Reroute (https://reroute.bio ) is a link-in-bio platform for creators. This policy explains what data we collect, how we use it, and the choices you have.
It covers three groups of people:
- Creators: you have a Reroute account and publish one or more pages.
- Respondents and subscribers: you submit a form, upload a file or voice response, or subscribe through a creator’s page. You do not need a Reroute account.
- Visitors: you browse Reroute or a creator’s public page.
1. The Data We Collect
| Category | Examples | Why we collect it |
|---|---|---|
| Account data | Name, email, profile photo, and sign-in details | Account creation, sign-in, account management, and support |
| page and creator content | page names, profile details, links, Blocks, design settings, uploaded images, files, and audio | Publishing and operating creator pages |
| Responses and audience data | Form answers, uploaded files or voice responses, names, email addresses, phone numbers, and subscription status | Delivering responses to creators and managing their audience |
| Billing data | Billing contact details and payment information processed by Stripe | Subscriptions, invoicing, cancellation, and legally required records |
| Usage and device data | IP address, approximate country, region, and city derived from your IP address, browser and device information, pseudonymous visitor and visit identifiers, pages viewed, Block clicks, form or purchase outcomes, referrers, campaign tags, and logs | Security, rate limiting, debugging, creator Insights, and product analytics |
| Cookies and local storage | Session data, pseudonymous visitor identifiers, saved preferences, subscription state, and Block Lock unlock state | Keeping you signed in, remembering choices, correlating page interactions, and operating the Service |
We do not ask creators for sensitive information as part of account setup. Creators control the fields on their forms, however, and respondents choose what they submit. Do not submit sensitive information unless you understand that it will be shared with the creator and any additional terms shown on the form.
2. Public pages, Responses & Subscriptions
Creator pages are public. Information a creator publishes on a page, including profile details, links, and uploaded media, can be viewed by anyone with access to the page.
When you submit a form or subscribe through a creator’s page:
- Your response is stored by Reroute and shared with the creator identified on that page.
- The page tells you which fields are required before you submit. Depending on the form, a response may include text, contact details, files, or a voice recording.
- If you provide an email address, Reroute may create or update a Contact in that creator’s audience. You are marked as subscribed only when you take an action that asks to receive updates, such as using the Subscribe button or an email-signup form.
- The creator can view and download the information you submit and is responsible for how they use it. A creator’s own terms may also apply when they are linked beneath the form.
- Where a page shows a subscription-management control, you can use it to unsubscribe. You can also contact the creator directly, or email us about a response or subscription and we will help where we can.
3. How We Use Your Data
- Provide the Service: publish pages, store creator content, deliver responses, manage audience Contacts, generate Insights, and keep accounts signed in.
- Process payments: manage paid plans through Stripe. We do not receive your full payment card number.
- Communicate with you: send sign-in codes, account notices, response notifications, service updates, and support replies.
- Improve and secure the Service: debug errors, understand product usage, enforce rate limits, and prevent fraud and abuse.
- Meet legal obligations: maintain required records and comply with applicable laws, including the Australian Privacy Act 1988 (Cth) where it applies.
4. Service Providers
We do not sell or rent your personal data. We share data with providers that help us run the Service:
| Provider | What it does | Data involved |
|---|---|---|
| Stripe | Payment processing and subscription billing | Billing details, email, and subscription records |
| Supabase | Database, authentication, and sign-in | Account data, page data, responses, and audience data |
| Vercel and Vercel Blob | Hosting and file storage | Creator content, uploaded files, and usage/device data |
| Resend | Transactional email | Email address and notification content |
| PostHog, Rybbit & Ahrefs | Product and website analytics | Usage events and device data |
| Upstash | Rate limiting | IP address and request data |
| Optional Google sign-in and Google Wallet | Account profile data or digital-card details, when used | |
| Apple | Optional Apple Wallet passes | Digital-card details, when used |
| Meta and Instagram | Optional Instagram connection and messaging | Instagram profile, media, comments, and messages, when connected |
| OpenFreeMap & Photon | Map tiles and location search | Map locations and request/device data, when maps are used |
These providers process data under their own terms and privacy policies and, where they act as our processors, on our instructions.
5. Legal Bases (EU/UK Visitors)
Where EU or UK data protection law applies, we rely on:
- Contractual necessity: to provide the Service you request.
- Legitimate interests: to operate, improve, and secure Reroute, provided those interests are not overridden by your rights.
- Consent: where you choose to subscribe, use optional features, or consent is otherwise required. You may withdraw consent at any time.
- Legal obligation: to satisfy accounting, regulatory, or other legal requirements.
6. Data Retention
- Account and page data: retained while your account remains open or until you remove the relevant content.
- Responses and audience data: retained while the creator’s relevant page or account remains active, unless we action a valid request sooner.
- Uploaded files: retained with the related account, response, or completed purchase. When account deletion completes, it removes unpinned files from active Reroute storage; files needed to fulfil completed purchases and limited provider backups or logs may remain.
- Usage, security, and diagnostic data: we do not currently apply a fixed retention period. Interaction data from pages is retained with the related creator account; provider logs and backups may remain for their operational retention periods. We may delete or anonymise this data when it is no longer reasonably needed for analytics, security, debugging, or legal obligations.
- Financial records: retained for the period required by tax, accounting, and consumer laws.
- Connected Instagram data: the encrypted access token and connected-account profile data are removed when you disconnect Instagram, deauthorize Reroute through Meta, or submit a valid Meta data-deletion request. See Data Deletion.
When account deletion is available and completes, it cancels any active Reroute subscription and removes your account, pages, responses, Contacts, page-interaction data, and unpinned stored files from our active systems. Account deletion may be unavailable while completed or in-flight purchases require us to preserve seller and fulfilment records. Billing records, purchase records and associated files, security logs, provider logs, and backup copies may remain where required for fulfilment, disputes, legal obligations, or provider backup and operational retention periods.
7. Your Rights & Choices
| Region | Your rights may include |
|---|---|
| Australia | Access, correction, and complaint rights under the Privacy Act 1988 |
| EU/UK | Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority |
You can update or delete your creator account from account settings and use any subscription-management control shown on a creator’s page. For access, correction, deletion, unsubscribe help, or other privacy requests, email ty@updates.reroute.bio. We may need to verify your identity before completing a request, and some rights are subject to legal exceptions.
8. Children’s Privacy
The Service is not directed to children under 13. Creators must not knowingly use Reroute to collect personal data from children under 13. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.
9. Cookies & Tracking Choices
We use cookies, local storage, and similar technologies to keep accounts signed in, remember preferences, record Block Lock unlock state, remember subscriptions on a device, correlate pseudonymous interactions on a creator page, and gather usage statistics. Visitor identifiers for page interactions rotate after 90 days without activity, and Reroute does not create them when a browser sends Global Privacy Control or Do Not Track. Most browsers also let you refuse or delete these technologies, although disabling them may limit functionality.
10. International Data Transfers
Reroute is operated from Australia, and our providers may process data in Australia, the United States, and other countries where they operate. Those countries may have different data protection laws. Where required, we use contractual or other safeguards for international transfers.
11. Security
We use technical and organisational safeguards including encryption in transit, access controls, rate limiting, and security monitoring. No online service is completely secure, so use a strong, unique sign-in method and take care with the information you publish or submit.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced by email to creators where appropriate and posted on this page with a new “Last updated” date.
13. Contact
Questions, privacy requests, or complaints? Email ty@updates.reroute.bio.