Privacy Policy

If you create a page

• From Google, when you sign in: your name, email address, profile photo, and Google’s ID for your account. We never see your Google password.
• What you add: your page name and link, bio, photo, payment QR image, payment phone number (optional), prices and menu, and replies to supporters.
• Checkout (Beta): your eSewa merchant product code and secret key. The secret is encrypted (AES-256-GCM) before it is stored, and is never shown back to you in full.
• Record keeping: when your account was made, and when you agreed to our terms.

If you support someone

• The amount and menu item, and the name and message you chose to leave (both optional).
• Whether you tapped “I’ve paid”, or, for Checkout, eSewa’s transaction reference and whether eSewa confirmed it.
• We don’t get your wallet, bank or card details. Those stay with your payment app and eSewa.

If you visit a page

• Page views, menu clicks and QR views, so creators can see their numbers. Each event keeps a one-way hash of your IP address (salted, cut short, and not reversible to the IP) and your browser’s user-agent string.
• Counts of how many people open the sign-up page and finish it, with nothing that identifies you.

We use only the cookies the site needs to work, never advertising or tracking cookies:

• bms_session keeps you logged in, for up to 30 days.
• bms_oauth secures the trip to Google and back, for 10 minutes.
• bms_pending holds a sign-in while you pick your link, for 30 minutes.

Your light or dark mode choice is saved in your browser’s local storage and never sent to us.

A creator page exists to be seen, so anyone with the link can see: the creator’s name, link, bio and photo, their payment QR code and payment phone number if they added them, their menu and prices, and the supporter wall (supporters’ names or “Anonymous”, messages, amounts, and the creator’s replies). Creators can hide or delete any supporter note.

Creators: a QR code can show the name and number of the account behind it. Only add what you’re happy for anyone to see.

• To run your page and your dashboard, and to show supporters where to pay.
• To send supporters to eSewa, and confirm their payments, if you use Checkout.
• To show creators their visits and supporters.
• To keep the site safe: stopping abuse, handling reports, and taking down pages that break the Terms.

We don’t sell personal information, show ads, or use it for anything other than these. We wouldn’t know how to sell it anyway.

• Google, to sign you in.
• eSewa, when a supporter uses Checkout: the amount, the creator’s product code and a transaction reference.
• Our hosting provider, which stores the database and uploaded images for us.
• Authorities, when Nepali law requires it: for example a court order, or a lawful request from Nepal Rastra Bank, the Inland Revenue Department or the police. Transaction records about a creator’s page may be part of that.

We keep your account and page for as long as you have them. When you delete your account, we delete your profile, QR code, photo, menu, Checkout keys, supporter records and visit counts, unless the law requires us to keep something longer. Logins end after 30 days, and unfinished sign-ins expire after 30 minutes.

You can ask us to show you the personal information we hold about you, correct it, or delete it. You can also withdraw your consent at any time, which means closing your account. Supporters can ask us to remove their name and message from a page. Most of this you can do yourself in the dashboard. For anything else, email hello@buymesutta.com from the address you signed in with. We’ll answer within 30 days.

Traffic to the site is encrypted (HTTPS). Session cookies can’t be read by scripts, Checkout secrets are encrypted at rest, and only you and our administrators can see your dashboard data. No system is perfectly secure. If a breach affects your information, we’ll tell you.

BuyMeSutta is for people aged 18 and over. We don’t knowingly collect information from anyone younger. If you think a minor has made a page, tell us and we’ll remove it.

If this policy changes, we’ll change the date at the top, and for significant changes we’ll tell creators first. Questions or requests: hello@buymesutta.com.