Privacy Policy

1. Introduction

ByModel ("we," "us," "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website at bymodel.io and related services. By using ByModel, you consent to the practices described in this policy.

2. Information We Collect

Account information: When you create an account, we collect your name, email address, and password. Seller accounts also include username, payment method preferences, and payout details.

Payment information: Card payments are processed by Stripe. We do not store your full card number, CVV, or expiration date. Stripe handles all payment data in compliance with PCI-DSS standards.

Order information: We store records of your purchases, including model details, amounts paid, payment method, and download history.

Usage data: We collect standard analytics including pages visited, browser type, device type, and IP address to improve the platform experience.

Affiliate tracking: If you arrive via a referral link, we store a cookie with the affiliate code for attribution purposes (30-day duration).

3. How We Use Your Information

To process purchases and deliver content packs to your Content Library.

To send transactional emails: order confirmations, seller notifications, listing approvals, and payout confirmations via Resend.

To manage seller accounts, process payouts, and track earnings.

To attribute affiliate referrals and calculate commissions.

To improve the platform, fix bugs, and analyze usage patterns.

To enforce our Terms of Service and prevent fraud.

4. AI-Powered Features

When a seller's content is approved, we use Google Gemini AI to automatically generate tags, captions, and content categories for each asset. This analysis is performed on the content pack files only — not on any personal data. The generated metadata is stored in our database and displayed to buyers in the Content Library.

5. Data Storage & Security

Account data and order records are stored in Supabase (PostgreSQL) with Row Level Security — users can only access their own data.

Content pack files are stored in Cloudflare R2 with private access. Downloads use time-limited signed URLs.

Preview images are stored in Supabase Storage with public access for marketplace browsing.

All data transmission is encrypted via HTTPS/TLS. We use industry-standard security practices to protect your information.

6. Third-Party Services

Stripe — payment processing (card payments, webhook events).

Supabase — database, authentication, and file storage.

Cloudflare R2 — private content pack storage and delivery.

Resend — transactional email delivery.

Google Gemini — AI content analysis (tags, captions, categories).

Vercel — website hosting and deployment.

Each third-party service has its own privacy policy. We only share the minimum data required for each service to function.

7. Cookies

Authentication cookies: Used to keep you logged in. Essential for the platform to function.

Affiliate tracking cookies: HTTP-only cookies that store a referral code for 30 days to attribute sales to affiliates.

We do not use advertising cookies or third-party tracking pixels.

8. Data Retention

Account data is retained for as long as your account is active.

Order records and Content Library access are retained permanently — buyers have lifetime access to purchased content.

If you delete your account, your personal data will be removed within 30 days. Anonymized order records may be retained for financial reporting.

Affiliate click data is retained for 90 days for attribution purposes.

9. Your Rights

Access: You can view your personal data in your account dashboard at any time.

Correction: Contact us to update any inaccurate personal information.

Deletion: Request account deletion by emailing hello@bymodel.io. Note that deleting your account will revoke access to purchased content.

Data export: Request a copy of your personal data by emailing hello@bymodel.io.

10. Children's Privacy

ByModel is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a user is under 18, we will terminate their account and delete their data.

11. International Users

ByModel is operated from the United Kingdom. By using our platform, you consent to the transfer of your data to the UK and processing in accordance with this policy. We comply with applicable data protection laws including UK GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of ByModel after changes constitutes acceptance.

13. Contact

For privacy-related questions or requests, contact us at hello@bymodel.io.