Privacy Policy

Account information: email address, role, username, display name, profile image, authentication identifiers, and account status.

Creator information: biography, public handle, page settings, cover image, posts, membership tiers, perks, Razorpay setup status, encrypted payment credentials, and platform-plan status.

Support and membership information: creator and supporter identifiers, amount, currency, tier, message, payment status, provider order/payment/subscription IDs, renewal and cancellation state, receipts, and webhook event references.

Communications and activity: comments, direct messages, support requests, moderation records, login events, device/browser information, IP address, timestamps, diagnostic logs, and abuse-prevention signals.

Payment methods are entered into Razorpay Checkout and processed by Razorpay. BuyATreat does not intentionally collect or store complete card numbers, CVV values, UPI PINs, or online-banking passwords.

We receive transaction metadata needed to create orders, verify signatures, activate access, prevent duplicate fulfillment, show receipts, support cancellations, reconcile records, and investigate disputes.

Creators enter Razorpay API credentials to connect their own accounts. Secret values are encrypted on the server and are not displayed back after setup. Public key identifiers and limited last-four status information may be shown to the relevant creator.

We use information to create and secure accounts; publish creator pages; process and reconcile tips, memberships, and SaaS subscriptions; provide paid access; deliver messages; enforce plan limits; prevent fraud and abuse; respond to support; maintain records; comply with law; and improve reliability.

We do not sell personal information. We do not use creator payment secrets for any purpose other than operating the creator-authorized Razorpay integration.

Creator handles, display names, profile and cover images, biographies, public posts, tiers, perks, and public supporter messages may be visible to anyone. Do not publish information you want to keep private.

A creator may receive information about people who support or subscribe to them, including names, account identifiers, email addresses where available, transaction amounts, membership status, and messages. Creators must use this information only to administer that relationship and must comply with applicable privacy and marketing laws.

We share information only as needed with infrastructure, authentication, email, security, and payment providers; with the creator involved in your transaction; with professional advisers and contractors under confidentiality duties; during a lawful business transfer; or when required to comply with law, enforce our terms, prevent fraud, or protect people and systems.

Key providers currently include Razorpay, Supabase, Vercel, Cloudflare Turnstile, and enabled sign-in providers such as Google. Their handling of data is governed by their own policies.

BuyATreat uses essential cookies and browser storage for authentication, security, preferences, checkout continuity, and core functionality. Blocking essential storage may prevent login or payment flows from working.

If we later introduce non-essential advertising or analytics technologies that require consent, we will provide appropriate notice and controls before using them.

We use measures such as access controls, row-level database policies, encryption of creator secrets, signed sessions, payment signature verification, rate limiting, abuse checks, security headers, logging, and restricted server credentials.

No internet service can guarantee absolute security. Protect your password and API credentials, use unique secrets, and contact us promptly if you suspect unauthorized access. Never send us your password, card details, UPI PIN, or Razorpay secret in ordinary email.

We retain information while your account is active and as needed to provide the service. After deletion or closure, we may retain financial, reconciliation, fraud-prevention, security, backup, dispute, and legal records for the period reasonably required by law and legitimate operational needs.

Deleting an account does not automatically cancel recurring Razorpay subscriptions. Cancel subscriptions first. Some public or shared content may remain temporarily in caches, backups, audit records, or copies made by other users.

You may update available profile information from your settings and manage memberships from the member workspace. Subject to applicable law, you may request access, correction, deletion, restriction, or a copy of information associated with your account.

We may need to verify your identity before completing a request. Some information cannot be deleted immediately where retention is required for payments, security, disputes, or legal obligations.

Our providers may process information in India and other countries where they operate, subject to their safeguards and applicable law.

BuyATreat is not intended for children. Users must be at least 18 years old. Contact us if you believe a child has provided personal information.

We may update this policy as our services, providers, or legal obligations change. We will publish the revised date and provide additional notice where required.

For privacy questions or requests, email support@buyatreat.com. Include the email associated with your account and describe your request clearly.

Use of BuyATreat is also governed by our Terms of Service.