Shorts, order content using the selected sorting option, refresh the connected content, and maintain and secure the connection. Biqli does not modify, upload, or delete content in the user's YouTube account through these read-only permissions.

Biqli stores encrypted YouTube OAuth access and refresh tokens, channel connection details, the metadata and identifiers selected for Video blocks, display configuration, and synchronization status. Google API responses may also be cached temporarily to provide the feature efficiently. Connected data is retained while the connection or resulting Video blocks remain active, subject to Section 10.

When the workspace owner disconnects YouTube, Biqli revokes and clears the active YouTube OAuth credentials, stops authenticated synchronization, and converts affected Video blocks to public-source-safe content where available. Public channel or video metadata already saved in a Video block may remain as Customer Content until the user edits or deletes that block, workspace, or Account. A user may also revoke Biqli's access through their Google Account permissions. Account and deletion requests can be submitted as described in Sections 9 and 10.

Disclosure, Protection, and Limited Use

At the user's direction, channel and video information selected for a published Video block is displayed to visitors of that user's public biolink. Biqli may otherwise disclose Google user data only to service providers that process it for Biqli under appropriate contractual and confidentiality obligations, to the relevant Account or workspace administrators, when the user directs an integration, for security purposes, to comply with applicable law, or as otherwise permitted by the Google API Services User Data Policy. The service providers supporting the Services are identified on our Subprocessor List.

Google OAuth credentials and Google user data are transmitted using encryption in transit and protected using access controls, monitoring, secure-development practices, and the safeguards described in Section 11. Access by personnel is limited to authorized purposes necessary to provide or support the user-facing feature, investigate security or abuse, comply with law, or handle aggregated and non-identifying internal operations as permitted by Google's requirements.

Biqli's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Biqli does not sell Google user data; use it for targeted, personalized, interest-based, or retargeted advertising; provide it to data brokers or information resellers; use it to determine creditworthiness or for lending; or use it to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.

16. TikTok Services and TikTok User Data

Biqli offers optional TikTok connections for two separate purposes: verifying ownership of a TikTok profile for the Biqli Partner Program, and allowing an authorized workspace owner to display their TikTok profile and public posts on a Biqli biolink. Connecting TikTok is optional and is not required to create or use a general Biqli Account.

Information Biqli Accesses

For Partner Program profile verification, Biqli may request read-only access to basic and additional public profile information. For a TikTok biolink connection, Biqli may request the read-only user.info.basic, user.info.profile, user.info.stats, and video.list permissions. Depending on the permissions the user grants and the features they use, Biqli may access:

• TikTok account identifiers, username, display name, avatar, biography, profile URL, and verification status;
• profile statistics such as follower, following, like, and public-post counts;
• public post information such as post identifiers, titles or captions, cover images, publication times, share and embed links, duration and dimensions, and public view, like, comment, and share counts; and
• OAuth access and refresh tokens, granted permissions, token-expiration information, connection status, and synchronization timestamps.

How Biqli Uses TikTok Data

Biqli uses TikTok data only to verify that a Partner Program applicant controls the submitted TikTok profile; let an authorized workspace owner connect the appropriate TikTok account; browse, select, order, and configure public TikTok profile and post content; display the content the user chooses on their public biolink; refresh that connected content; and maintain and secure the connection. These permissions are read-only. Biqli does not use them to publish, edit, or delete TikTok content, access private messages, or act on the user's TikTok account.

Storage, Public Display, and Disclosure

Biqli stores TikTok OAuth credentials in encrypted form in access-controlled systems. Biqli also stores connection details and the profile, public-post, statistics, display configuration, and synchronization information needed to provide the selected features. At the user's direction, selected TikTok profile and post information is displayed to visitors of the user's public biolink.

Biqli may otherwise disclose TikTok user data only to the relevant user and workspace administrators; to service providers processing it for Biqli under appropriate contractual and confidentiality obligations; when the user directs the disclosure or integration; for security, support, or legal compliance; or as otherwise permitted by TikTok's applicable developer terms and policies. Biqli does not sell TikTok user data, provide it to data brokers, use it for third-party targeted advertising, or use it to train generalized or non-personalized artificial-intelligence or machine-learning models.

Retention, Disconnection, and Deletion

TikTok connection data is retained while the connection or resulting Partner verification or biolink content remains active and as otherwise described in Section 10. When an authorized user disconnects TikTok, Biqli stops authenticated synchronization and revokes and clears the active OAuth credentials. Public TikTok metadata already saved in a biolink block may remain as Customer Content until the user edits or deletes that block, workspace, or Account.

When the relevant workspace or Account is deleted, Biqli deletes the locally stored TikTok connection data under Section 10 and, where technically possible, asks TikTok to revoke any active authorization. A user may also revoke Biqli's access through their TikTok account settings. Privacy and deletion requests may be submitted as described in Sections 9, 10, and 18.

17. Changes to This Policy

We may update this Policy as our practices, Services, or laws change. We will post the new date and give at least 30 days notice of a material change where required. Before accessing or using Google or TikTok user data for a new or materially different purpose, we will update this Policy and relevant in-product notices and obtain additional user consent where required. A privacy or DPA version incorporated into a signed Enterprise Order Form remains governed by that agreement's versioning terms.

18. Contact Us

Privacy questions and requests may be sent to:

• Email: contact@biq.li
• Mail: Biqli LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA