Privacy Notice
Last updated 5 September 2026.
Draft pending legal review. This document describes how the service currently works and is written for a US audience. It has not been reviewed by counsel and must be before launch.
BuySellPoints connects members who want to exchange loyalty points, certificates, and perks. We introduce members to each other. We do not process payments, hold funds, act as escrow, or transfer points on anyone's behalf.
What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, password (stored hashed, never in plain text), display name | To create and secure your account and confirm you control the address |
| Profile data | Display name, optional bio and avatar | So other members can see who they are dealing with |
| Listing content | Programme, quantity, expiry, restrictions, requested terms | To publish your listing in the marketplace |
| Messages | Private conversation content and timestamps | To deliver messages between members |
| Community posts | Anything you post in a public channel | To publish it; these posts are readable by anyone |
| Ratings | Scores and comments you leave about other members | To show reputation on member profiles |
| Safety records | Reports, blocks, and moderation decisions | To investigate abuse and keep a record of what was done |
| Technical data | IP address, browser type, timestamps of requests | Security, abuse prevention, and keeping the service running |
We do not collect payment card details, because transactions happen directly between members and never through this service.
Who we share it with
- Other members. Your display name, profile, listings, community posts, and ratings are visible to anyone browsing. Private messages are visible only to the members in that conversation.
- Service providers. Supabase (database, authentication, file storage), our hosting provider, and a transactional email provider used to send confirmation and password-reset messages.
- Legal and safety. Where we are required to by law, or where it is necessary to investigate abuse or protect someone from harm.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Cookies and analytics
We set cookies that are necessary for the service to work: a session cookie that keeps you signed in, and a short-lived cookie used during email confirmation. Your browser also stores whether you dismissed the site announcement. We do not use advertising cookies or third-party analytics trackers.
Retention
- Account, profile, and listing data are kept while your account is open.
- Private messages are kept until deleted. Hiding a conversation removes it from your inbox only; the other member keeps their copy, which is theirs.
- Safety records — reports, blocks, and moderation decisions — are kept after an account is deleted, with identifying fields replaced by a snapshot of what was reported. This is so a record of abuse survives the deletion of the account that caused it.
- Backups are retained on a rolling basis and are overwritten in the ordinary course. Deletion from live systems does not immediately erase data already written to a backup.
The exact retention periods are still being set and will be published here before launch. We will not promise instant erasure that backups and legal obligations prevent.
Your choices and rights
Depending on where you live in the United States — including California, Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws — you may have the right to:
- Know what personal information we hold about you and get a copy of it
- Correct information that is wrong
- Delete your account and the personal information attached to it
- Opt out of sale or sharing for targeted advertising — we do neither
- Not be discriminated against for exercising any of these rights
- Appeal a decision we make about one of these requests
You can edit your profile and delete your account from your account settings. For access, correction, or appeal requests, contact us at the address below. We will verify that the request comes from you before acting on it.
Security
Passwords are hashed and never stored in readable form. Access to messages, listings, and profiles is enforced in the database itself, so a member cannot read a conversation they are not part of. Connections to the service use HTTPS in production. No system is immune from compromise; if a breach affects your information we will notify you as required by the law of your state.
Children
This service is for adults. It is not directed to children under 13, and we do not knowingly collect their information. If we learn we have, we will delete it.
Email preferences
We send transactional email only — confirmation, password reset, and notifications about your conversations. There is no marketing email. Notification emails carry an unsubscribe link; account-security email cannot be turned off while your account is open.
Changes and contact
We will post changes to this notice here and update the date at the top. For privacy questions, or to make an access, correction, deletion or appeal request, contact support@buysellpoints.com. We will acknowledge your request and respond within the time your state's law allows.
See also our Terms of Use.