Privacy policy

When you create an account, we collect your email address, your first name, your password and a one-time verification code sent by email. Your password is never stored in plain text: only its hashed form is kept.

During sign-up, we also ask a few optional questions about your profile (your activity, the platforms you use, how you found us): these answers help us improve the service and are never resold.

This collection is based on the performance of our contract with you. You can delete your account at any time from the Account page. Whether you delete it or we do, the account is deactivated immediately and your bio pages are no longer visible to the public. Your account data is then kept for 45 days, so that we can handle any problem, dispute, audit or security check. During that period, the account can be restored on request to our support. After 45 days, your personal information is automatically anonymized (email address, first name, last name, password, company details, free-text answers given at sign-up, and sessions) and the account can no longer be restored. The following is kept, offline and never shown publicly: your bio pages and their content, including media, aggregated statistics, the billing references linked to our payment provider Whop (subscription ID, status, dates) and the records relating to link security checks.

If you provide billing information (company name, registration number, VAT number, address), it is used solely to issue invoices and meet our accounting obligations.

The content you add to your bio page (text, links, images, audio or video files) is public by nature: it is visible to anyone who visits your page at its ultime.bio address.

Payment for the Pro plan is processed by our provider Whop, Inc. (300 Kent Ave #401, Brooklyn, New York 11249, United States). Whop processes your name, email address and payment details (card). We never store your card number: we only keep your Whop subscription identifier, its status (active, cancelled…) and payment dates.

To protect the people who visit your pages, every link you add to a block is automatically checked as soon as you save your page, whether or not it is published: a link already known to be dangerous is caught immediately, and the others are analyzed right after, usually within a few minutes. As long as the page is online, its links are then checked again regularly.

The first checks use only the link itself (its address and domain name), never your account data. They rely on Google's database of dangerous sites (Web Risk), on URLhaus, the database of malicious URLs run by abuse.ch (Switzerland), and on the secure DNS resolution of our hosting provider Cloudflare. To read the domain's registration date, which is public, its name is also sent to the rdap.org service, which directs the request to the relevant registry.

When these checks are not enough to decide, the link may be submitted to Cloudflare's URL Scanner, which visits the linked page. This scanner publishes its scans: the link and a screenshot of the linked page then appear on Cloudflare Radar (radar.cloudflare.com), including for a link placed on an unpublished page, since the check takes place as soon as the page is saved.

If doubt remains, the public content of the linked page (its text, never your account data) may be analyzed by artificial intelligence to detect phishing or scam attempts. This analysis is primarily performed by a model run by Cloudflare (Workers AI). To confirm that a link is dangerous, a second analysis is performed by Google Gemini, which we access through the kie.ai service, or, if Gemini is unavailable, by a second model run by Cloudflare. When Workers AI is unavailable or has reached its daily quota, Google Gemini performs this analysis alone.

If a link is found to be dangerous, the page containing it is automatically quarantined and taken down from public view, and you are notified by email. Anyone can also report a page using the form at ultime.bio/en/report.

We measure your bio page's audience without a tracking cookie. On each visit, we temporarily receive the visitor's IP address and browser: neither is retained as such.

A cryptographic digest (hash) computed from this information is used only to avoid counting the same visit twice within a two-hour window.

We then retain: country, city, device type, browser, operating system, referring site, and any campaign parameters.

Raw events are kept for 3 months by our hosting provider Cloudflare. Daily aggregated statistics are kept for 400 days.

Cloudflare, our hosting provider, keeps technical connection logs for 7 days for security and fraud-prevention purposes.

Our transactional emails (verification code, password reset…) are sent through our provider Shipmail.

If you checked the corresponding box when signing up, your email address is also added to our mailing list at Shipmail, together with a few usage details that help us send you relevant tips: your plan (free or Pro), the number of pages you've created, your last login date, the date you last updated a page, as well as your total visits and clicks received and your payment dates. You can unsubscribe at any time via the link in every email.

You can also subscribe to our newsletter without creating an account, from a blog article. We first send you a confirmation email: your address is only added to the mailing list after you click the link you received and then the confirmation button (double opt-in). We then keep your email address, the confirmation date, the article you subscribed from, and the IP address used at confirmation, as proof of your consent. Without confirmation, your address is never added. You can unsubscribe at any time using the link included in every email.

We only use a session cookie strictly necessary for your account to work, kept for 30 days, and a convenience local-storage entry in the editor (studio) to remember your display preferences.

We do not use any advertising cookie or third-party tracker.

Depending on the blocks you choose to add to your page, it may load resources from third-party providers, which then receive your visitors' IP address:

• Bunny Fonts, operated by BunnyWay d.o.o. (fonts, on every page)
• OpenFreeMap and Photon, operated by komoot GmbH (maps and address search, Location block)
• YouTube, Spotify, SoundCloud and other oEmbed-compatible providers (embedded content)
• X, formerly Twitter (displaying embedded posts)
• GitHub (displaying statistics and avatars)
• Third-party sites linked from your blocks, to generate a preview (image, title, description)

We use the following processors:

• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States (hosting, database, file storage, analytics and automated link checks through secure DNS resolution, the URL Scanner and Workers AI; data centers located in the United States and the European Union)
• Shipmail (transactional and marketing email delivery; infrastructure hosted in the European Union, in Frankfurt)
• Whop, Inc., 300 Kent Ave #401, Brooklyn, New York 11249, United States (payment processing and Pro plan subscription management)
• Google LLC and, for users in the European Union, Google Ireland Limited (checking the safety of the links you publish via the Web Risk API, and analyzing the content of suspicious links via the Gemini API, which we access through kie.ai)
• NexusAI Services LLC (kie.ai), 118 Krameria St, Denver, CO 80220, United States (access to Google's Gemini API to analyze the content of suspicious links)
• abuse.ch (URLhaus), Switzerland (checking the links you publish against its database of malicious URLs)
• BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (Bunny Fonts typefaces)
• komoot GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany (OpenFreeMap base map and Photon address search)

Transfers of data to the United States are governed by the European Commission's standard contractual clauses. Transfers to Switzerland (abuse.ch) are covered by the European Commission's adequacy decision for that country. The data sent to kie.ai for analysis by Google Gemini is limited to information about the link (its address, its label on your page) and the public content of the linked page, excluding any account data.

Data is encrypted in transit (HTTPS) and your passwords are stored in hashed form, never in plain text.

Under the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, port, object to and restrict the processing of your data.

• Erasure: delete your account from the Account page. It is deactivated immediately, then your personal information is anonymized after 45 days, as described in the Account data section.
• Portability: to receive a copy of your data, request it by email using the "Write to us" button at the bottom of this page.
• For any other request, write to us using the same button.

You may lodge a complaint with the data protection authority of your country of residence, for example the French data protection authority (CNIL) at cnil.fr, or the Information Commissioner's Office (ICO), the competent authority in the United Kingdom where SHARINGANG LTD is registered, at ico.org.uk.

The service is reserved for people aged 15 and over.

For any question about this policy or your data, write to us using the "Write to us" button below.