Privacy policy

Bowyy (“we”, “us”, or “our”) operates a marketplace that connects content creators with buyers of future revenue receivables (each such buyer, referred to elsewhere on the platform as an “investor”). This Privacy Policy explains how we collect, use, and protect your personal information when you use the platform.

By using the Service, you agree to the collection and use of information in accordance with this policy. Capitalized terms not defined here have the meanings given in our Terms of Service.

Account information. When you create an account we collect your name, email address, and authentication credentials (or your Google account identifier if you sign in with Google).

Application data (creators). When you apply for financing we collect information about your business, revenue history, use of funds, and any documentation submitted as part of the application.

Connected-platform analytics. With your permission, we access analytics from connected platforms (YouTube, Patreon, Twitch, Instagram) including views, subscriber counts, and revenue figures. We access only the minimum data required for underwriting.

Identity verification (KYC). Both creators receiving funding and buyers purchasing receivables go through identity verification handled by Stripe Identity. We receive verification status and identifiers from Stripe; we do not store government ID images on our servers.

Bank and payment data. We collect bank-account information for ACH disbursements (to creators) and ACH debits (from buyers funding purchases), handled through Stripe's Connect and Financial Connections products. We do not store full bank account numbers or card numbers; Stripe holds those.

Legal acceptance records. When you accept the Terms of Service or Privacy Policy through the platform, we record the versions you accepted and the timestamp of acceptance. We use this to determine whether to prompt you to re-accept after a material update.

Transaction data. For active financing arrangements we record monthly revenue you report, the resulting repayment amounts, payment status, and the lifetime ledger of disbursements and repayments. For buyers we record purchase commitments, expected return, and amounts returned.

Tax data. Where required by law (for example, IRS Form 1099-K or 1099-MISC), we collect taxpayer identification information and issue informational tax forms.

Usage data. We automatically collect information about how you interact with the platform, including pages visited, features used, and device information.

We use the information we collect to:

• Evaluate financing applications and generate offers
• Display marketplace listings (creator category, platform, deal economics) to eligible buyers
• Process disbursements to creators and repayments back to buyers
• Send transaction confirmations and account notifications by email and in-app
• Determine whether you have accepted current versions of the Terms and Privacy Policy
• Provide customer support
• Improve the platform and develop new features
• Comply with legal, tax, and anti-fraud obligations

We do not sell your personal information to third parties.

Service providers. We share data with trusted third-party services that help us operate the platform, including Supabase (database and authentication), Stripe (payments, identity verification, bank connections), DocuSign (contract execution), Resend (transactional email), PostHog (product analytics), Vercel (hosting), and Cloudflare (bot protection on forms via Turnstile — see Cloudflare's Turnstile privacy policy). These providers are contractually bound to protect your data and use it only to provide services to Bowyy.

Buyers (investors). Buyers evaluating a receivable on the marketplace can view aggregated revenue history, underwriting score, category, and platform information for the deal. Personally identifying information (full legal name, email, phone, bank details) is never shared with buyers. We share only the information necessary to evaluate the purchase opportunity.

Creators. Creators do not see the identity of individual buyers funding their deal — they see aggregate funding status and progress.

Legal requirements. We may disclose your information if required by law, court order, or in response to valid legal process, and where reasonably necessary to investigate fraud or protect the rights and safety of Bowyy users.

When you connect a third-party platform (YouTube, Patreon, Twitch, Instagram), we access analytics data via their official APIs. We request only the permissions necessary for underwriting and do not post to, modify, or take any action on your connected accounts.

You can disconnect any connected account at any time from your account settings. Disconnecting does not affect existing financing arrangements but may affect future applications.

Connected platform data is stored for the duration of your account. You may request deletion at any time, subject to the retention exceptions in Section 7.

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, role-based access controls, row-level database security for user-owned data, and regular security reviews.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your personal data for as long as your account is active or as needed to provide services. Transaction records, signed Revenue Financing Agreements, Receivables Purchase Agreements, and related financial data are retained for a minimum of 7 years to comply with financial-recordkeeping requirements.

When you close your account, we mark your profile as closed and within 90 days delete or anonymize personal data not subject to the retention requirements above. Closed accounts cannot be reopened.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data, subject to our retention obligations
• Portability: Request your data in a portable format
• Objection: Object to certain types of processing

To exercise any of these rights, contact us at privacy@bowyy.com.

Essential cookies. We use cookies to keep you signed in and to secure your session. These are required for the platform to function and cannot be disabled while you're using the Service.

Bot protection (Cloudflare Turnstile). Sign-up and contact forms are protected against automated abuse by Cloudflare Turnstile. Turnstile may run invisibly and analyse browser characteristics, IP address, and interaction signals to distinguish humans from bots. Cloudflare may set cookies as part of this process. See Cloudflare's Turnstile privacy policy.

Analytics cookies (optional). With your consent we use PostHog to understand how the platform is used — which pages are visited, where users get stuck, and which features get used. PostHog may set cookies in your browser to support this.

On your first visit you'll see a cookie banner where you can Accept or Reject analytics cookies. Your choice is stored locally in your browser. You can change your choice at any time using the “Cookie preferences” link in the footer.

You can also control cookies through your browser settings. Disabling essential cookies will prevent you from staying signed in.

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at privacy@bowyy.com.

We may update this Privacy Policy from time to time. When we make material changes we update the “Last updated” date above and may prompt you to re-accept the updated policy when you next sign in. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, contact us at privacy@bowyy.com.