Privacy Policy

1. Who we are

5127 AI ("5127," "we," "us," or "our") is based in Alberta, Canada. We are the controller of the personal information described in this policy.

All privacy, data, and general enquiries: b@5127.ai

2. Which laws apply

We are a Canadian business. This policy is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR also apply to our handling of your information, and section 12 sets out the legal bases we rely on.

If you are in the United States, applicable state privacy laws may give you additional rights. Contact us and we will honour them.

3. What we collect

Information you give us

• Account information: your email address and password credentials.
• Page content: photos, images, name, biography, statistics, social handles, links, video selections, and design choices you enter in the Studio.
• Pro intake information: your domain preference, desired email address, and any notes about changes you want.
• Communications: emails, form submissions, and support messages.
• Billing information: handled by Stripe. We receive a record that a payment occurred, the amount, and a Stripe customer identifier. We never receive or store your card number.

Information collected automatically

• Technical data such as IP address, browser type, device type, and pages visited, through standard analytics.
• Page view counts for published pages, in aggregate.

Information from other sources

• Publicly listed business contact details, used for outreach as described in section 8.

4. Your published page is public

This is the most important thing to understand about our service.

When you publish a page, everything on it becomes publicly visible on the internet: your photos, your name, your biography, your links, and anything else you added. It can be indexed by search engines, shared, screenshotted, and archived by third parties beyond our control.

Do not put anything on your page that you are not comfortable being public. Deleting your page removes it from our systems but cannot remove copies that others have already made or that search engines have cached.

5. How we use your information

• To create and operate your account.
• To build, publish, host, and maintain your page.
• To process payments, subscriptions, and refunds.
• To send service messages: publication confirmations, receipts, draft reminders, and account notices.
• To provide the AI assistant in the Studio.
• To calculate and pay referral earnings.
• To respond to your questions and support requests.
• To detect and prevent fraud, abuse, and breaches of our Terms.
• To improve our services, using aggregated and anonymised data.
• To meet legal, tax, and accounting obligations.

We do not sell your personal information. We do not share it with advertisers.

6. Images and hosting

Images you upload are stored with our third-party image hosting provider (Cloudinary) and are served publicly as part of your published page. Images attached to unpublished drafts are stored but not publicly linked from your page.

When you delete your page, associated images are queued for permanent deletion from both our database and the image host within 30 days.

7. AI features

The Studio includes an AI assistant that can draft page content and suggest design choices. Text and images you give it are sent to a third-party AI provider to generate that output.

We select providers with data handling commitments that prohibit using submitted content to train their general-purpose models. We do not use your content to train any model of our own.

8. Business outreach

We contact athletes, creators, agencies, and businesses about our services using contact details they have published for business purposes, such as an email address listed in a public link-in-bio page or on a company website.

Under Canada's Anti-Spam Legislation this is implied consent through conspicuous publication. Every message we send identifies us, includes our mailing address, and offers a way to opt out. If you ask us not to contact you again, we will stop, and you can ask us at b@5127.ai to delete your details from our records entirely.

9. Web design services

We build websites for small businesses as a separate service. Preview and delivered sites may be hosted on our domain by arrangement with the business owner.

Contact forms on those sites collect the name, email, phone number, and message a visitor submits. That information is forwarded to the business the site was built for and is not used by us for any other purpose. Business owners may request modification or removal of any content at any time by contacting b@5127.ai.

10. Who we share information with

We share personal information only with service providers who help us operate, and only as needed:

• Stripe for payment processing.
• Cloudinary for image storage and delivery.
• Our hosting, database, and email delivery providers.
• Analytics providers.
• Professional advisors such as accountants or lawyers, where necessary.
• Regulatory or law enforcement authorities, where required by law.

Visitor contact form submissions on a creator page are forwarded to that creator.

If our business is ever sold or merged, personal information may transfer as part of that transaction. We would notify account holders first.

11. International transfers

We are in Canada and our service providers are primarily in the United States. Your information will be stored and processed outside your country and may be accessible to courts and authorities in those jurisdictions.

Where we transfer information from the EEA or UK, we rely on standard contractual clauses or an equivalent safeguard offered by the provider.

