Skip to content
Buygent
Test mode: sandbox purchases only, no real charges.Sign inJoin waitlist

Privacy Policy

Last updated 2026-10-12 - applies to Buygent in test mode.

We collect the minimum the service needs - your name, email and shipping address - and never your card number. This page explains what we collect, why, who processes it, how long we keep it and the choices you have.

Scope

This policy covers buygent.io and the Buygent app in their current test release. All payment features run in a Stripe sandbox, which also limits what data exists in the first place: there is no real payment data because there are no real payments.

Data we collect

  • Account: your name and email address, received from your sign-in provider (Google or GitHub) through Clerk.
  • Shipping: the US shipping address you enter in your profile. It is used as the delivery address for demonstration purchases.
  • Waitlist: your email address and the version of the waitlist consent you accepted.
  • Sandbox activity: records of test purchases, issues you report and notifications sent to you, tied to your account.
  • Support: the messages you send us and our replies.

What we never collect

Card numbers, expiry dates or security codes (your sandbox card is issued by Stripe and is revealed only inside Stripe's hosted display, which you copy to your own agent; Buygent's servers never receive or store it, and the app shows only brand and last four digits), passwords for any merchant, date of birth, government IDs, or Social Security numbers.

How we use your data

  • To operate your account and the sandbox purchases you authorize.
  • To send the transactional email described in the Terms.
  • To keep the evidence trail for your test purchases and reported issues.
  • To keep the service safe: rate limiting and abuse prevention.

Why we may process it

We process account data to perform the service you signed up for, send transactional messages as part of that service, act on your consent when you give it (for example waitlist or billing consent), and use short-lived technical data to prevent abuse, which is a security measure in our legitimate interest.

Who receives your data

We do not sell personal data. We share data only with the processors that run the service:

  • Clerk - sign-in and account identity.
  • Stripe - sandbox payments, card issuing, subscriptions, refunds and, if you escalate an issue, card-network disputes. All in test mode.
  • Resend - delivery of transactional email.
  • Railway - application hosting.

A complaint you escalate is submitted to the external body you chose (for example the BBB or a state attorney general) only by a human Buygent operator, only after your recorded consent, and the record of that submission is kept in your issue history.

Retention and deletion

  • Sandbox purchase and issue evidence is retained while your account exists.
  • If you delete your account, your personal data is tombstoned, your API keys are revoked and no new purchase can execute. Sandbox transaction records are kept only as long as legally necessary, in de-identified form.
  • Waitlist entries are deleted on request.
  • IP addresses used for rate limiting are stored only as hashes and are not kept beyond 24 hours.

How we protect it

  • All traffic uses HTTPS.
  • API keys are stored only as keyed hashes (HMAC-SHA256 with a server-side pepper) and are displayed exactly once, when created.
  • Email cancel links use single-purpose tokens that expire and are stored only as hashes.
  • Service secrets live in a dedicated secrets vault, never in the codebase.

Your choices

  • Correct your name and shipping address any time in the app; your email address comes from your sign-in provider.
  • Cancel your subscription online at any time (refund policy).
  • Delete your account to tombstone personal data and stop all execution.
  • Ask us for a copy of your data or a correction by writing to support@buygent.io.

Contact

Privacy questions go to support@buygent.io. Related pages: Terms of Service, Refund Policy.