Privacy policy
What data Boughtcast processes, why, and your rights over it.
Controller
Alpa Digital, Calle Mayo 1, Seville (Spain). Contact: hello@boughtcast.com.
For the data of buyers who take part in a campaign, the product's creator (the “maker”) is the controller and Boughtcast processes it on their behalf.
What we process
Makers: sign-in email, the products and campaigns you create, your payment provider tokens (stored encrypted with AES-256-GCM) and billing data handled by Polar.
Buyers: order number or purchase email, the link to your post and its public content (text, name and handle on X or Reddit), the status of your entry and, if you agree, your consent to appear on the product's wall.
Personal links: how many visits they get and which site sent them. We don't store your IP, only a temporary hashed fingerprint so the same visit isn't counted twice.
Security: hashed IP and email fingerprints to limit abuse, and an audit log of every approval and refund.
Why, and on what basis
Providing the service and verifying purchases and posts: performance of our contract with the maker.
Showing posts on the wall: your consent, which you can withdraw by writing to the maker or to us.
Preventing fraud and abuse, and keeping refunds traceable: legitimate interest.
Billing Boughtcast plans: legal obligation.
Who we share it with
Supabase (database, sign-in and files; servers in the EU, Paris), the website's hosting provider, Resend (email), Polar (plan billing) and the maker's payment provider (Polar, Dodo Payments or Stripe) to look up orders and issue refunds.
If the maker turns it on, Anthropic classifies the post type (review, tutorial…) from its public text.
Some of these providers are outside the EU; those transfers rely on the European Commission's standard contractual clauses.
We don't sell data or use it for advertising.
How long
As long as the maker's account is active. When it's deleted we remove products, campaigns and entries, except the refund audit log and billing data, which we keep as long as the law requires.
Cookies
We only use essential cookies: your session, language, selected product and a short-lived sign-in code. Light or dark theme is stored in your browser. No analytics or advertising cookies.
Your rights
You can ask for access, rectification, erasure, objection, restriction or portability by writing to hello@boughtcast.com. If you took part in a campaign you can also contact the maker. You may complain to the Spanish Data Protection Agency (aepd.es).