MAXBIO Pay Privacy Policy
This policy explains how MAXBIO Pay handles personal data about creators who use payment.maxbio.link, buyers who pay through our checkouts, affiliates, and visitors to our website.
1. Who we are
MAXBIO Pay is operated by Craig McIntosh, a sole trader trading as MAXBIO.LINK and MAXBIO Pay ("we", "us", "our"). Our address is 4 Hyndford's Close, 34 High Street, Edinburgh EH1 1TG, Scotland, United Kingdom.
Contact: support@maxbio.link or support.maxbio.link.
2. Our role
- For creators (account holders), affiliates we contact directly, and visitors to our own website, we are the controller.
- For buyers, the creator you buy from is the controller of your data and we are their processor under our Data Processing Addendum. We also act as a controller for a limited set of buyer data we need to prevent fraud, keep security logs and meet our legal obligations.
3. What we collect
Creators
- Name, email, password (hashed), business name, logo and settings.
- Stripe and PayPal account identifiers and status. Your Stripe account data is held by Stripe; we receive only what we need, such as whether charges are enabled. PayPal API secrets and connected email-platform keys are stored encrypted.
- Plan and billing history for your MAXBIO Pay subscription (card handled by Stripe).
- Products, files, checkout content, coupons, affiliates, webhooks and email rules you create.
- Log-in, IP address, device and usage data for security and support.
Buyers
- Name and email address, what you bought, amounts, discounts, and order and download history.
- Payment metadata from Stripe or PayPal (such as payment ID, card brand and last four digits, country). We never receive your full card number.
- Whether you ticked the marketing box, and any affiliate referral code.
- IP address and browser data for fraud prevention and download security.
Affiliates
- Name, email, referral code and commission records, provided by the creator who added you.
4. How we use it and our legal basis
- Run the Service, process orders, deliver downloads, send receipts and subscription notices — contract (for creators) or on the creator's instructions (for buyers).
- Bill creators for MAXBIO Pay — contract.
- Security, fraud and abuse prevention, and enforcing our Terms — legitimate interests.
- Accounting, tax and responding to lawful requests — legal obligation.
- Product updates to creators — legitimate interests, with an opt-out in every email.
We do not sell personal data, do not use it for advertising, and do not use it to train AI models. We only add buyers to a creator's mailing list when the creator's rules say so, and by default only if the buyer ticked the marketing box.
5. Who we share it with
- The creator you bought from (buyer data), and their affiliate (only the commission amount and product, never your contact details).
- Stripe and PayPal — payment processing on the creator's account, and billing of MAXBIO Pay subscriptions.
- Amazon Web Services — secure file storage and email delivery.
- IONOS and Cloudflare — hosting, DNS and security.
- Services a creator connects, on the creator's instructions: email-marketing platforms (such as Kit, MailerLite, ActiveCampaign, Mailchimp, Brevo, Beehiiv, Sendy or listmonk), their own email sender (such as Mailflare or an SMTP provider), and webhook endpoints they configure.
- Our full list of providers is at Sub-processors.
We may also disclose data to professional advisers, a successor business, or where required by law.
6. International transfers
We are based in the UK and many of our providers are in the United States or the European Economic Area. Where personal data leaves the UK we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, as applicable.
7. How long we keep it
- Creator accounts: while open, then deleted within 90 days of closure (backups within a further 30 days).
- Order and payment records: 6 years for tax and accounting, unless the creator asks us to delete them sooner and the law allows.
- Download and security logs: up to 12 months.
- Uploaded product files: until the creator deletes them or closes their account.
8. Security
We use HTTPS everywhere, encrypt secrets (such as API keys you connect) at rest, restrict staff access, keep backups, and use reputable infrastructure providers. Card details are entered directly into Stripe or PayPal and never reach our servers. No system is perfectly secure; if we become aware of a breach affecting you we will notify you and, where required, the ICO.
9. Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to: access your personal data; have it corrected; have it erased; restrict or object to our use of it; receive it in a portable format; and withdraw consent at any time where we rely on consent. You can also object at any time to direct marketing.
To exercise a right, email support@maxbio.link. We will respond within one month. We may need to verify your identity first.
You can complain to the UK Information Commissioner's Office (https://ico.org.uk, 0303 123 1113). We would appreciate the chance to resolve your concern first.
United States residents
Depending on your state (for example California, Colorado, Connecticut, Virginia or Utah), you may have rights to know, access, correct and delete your personal information, and to opt out of its sale, sharing for cross-context behavioural advertising, or profiling. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. You may use an authorised agent. To make a request, email us; if we decline, you may appeal by replying to our decision.
10. Buyers: making a request
Because the creator controls your purchase data, please contact them first. If you cannot reach them, email support@maxbio.link and we will pass on your request and help them respond.
11. Children
Our services are not directed at children. You must be at least 18 to create an account (or the age of majority where you live). We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
12. Cookies
See our Cookie Policy.
13. Changes
We may update this policy. We will post the new version here with a new date, and if a change is material we will tell account holders by email or in the dashboard at least 14 days before it takes effect (unless the change is required sooner by law).
14. Contact us
Questions about this document: support@maxbio.link, support.maxbio.link, or post to Craig McIntosh, a sole trader trading as MAXBIO.LINK and MAXBIO Pay, 4 Hyndford's Close, 34 High Street, Edinburgh EH1 1TG, Scotland, United Kingdom.