BuPay Logo
BuPaySmart Team Payments

Privacy Policy

Last updated: July 2026

1. Introduction

Welcome to BuPay. We are committed to protecting your privacy and handling your personal data with transparency and care. This Privacy Policy explains how we collect, use, store, and protect your information when you use our sports team and payment management platform.

We never sell your data. Your personal information is kept strictly confidential and used only to provide and improve our services.

2. Information We Collect

We collect the following types of information:

2.1 Information You Provide

  • Account Information: Name, email address, and authentication credentials managed through Clerk (our third-party authentication provider)
  • Profile Information: Team affiliations, player profiles, and organizational roles
  • Payment Information: Payment details are collected and processed securely by Stripe (our payment processor). We do not store complete credit card or PayPay payment details on our servers. If you save a card for automatic payments, we store only the card brand and last four digits
  • Communications: Email address for waitlist, notifications, and LINE account information for payment notifications
  • Financial Data: Transaction history, invoices, and payment records necessary for team management

2.2 Information Collected Automatically

  • Technical Data: IP address, browser type and version, device information, and operating system
  • Usage Data: How you interact with our platform, pages visited, features used, and time spent on the platform
  • Cookies: We use cookies to enhance your experience and maintain session information

3. How We Use Your Information

We use your personal data for the following purposes:

  • Service Delivery: To provide team management, payment processing, invoicing, and member communication features
  • Account Management: To create and maintain your account, authenticate users, and manage profiles
  • Payment Processing: To facilitate payments between team members and organizers through our Stripe integration
  • Communications: To send payment notifications via LINE, email reminders, and service updates
  • Platform Improvement: To analyze usage patterns, fix bugs, and develop new features
  • Security: To detect and prevent fraud, unauthorized access, and other security threats
  • Legal Compliance: To comply with applicable laws, regulations, and legal processes

4. Third-Party Services

We use trusted third-party service providers to deliver our platform. Your data may be shared with:

4.1 Clerk (Authentication)

We use Clerk to manage user authentication and account security. Clerk processes your email address, password, and authentication tokens. Clerk's privacy policy is available at here.

4.2 Stripe (Payment Processing)

All payment processing is handled by Stripe, a PCI-DSS compliant payment processor. Stripe processes payment card information, PayPay transactions, and bank account details. We never store complete payment card details on our servers. Stripe's privacy policy is available at here.

4.3 LINE Integration

If you choose to connect your LINE account for payment notifications, we will receive your LINE user ID to enable this functionality. This is optional and can be disconnected at any time.

4.4 Google Cloud Platform (Hosting & Storage)

Our application, databases, uploaded files, and system logs are hosted on Google Cloud Platform servers located in the Tokyo, Japan region.

4.5 Resend (Email Delivery)

We use Resend to deliver transactional emails such as payment notifications and receipts. Resend processes recipient email addresses and message content, and is based in the United States.

4.6 Expo (Mobile Push Notifications)

If you use the BuPay mobile app and enable push notifications, your device push tokens are processed by Expo's notification delivery service (based in the United States) to deliver notifications to your device.

4.7 Upstash (Job Queue & Cache)

We use Upstash-managed Redis to queue background jobs such as notifications and report generation. Notification and report data may be held transiently in this queue while it is being processed, and may be processed outside Japan.

4.8 Website Analytics and External Transmission

Our marketing website (bupay.jp) uses the following analytics tools. When you visit the website, information such as pages viewed, referrer, device and browser information, and identifiers is transmitted to these providers:

  • Google Analytics (Google LLC): website usage statistics
  • PostHog: page view and product analytics events
  • Vercel Analytics: website performance and visit statistics

The BuPay app itself (your dashboard and payment screens) uses no third-party analytics or advertising trackers, only the cookies required for sign-in sessions (Clerk).

5. Data Storage and Security

We implement industry-standard security measures to protect your personal data:

  • All data is stored on secure servers with encryption at rest and in transit (TLS/SSL)
  • Access to personal data is restricted to authorized personnel only
  • We use PostgreSQL databases with regular backups and security updates
  • Payment data is processed through Stripe's PCI-DSS compliant infrastructure
  • We conduct regular security audits and monitoring for unauthorized access

While we implement robust security measures, no system is completely secure. We cannot guarantee absolute security of data transmitted over the internet.

6. Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations:

  • Active Accounts: We retain your data while your account is active
  • Financial Records: Transaction and invoice data is retained for 7 years to comply with tax and accounting regulations
  • Account Deletion: You may request deletion of your account and personal data at any time by contacting privacy@bupay.jp. We will delete or anonymize your personal data within 30 days of your request, except for financial records we are required to retain by law

7. We Do Not Sell Your Data

BuPay never sells, rents, or trades your personal information to third parties for marketing purposes.

Your data is kept strictly confidential and used only to:

  • Provide and improve our services
  • Process payments through our payment processor (Stripe)
  • Authenticate users through our authentication provider (Clerk)
  • Comply with legal obligations

We will never use your data for advertising purposes or share it with data brokers.

8. Your Privacy Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your personal data (subject to legal retention requirements)
  • Data Portability: Request a copy of your data in a machine-readable format
  • Objection: Object to certain processing of your data
  • Withdrawal of Consent: Withdraw consent for optional features like LINE notifications

To exercise these rights, please contact us at the details provided in Section 12.

9. Children's Privacy

BuPay is designed for teams and organizations that include minors (such as youth sports teams). Parent or guardian accounts can manage profiles for their children. We do not knowingly collect personal information directly from children under 13 without parental consent.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately.

10. International Data Transfers

All primary data, our databases, uploaded files, and backups, is stored on servers located in Japan (Google Cloud Platform, Tokyo region).

Some of the third-party providers listed in Section 4 process specific personal data outside Japan, primarily in the United States: Clerk (authentication data), Stripe (payment and identity verification data), Resend (email addresses and message content), and Expo (mobile push notification tokens). Queue data processed by Upstash may also be held outside Japan. We only work with providers that maintain data protection standards consistent with this Privacy Policy and applicable Japanese law, and we disclose these overseas transfers in accordance with the Act on the Protection of Personal Information (APPI).

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email or through a notice on our platform. The 'Last updated' date at the top of this policy indicates when it was last revised.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Email: privacy@bupay.jp
  • Support: support@bupay.jp

We will respond to your inquiry within 30 days.