Privacy Policy

Delulu Bio (“the Service”) is operated by Nov Square (“we”, “us”). This policy explains what we collect, why, and the choices you have. Questions: team@indelulu.club.

1. What we collect

Account. Your email address and name. Passwords are handled by Firebase Authentication; we never see or store your password.

Your page. What you add: username, display name, bio, profile photo, category, Instagram handle, social links, custom links, products you recommend (titles, links, prices, notes and images you upload or link to) and appearance settings. Published pages are public, by design.

Waitlist. Email, Instagram username, category and follower range.

Invitations. The email and Instagram username an admin enters for the invite, and whether it was used. Invite codes are stored only as a one-way hash.

Visitor analytics on public pages. For each page view and link click we record which link or product was clicked, the time, the referring site, a coarse traffic source (e.g. “instagram”, “direct”) and a shortened browser user-agent string. We do not store IP addresses and visitors do not need an account. Requests from obvious bots are skipped.

Instagram (optional). If you choose “Connect Instagram” we use Meta’s official Instagram API with read-only access (instagram_business_basic) to receive your Instagram user ID, username, name, biography and profile photo, where available. Your access token is stored encrypted on our servers, is never exposed to your browser, and is deleted when you disconnect. We never ask for your Instagram password and do not post, message or read anything else on your account.

“Fetch name & photo”. When you click it, our server requests the public Instagram profile for the handle you typed and reads its public name and photo. We keep only what you then choose to save.

Technical data. Our hosting provider keeps standard server logs, which may include IP addresses and are used for security and reliability. We also use IP addresses momentarily in memory for rate limiting; they are not saved to our database.

2. How we use it

• To run the Service: sign you in, show your public page, count views and clicks for your analytics.
• To manage invitations and the waitlist, and contact you about access.
• To keep the Service secure and prevent abuse.
• To improve the product using aggregate usage data.

We do not sell your personal data and we do not show ads.

3. Cookies and similar technologies

We set one essential cookie (__session) to keep you signed in. It is HTTP-only and expires after 5 days.

On our marketing, sign-in, sign-up and dashboard pages we use Google Analytics to understand how people use the product, for example which steps of sign-up are confusing. It records page views, button clicks and form events (such as “started”, “submitted”, “error” and the name of the last field touched, never what you typed), and sets its own cookies and identifiers. When you are signed in, we attach your opaque account ID and role to these events, never your email or name.

We do not load Google Analytics on creators’ public pages, so visitors to a page are not tracked by Google through us, and we do not load it in the admin area. We also do not load it if your browser sends Do Not Track or Global Privacy Control.

4. Who we share data with

We use service providers to run the Service, acting on our instructions:

• Google (Firebase / Google Cloud / Google Analytics): authentication, database, file storage, hosting and product analytics.
• Meta (Instagram): only if you connect Instagram. Meta’s own privacy policy applies to data on their platform.

We may disclose information if required by law or to protect the rights, safety or security of users or the Service. Your published page, including your name, photo, bio and links, is visible to anyone on the internet and may be indexed by search engines.

5. Where data is stored

Data is stored with Google Cloud in the United States. If you use the Service from elsewhere, your data is transferred there.

6. How long we keep it

We keep account and page data while your account is active. Analytics events are kept for as long as your page exists. When your account is deleted we remove your account, page, links, analytics and stored Instagram data, except where we must keep something by law. Backups may persist for a short period.

7. Your choices and rights

• Edit or delete your page content any time in the dashboard; unpublish to take your page offline.
• Disconnect Instagram in Settings to delete the stored token immediately.
• Ask us to access, correct, export or delete your data, or to remove you from the waitlist, by emailing team@indelulu.club.

See how to delete your data. Depending on where you live, you may have additional legal rights, which we will honour.

8. Children

The Service is not for children under 13 (or the minimum age in your country). If you believe a child has given us data, contact us and we will delete it.

9. Security

We use encryption in transit, access controls, and encrypt Instagram tokens at rest. No system is perfectly secure, so please use a strong password.

10. Changes

We may update this policy and will change the date above. For significant changes we will give notice in the Service or by email.

11. Contact

Nov Square · team@indelulu.club