Privacy without the mystery.
This notice explains what BuyerProof processes, why, and where the data goes. We use privacy-minimized first-party product analytics and intentionally avoid advertising or cross-site marketing trackers.
1. Controller
Sylvia Singh, sole proprietor, operating BuyerProof™ / THE LAZY AI METHOD™.
Email: thelazyaimethod@gmail.com
Postal correspondence: Postfach 20 12 12, 20212 Hamburg, Germany.
2. Data we process
- Account and authentication data: email address, account identifier, verification/session data and, if you choose to add one, passkey-related authentication records managed by the hosting/auth platform.
- Free-check eligibility: a one-way hash derived from your verified account email, a temporary request token and reservation expiry, and a completion timestamp. The current free-check limit follows your verified account rather than a shared network address. Earlier free-check records may contain browser/network identity hashes and buyer-path hashes.
- Abuse prevention: a pseudonymized hash derived from the requesting network address plus attempt timestamps for rate limiting.
- Buyer-path check data: the URL you submit is processed to perform the requested check. The free-tier eligibility record is designed not to retain the raw submitted buyer URL after a conclusive check; the completed verified-account eligibility hash enforces the one-free-check rule. Earlier records and optional PASS receipts may also contain a one-way path hash. If you use BuyerProof Watch, the monitored URL, expected outcome, current verdict, check timestamps and your notification email are stored while that Watch path remains active so automatic rechecks and alerts can operate.
- Technical and first-party product analytics: request/function logs for reliability and security, plus a random session identifier, page/event name, timestamp, referrer hostname and explicit UTM campaign parameters where present. We do not intentionally store raw buyer URLs, email addresses or full referrer URLs in the analytics event table.
- Billing data: if you subscribe, Stripe / Sold through Link processes payment, billing, tax and transaction information. BuyerProof does not receive or store full card details.
- Support communications: information you send to our support email.
3. Why we process it
We process data to provide requested checks and paid monitoring, authenticate users, enforce the one-time free check, prevent abuse, secure and debug the service, understand whether the product funnel is working, improve the service, administer subscriptions, respond to support requests and comply with legal obligations. Depending on the context, the legal bases under the GDPR are performance of a contract or pre-contractual steps (Art. 6(1)(b)), legitimate interests in operating and securing the service and preventing abuse (Art. 6(1)(f)), and compliance with legal obligations (Art. 6(1)(c)).
4. Hosting, authentication and infrastructure
BuyerProof is hosted on Hatchable, which provides application hosting, database, authentication, browser automation and related infrastructure used by the service. Data required for those functions is processed through that infrastructure on our behalf or as otherwise described by the provider’s applicable privacy terms.
5. Stripe / Sold through Link
Payments and subscriptions are processed through Stripe. For transactions using Stripe Managed Payments, Sold through Link, LLC may act as merchant of record for eligible transactions and process payment, tax, fraud, dispute and transaction-support data. Stripe and its affiliates process personal data under their own applicable privacy terms for those functions. We receive only the billing/subscription information necessary to administer BuyerProof.
6. Submitted destination providers
When you ask BuyerProof to check a Google, Canva or other buyer link, our browser infrastructure must contact that destination to perform the check. The destination provider therefore receives a request from the monitoring infrastructure. Do not submit private admin URLs, passwords, personal customer records or links that expose more information than a normal buyer should receive.
7. Support email
Support mail sent to thelazyaimethod@gmail.com is processed through Google’s Gmail service. Only send information necessary to resolve your request.
8. Cookies, session storage and analytics
The service uses technically necessary authentication/session technologies for paid-account sign-in and secure product operation. BuyerProof records simple server-side product-funnel events such as page visits, free-check starts, completed checks and checkout clicks without assigning a persistent analytics identifier to the visitor. We do not intentionally use advertising pixels, cross-site marketing trackers or analytics cookies. If we later add non-essential browser-based analytics or marketing technologies, the consent approach will be reviewed before deployment.
9. Retention
Account and subscription data is retained while needed to provide the service and meet legal obligations. Free-check anti-abuse records may be retained only as needed to prevent repeated free use and protect the service. Raw buyer URLs are not intentionally retained in the free-check eligibility record after a conclusive run. When a Launch Pass or paid monitoring access ends, automatic checks stop. Saved monitored URLs, status, alerts and check-history data are kept for up to 30 days so the account can be reactivated without rebuilding the Watch list; after that period the monitoring data and local BuyerProof account are deleted. BuyerProof does not retain a separate marker solely to block future Launch Pass purchases. Minimal billing, eligibility and statutory accounting records may remain where required. Abuse-prevention attempt records are short-lived operational data. First-party analytics events are retained for up to 180 days and then automatically deleted.
10. International processing
Some service providers may process data outside Germany or the EEA. Where applicable, transfers are handled using the safeguards made available by the relevant provider and required under applicable data-protection law.
11. Your rights
Subject to the applicable conditions, you may have rights of access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a competent data-protection supervisory authority. To exercise a right, contact thelazyaimethod@gmail.com.
12. Automated decisions
BuyerProof produces automated technical check results, but we do not use those results to make decisions that produce legal effects or similarly significant effects about individuals.
13. Changes
We may update this policy as the service or provider stack changes. The version date below identifies the current notice.
14. Get Featured submissions and image licences
If you submit artwork for optional editorial featuring, we process your submitted name or brand, contact email, optional social handle, product/campaign title, optional or required buyer link, selected check type, artwork and a smaller image preview, image metadata, recorded rights declarations and optional separate social-use permission. We also store a pseudonymous network-address hash for anti-spam rate limiting and application/status timestamps. The artwork is compressed to WebP in your browser before upload. Original selected files are not intentionally uploaded. The submitted preview and artwork stay private in our application database until a reviewer approves publication.
Where a buyer link is supplied, BuyerProof may run an internal check and record its technical verdict, explanation and timestamp without using your public free-check entitlement. A published feature may display your credited name, handle, artwork, product name, public submitted link and, only after a verified point-in-time PASS, the date of the check. Inconclusive, failed, rejected and withdrawn submissions are not published. The verification badge remains subject to withdrawal and must not be read as continuing certification.
We process the application data to deal with your voluntary request and the associated revocable website-display licence (Art. 6(1)(b) GDPR where applicable), operational security and abuse prevention (Art. 6(1)(f)), and the independently optional social-publication preference only after your affirmative choice (Art. 6(1)(a) where consent is the appropriate basis). You may withdraw optional social consent at any time without affecting the legitimacy of previous processing. The website-display licence is separately revocable. No advertising analytics or third-party marketing profiles are created from applications. The service is hosted by Hatchable; published images may be cached for delivery.
Pending, under-review and declined submissions are automatically removed after 90 days. Withdrawn records are removed after 30 days, and image payloads are removed promptly on revocation. Approved materials remain only while the feature is published or as otherwise legally required. For access, correction, revocation, withdrawal or erasure contact thelazyaimethod@gmail.com. Your other GDPR rights are described above. Do not upload sensitive documents, personal customer data or media without the depicted person's permission.