Privacy policy

Information you provide

• Name, email, company, website, and later kickoff contact details.
• Project type, brief, must-haves, references, budget, deadline, visibility choice, and publication consent.
• How you found the service, such as Outbid, X, Reddit, direct, or a referral, plus limited campaign labels in the link you opened.
• Project milestone responses, approval choices, and notes you submit through the private project portal.
• Contract, support, grievance, and transaction communications.
• Consent timestamps and the policy versions accepted at checkout.

Information collected automatically

• Payment order, payment, refund, currency, amount, and status identifiers. Razorpay handles card, UPI, and bank credentials; BuildOrPass does not store full payment-card or UPI credentials.
• IP address, user-agent and request metadata, anti-spam results, security events, and sanitized application errors.
• First-party funnel events such as page viewed, form started, payment confirmed, and kickoff submitted. These use a temporary browser-session identifier and do not contain your pitch or contact details.

Sources

We receive information directly from you, from the browser or device you use, and from service providers involved in payment, hosting, email, fraud prevention, and technical operations.

Why we use it

• Perform the paid review and any steps you request before a separate project agreement.
• Process and reconcile payments, refunds, tax records, and chargebacks.
• Authenticate private and operator access, prevent fraud and abuse, and investigate failures.
• Send receipts, status links, decisions, agreement notices, and support responses.
• Comply with law and establish, exercise, or defend legal claims.
• Publish only the limited decision fields covered by an explicit anonymous or named publication choice.

Service providers and disclosures

We use Vercel for hosting, Supabase for database services, Razorpay for payments, Resend for transactional email, and Cloudflare Turnstile for abuse prevention. We disclose only the information each provider needs to perform its service. We may also disclose information to professional advisers, authorities when legally required, or a successor in a genuine business transaction subject to appropriate safeguards.

No sale or behavioural advertising

We do not sell personal information, share it for cross-context behavioural advertising, or use third-party advertising cookies. Because we do not perform that tracking, browser “Do Not Track” settings do not change the site’s behaviour. We will honour legally recognized opt-out preference signals if our practices later require it.

International transfers

The service targets customers internationally. Information may be processed in India, the United States, and other places where our providers operate. Those places may have different privacy laws. We use provider agreements and other legally available safeguards where required.

Retention

We keep information only as long as reasonably needed for the review, a signed project, security, payment reconciliation, tax and accounting, disputes, and legal obligations. Unpaid submissions may be removed sooner. Paid transaction and contract records may be kept for the applicable statutory recordkeeping period. When retention is no longer required, we delete, anonymize, or securely isolate the data.

Security

Private links use high-entropy access tokens stored as hashes, sensitive recovery material is encrypted, administrator access uses allowlisted passkeys with action-specific verification, and payment events are signature-verified. Access links are bearer credentials: anyone who obtains one may be able to view that pitch, so keep it private. No internet service can guarantee absolute security.

Your privacy rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, objection, or withdrawal of publication consent. California residents may also request the categories and specific pieces of personal information collected and information about disclosures. We do not discriminate for exercising a privacy right. We may verify your identity and authority before acting.

Requests and appeals

Email support@buildorpass.lol with the subject “Privacy request.” Include the submitted email and BOP reference, but not a password or card number. If we deny a request, reply with “Appeal” and explain why you believe the decision should change. You may also contact the privacy regulator available in your jurisdiction.

Children

BuildOrPass is a business service for people aged 18 or older. We do not knowingly collect personal information from children. Contact us if you believe a child submitted information.

Changes

We will post material changes here with a new effective date. The policy version recorded with a submission shows the notice acknowledged at checkout.

Privacy and grievance contact

Email support@buildorpass.lol with the subject “Privacy request” or “Grievance.” Include the submitted email and BOP reference, but never send a password, private key, full card number, UPI PIN, or one-time code.