12. Legal bases (EEA and UK users)

• Contract: creating your account, building and hosting your page, processing payment.
• Legitimate interests: securing our service, preventing fraud, improving our product, and business-to-business outreach.
• Consent: optional marketing emails and non-essential cookies. You may withdraw consent at any time.
• Legal obligation: tax, accounting, and responding to lawful requests.

13. How long we keep information

• Account and page data: for as long as your account is active.
• Unpaid drafts: deleted automatically after 90 days of inactivity, along with their images.
• Deleted pages: personal data and images permanently deleted within 30 days. We keep a minimal record of the URL and deletion date so the URL is not reissued.
• Payment records: retained for the period required by Canadian tax and accounting law, currently six years.
• Outreach records: deleted on request, and otherwise reviewed periodically and removed when no longer needed.
• Backups: routine backups may hold deleted data for a limited additional period before being overwritten.

14. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your page and personal information. Account holders can do this directly in account settings. Anyone else can request it at b@5127.ai.
• Export your data in a portable format, available from account settings.
• Withdraw consent where we rely on it.
• Object to or restrict processing based on legitimate interests.
• Complain to a privacy regulator.

We respond to requests within 30 days. We do not charge for this and we will not treat you differently for exercising your rights.

If you appear on a page you do not control and want your image or information removed, email b@5127.ai. We act on valid removal requests within 24 hours.

15. Children

Our services are not intended for children under 16 and we do not knowingly collect their personal information. Account holders must be at least 16, and those under 18 need a parent or guardian's involvement and consent.

If a page includes an identifiable minor, the account holder is required to have that minor's parent or guardian's permission before publishing.

If you believe we hold information about a child under 16, contact b@5127.ai and we will delete it.

16. Security

We protect personal information with measures including encrypted connections, database access controls, restricted payment credentials, and authentication requirements for uploading content.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the relevant regulator as the law requires.

16A. Connected social accounts

If you choose to connect an Instagram or TikTok account, we receive only what that platform's permissions allow: your account identifier, username, display name, profile picture, follower count, and your recent public posts. We use it for one purpose, to display your own information on your own page.

Access tokens are stored on our servers, are never sent to browsers, and are never shared or sold. We do not post on your behalf and we do not read your private messages.

Disconnecting the account in your dashboard, or removing 5127 from inside Instagram or TikTok, deletes the token and the stored profile data. Full instructions are on our data deletion page.

Use of information received from Meta and TikTok follows their respective platform terms and developer policies, including Meta's Platform Terms and Developer Policies.

16B. Connected third-party services

Some features let you connect an account you already own, for example a calendar, a scheduling tool, a video channel, a store, or a payment account. Connecting is always optional, always started by you, and never required to use 5127.

When you connect a service we receive only the specific data the permissions you approve allow, and we use it only to operate the feature you turned on. We do not use connected account data for advertising, for profiling, for training any AI model, or for any purpose you did not ask for, and we never sell it.

Connection tokens are encrypted, stored on our servers, and never exposed to browsers. Disconnecting a service in your dashboard, or revoking access from inside that provider's own settings, deletes the token and any data we stored solely to run that feature. Deleting your account does the same automatically.

Human access to connected account data is limited to what is strictly necessary to provide the feature, to resolve a support request you raise, for security, or where the law requires it.

16C. Google user data

If you connect a Google account, 5127's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, that means we request the narrowest scopes a feature needs, we use Google data only to provide the feature you enabled, we do not transfer it to others except as needed to provide that feature, to comply with law, or as part of a merger with notice to you, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security, to comply with law, or on aggregated anonymised data for internal operations.

You can revoke our access at any time in your 5127 dashboard or at your Google account permissions page. Revoking deletes the stored token and any cached Google data.

17. Cookies

We use two kinds of cookies. Strictly necessary cookies keep you signed in and hold your unsaved draft while you build a page, and these are set without consent because the site cannot work without them. Analytics cookies (Google Analytics) measure how the site is used, and these are only set after you accept them in the cookie banner. You can decline, and you can change your choice later by clearing site data in your browser.

We do not use advertising or cross-site tracking cookies.

18. Changes to this policy

We may update this policy. We will post the updated version with a new "Last updated" date, and where a change materially affects your rights we will notify account holders by email.

19. Contact and complaints

All privacy, data, and general enquiries: b@5127.ai

5127 AI
Alberta, Canada

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca. If you are in the EEA or UK, you may complain to your local supervisory authority.