Privacy Policy

Last updated: 21 July 2026

This policy explains what personal data BuyMeATea (“we”, “us”) collects at buymeatea.online, why we collect it, and the rights you have over it. It is written to align with India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data we collect

• Account data — email address (used for sign-in codes and receipts), name, and profile details you choose to add (bio, links, photo).
• Creator verification data — PAN and bank account number or UPI ID, collected because payment regulations and our payment gateway require identity verification before payouts. PAN and account numbers are stored encrypted (AES-256-GCM); staff interfaces show only masked values.
• Payment data — amount, payment method type, gateway references, and the optional name/message a supporter attaches. Card numbers and UPI PINs are never collected or stored by us — they go directly to our RBI-regulated payment gateway (Razorpay).
• Technical data — IP address, browser type and basic logs, used for security (fraud prevention, rate limiting) and debugging.

Supporters can pay without creating an account; providing your name, a message, or an email for the receipt is optional.

2. Why we process it (purposes)

• operating your account and creator page;
• processing payments, settlements, refunds and receipts;
• identity verification and fraud prevention, as required by payment regulations;
• sending transactional messages (sign-in codes, payment notifications, receipts);
• complying with tax, accounting and legal obligations.

We do not sell personal data, and we do not use it for third-party advertising.

3. Who we share it with

• Payment gateway (Razorpay) — to process payments, verify creator identity, and settle payouts;
• Email delivery provider — to send sign-in codes, receipts and notifications;
• Infrastructure providers — our servers and database are hosted in Mumbai, India (Oracle Cloud), with Cloudflare providing network security;
• Authorities — where required by law, court order, or to investigate fraud.

Public by design: a creator’s page shows their chosen display name and profile, and — unless a supporter chooses anonymity or private support — the supporter’s given name and message appear on the creator’s supporter wall.

4. How long we keep it

• Payment and payout records are retained for at least 8 years, in line with Indian tax and accounting requirements.
• Account and profile data is kept while your account is active and deleted or anonymised after account deletion, except where retention is legally required.

5. Your rights (DPDP Act)

As a data principal you can:

• request access to the personal data we hold about you;
• request correction of inaccurate data (most profile data is editable in Settings);
• request erasure of your data, subject to the legal retention obligations above (payment records cannot be erased before their statutory retention period ends);
• withdraw consent for optional processing (e.g. notification emails, via Settings);
• nominate another individual to exercise these rights if you are unable to.

To exercise any of these, email [email protected]. We aim to respond within 30 days. If you are unsatisfied with our response, you may complain to the Data Protection Board of India.

6. Security

• All traffic is encrypted in transit (TLS); the site is served via Cloudflare.
• Sensitive identifiers (PAN, account numbers) are encrypted at rest.
• Sign-in is passwordless (one-time codes and OAuth) — we never store passwords, so they cannot leak.
• Payment state changes are verified against signed gateway callbacks and webhooks.
• Encrypted database backups are stored separately from the primary server.

If a personal data breach affects you, we will notify you and the Data Protection Board as required by the DPDP Act.

7. Cookies

We use only essential cookies: a session cookie for signed-in users (HttpOnly, Secure) and security cookies set by Cloudflare. We do not use third-party advertising or tracking cookies.

8. Children

The Platform is not directed at children. Creator accounts require you to be 18 or older. We do not knowingly process children’s personal data; if you believe a child’s data has been provided to us, contact us and we will delete it.

9. Changes and contact

We will update this policy as the Platform evolves and announce material changes on the Platform or by email. Data questions: [email protected] · General support: [email protected].