Privacy Policy

1.Who is responsible

Babe Pay is the controller of the personal data described here. You can contact us about privacy at access@babepay.app.

2.What we collect

Creators. Your email address, handle and display name, a password (stored only as a salted hash, never in readable form), your language, and your sign-in method. If you sign in with Google or Apple, we receive your name and email from them and an account identifier. We also keep the content you upload (photos, videos, titles, descriptions, prices), your drops' settings, your sales and balance records, and, for crypto withdrawals, the wallet addresses you add and the time you confirmed them.

Payout and identity details. When you set up card payouts, Stripe collects the identity, bank and tax details it needs. That data is held by Stripe under its own privacy policy; we receive the status and the identifiers we need to pay you.

Identity check before payouts. Before your first withdrawal or payout we ask our identity provider (Stripe Identity or Didit) to check a photo ID and a live selfie, to confirm you are a real adult and to prevent fraud and the reuse of banned accounts. The provider processes the ID images and selfie under its own privacy policy and does not send them to us. We keep only the result: the verification status, the provider's session reference, your verified legal name, your birth year (and whether you are 18 or older), your country, and when the check happened. We compare the verified name and birth year with suspended accounts to detect people returning after a ban. We keep this record while your account exists and, after it is closed, for as long as fraud prevention or the law requires, then delete it.

Buyers. The email address you enter at checkout, the drop you bought, the amount, the date, the source of the visit (for example which link or site sent you), your language, and a random access token. For crypto payments we also record the deposit address created for your order, the amount, the transaction hash and the time. We do not receive or store your card number.

Devices. When you open an access link we set a cookie that identifies your device for that purchase (limited to 3 devices) and we store the device identifier, the last IP address that used it and the time it was last used. We use this to enforce the device limit and to protect creators against sharing and fraud.

Visitors. When someone opens a public drop page we count a view with the drop, the time and a source label taken from the link's tag or the referring site. We do not store the visitor's IP address or a persistent identifier for this count, and we skip visits from obvious bots.

Technical data. Our servers and our hosting providers keep standard logs (such as IP address, browser type, pages requested and errors) for security, abuse prevention and fixing problems.

When you write to us or report content. The emails and information you send us, and the details of each report (reason, text, optional email, and a hashed form of your IP address that we use only to limit abuse).

3.What we do not do

We do not sell your personal data. We do not use advertising or cross-site tracking cookies, and we do not use third-party advertising or analytics trackers on Babe Pay. We do not build profiles about you to sell to others.

4.Why we use your data, and our legal bases

• To provide the service: create accounts, host and deliver content, process orders, send access links, show creators their sales and pay them. (Performance of a contract.)
• To keep Babe Pay safe: prevent fraud, abuse, chargeback abuse and unauthorised sharing, enforce the device limit, handle reports and screen payments or addresses where required. (Our legitimate interests, and legal obligations.)
• To give creators simple analytics about views, sources and sales. (Our legitimate interests and the creator's.)
• To send service emails such as access links, security codes and important changes. We do not send marketing email without your agreement. (Performance of a contract, legitimate interests, or consent.)
• To meet legal duties: tax, accounting, sanctions, responses to lawful requests and removal of illegal content. (Legal obligation.)
• To improve and fix Babe Pay. (Legitimate interests.)

5.Cookies and similar storage

We use only what is needed to run Babe Pay. We do not use advertising or analytics cookies, so we do not show a cookie banner.

• Session cookie (pp_session): keeps creators signed in, up to 30 days.
• Access cookie: identifies a buyer's device for a purchased drop, up to 1 year.
• Language cookie (NEXT_LOCALE): remembers your language, 1 year.
• Temporary sign-in cookies: protect Google or Apple sign-in and onboarding, and last only a few minutes.
• Browser storage (pp-crypto-pref): remembers the last coin and network you picked for crypto checkout. It contains no personal data.

Our hosting or security providers may also set technical cookies to protect the service. You can block cookies in your browser, but then sign-in and access links will not work.

6.Who we share data with

We share data only with providers that help us run Babe Pay, under agreements that limit how they can use it, and with others where the law requires or where you ask us to. These are the types of provider we use or plan to use at launch:

• Payments: stablecoin checkout on public blockchains. Card payments are not offered yet.
• Identity verification: Stripe Identity or Didit (ID document and selfie check before creator payouts).
• Email: Resend (sending access links and security emails).
• Hosting and storage: Render (application and database) and Cloudflare (file storage and delivery, security).
• Sign-in: Google and Apple, if you choose them.
• Blockchain infrastructure: node and data providers that read public blockchain networks for crypto payments, and compliance providers that screen wallet addresses where we are required to.
• Professional advisers, and authorities or courts when the law requires or to protect rights and safety.

Creators see their buyers. A creator can see the email address, amount, date and source of each purchase of their drops. Buyers see the creator's public handle, display name and drop details. Please do not use a buyer's email for anything except supporting their purchase.

If Babe Pay is sold or reorganised, personal data may be transferred to the new owner under this policy.

7.Public blockchains

Crypto payments are recorded on public blockchains. Those records, including wallet addresses and amounts, are public and cannot be changed or deleted by us or anyone else. Do not use a wallet that you do not want linked to your Babe Pay purchase.

8.International transfers

Babe Pay is run from Israel and the United States and uses providers in several countries, so your data may be processed outside your country, including in the United States and the European Economic Area. Where the law requires it, we use safeguards such as standard contractual clauses or equivalent mechanisms.

9.How long we keep data

We keep personal data only as long as we need it for the purposes above.

• Creator account data: while your account is open, and afterwards only what we need for legal, tax, fraud-prevention and dispute purposes.
• Purchase records, buyer email, access devices and the content that was sold: as long as buyers need access to what they bought, and then as required for legal, tax and accounting purposes.
• View counts: kept as aggregated statistics tied to the drop.
• Support emails: as long as needed to handle your request and any follow-up.

Backups are overwritten on a regular schedule.

10.Security

We protect data with measures such as encrypted connections, hashed passwords, signed session cookies, access controls on files (originals are only served to authorised buyers and owners), and removal of location and camera metadata from uploaded photos. No system is perfectly secure, so we cannot guarantee absolute security. Tell us at access@babepay.app if you find a problem.

11.Your rights

Depending on where you live (for example the EU or UK under the GDPR, Israel under the Protection of Privacy Law, or California and other US states), you may have the right to: access your data, correct it, delete it, restrict or object to some processing, receive a portable copy, withdraw consent that you gave, and not be discriminated against for using your rights.

To use a right, email access@babepay.app from the address on your account or purchase so we can verify you. We reply within the time the law requires, usually within 30 days. Some data we must keep (for example sales records, and content that buyers have paid to access), and we will explain if we cannot do what you ask.

We do not "sell" or "share" personal data for cross-context advertising as those words are defined in California law. If you are in the EU or UK and believe we handle your data unlawfully, you can complain to your local data protection authority. In Israel you can contact the Privacy Protection Authority.

12.Children

Babe Pay is for people 18 and older. We do not knowingly collect personal data from anyone younger. If you think a child has used Babe Pay, contact us at access@babepay.app and we will delete the data.

13.Changes

We may update this policy. We will post the new version with its date and, for important changes, tell you by email or in the product.

14.Contact

Babe Pay. Email: access@babepay.app.