Privacy Policy

1Introduction

Welcome to BuPay. We are committed to protecting your privacy and handling your personal data with transparency and care. This Privacy Policy explains how we collect, use, store, and protect your information when you use our sports team and payment management platform.

2Information We Collect

We collect the following types of information:

2.1 Information You Provide

• Account Information: Name, email address, and authentication credentials managed through Clerk (our third-party authentication provider)
• Profile Information: Team affiliations, player profiles, and organizational roles
• Payment Information: Payment details are collected and processed securely by Stripe (our payment processor). We do not store complete credit card or PayPay payment details on our servers. If you save a card for automatic payments, we store only the card brand and last four digits
• Communications: Email address for waitlist, notifications, and LINE account information for LINE login and account linking
• Financial Data: Transaction history, invoices, and payment records necessary for team management

2.2 Information Collected Automatically

• Technical Data: IP address, browser type and version, device information, and operating system
• Usage Data: How you interact with our platform, pages visited, features used, and time spent on the platform
• Cookies: We use cookies to enhance your experience and maintain session information

3How We Use Your Information

We use your personal data for the following purposes:

• Service Delivery: To provide team management, payment processing, invoicing, and member communication features
• Account Management: To create and maintain your account, authenticate users, and manage profiles
• Payment Processing: To facilitate payments between team members and organizers through our Stripe integration
• Communications: To send app push notifications, email reminders, and service updates
• Platform Improvement: To analyze usage patterns, fix bugs, and develop new features
• Security: To detect and prevent fraud, unauthorized access, and other security threats
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

4Third-Party Services

We use trusted third-party service providers to deliver our platform. Your data may be shared with:

4.1 Clerk (Authentication)

We use Clerk to manage user authentication and account security. Clerk processes your email address, password, and authentication tokens. Clerk's privacy policy is available at here.

4.2 Stripe (Payment Processing)

All payment processing is handled by Stripe, a PCI-DSS compliant payment processor. Stripe processes payment card information, PayPay transactions, and bank account details. We never store complete payment card details on our servers. Stripe's privacy policy is available at here.

4.3 LINE Integration

If you choose to link your LINE account, we will receive your LINE user ID to enable this functionality. Linking lets you check your payment status and upcoming games from LINE. This is optional and can be disconnected at any time.

4.4 Google Cloud Platform (Hosting & Storage)

Our application, databases, uploaded files, and system logs are hosted on Google Cloud Platform servers located in the Tokyo, Japan region.

4.5 Resend (Email Delivery)

We use Resend to deliver transactional emails such as payment notifications and receipts. Resend processes recipient email addresses and message content, and is based in the United States.

4.6 Expo (Mobile Push Notifications)

If you use the BuPay mobile app and enable push notifications, your device push tokens are processed by Expo's notification delivery service (based in the United States) to deliver notifications to your device. When the app starts, it also sends Expo anonymous usage statistics such as the app version, operating system and a random installation ID, so we can see how app updates are rolling out. These do not include your name or email address.

4.7 Upstash (Job Queue & Cache)

We use Upstash-managed Redis to queue background jobs such as notifications and report generation. Notification and report data may be held transiently in this queue while it is being processed, and may be processed outside Japan.

4.8 Sentry (Error Monitoring)

We use Sentry (Functional Software, Inc.) to detect and fix errors in the dashboard, the mobile app and our servers. When an error occurs, Sentry receives the error details, browser, device and operating-system information, the app version and your internal BuPay user ID. We configure it not to send your name, email address, payment details or anything you type. This data is stored on servers in the European Union (Germany). Sentry's privacy policy is available here.

4.9 Website Analytics and External Transmission

Our marketing website (bupay.jp) uses the following analytics tools. When you visit the website, information such as pages viewed, referrer, device and browser information, and identifiers is transmitted to these providers:

• Google Analytics (Google LLC): website usage statistics
• PostHog: page view and product analytics events
• Vercel Analytics: website performance and visit statistics

The BuPay app itself (your dashboard and payment screens) uses no advertising trackers or behavioural analytics, and only the cookies required for sign-in sessions (Clerk). The only data it sends out is error reports for fixing problems (4.8 Sentry) and anonymous mobile app usage statistics (4.6 Expo).

5Data Storage and Security

We implement industry-standard security measures to protect your personal data:

• All data is stored on secure servers with encryption at rest and in transit (TLS/SSL)
• Access to personal data is restricted to authorized personnel only
• We use PostgreSQL databases with regular backups and security updates
• Payment data is processed through Stripe's PCI-DSS compliant infrastructure
• We conduct regular security audits and monitoring for unauthorized access

While we implement robust security measures, no system is completely secure. We cannot guarantee absolute security of data transmitted over the internet.

6Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations:

• Active Accounts: We retain your data while your account is active
• Financial Records: Transaction and invoice data is retained for 7 years to comply with tax and accounting regulations
• Account Deletion: You can delete your account yourself at any time from the Security settings in the app or on the web. If you cannot use the app, contact privacy@bupay.jp. We will delete or anonymize your personal data within 30 days of your request, except for financial records we are required to retain by law. For the steps and what is deleted, see "Delete your account" on our contact page (bupay.jp/en/contact/account-deletion)

7We Do Not Sell Your Data

BuPay never sells, rents, or trades your personal information to third parties for marketing purposes.

Your data is kept strictly confidential and used only to:

• Provide and improve our services
• Process payments through our payment processor (Stripe)
• Authenticate users through our authentication provider (Clerk)
• Comply with legal obligations

We will never use your data for advertising purposes or share it with data brokers.

8Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Data Portability: Request a copy of your data in a machine-readable format
• Objection: Object to certain processing of your data
• Withdrawal of Consent: Withdraw consent for optional features like LINE account linking

To exercise these rights, please contact us at the details provided in Section 12.

9Children's Privacy

BuPay is designed for teams and organizations that include minors (such as youth sports teams). Parent or guardian accounts can manage profiles for their children. We do not knowingly collect personal information directly from children under 13 without parental consent.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately.

10International Data Transfers

All primary data, our databases, uploaded files, and backups, is stored on servers located in Japan (Google Cloud Platform, Tokyo region).

Some of the third-party providers listed in Section 4 process specific personal data outside Japan. In the United States: Clerk (authentication data), Stripe (payment and identity verification data), Resend (email addresses and message content), and Expo (mobile push notification tokens and anonymous app usage statistics). In the European Union (Germany): Sentry (error reports and internal user IDs). Queue data processed by Upstash may also be held outside Japan. We only work with providers that maintain data protection standards consistent with this Privacy Policy and applicable Japanese law, and we disclose these overseas transfers in accordance with the Act on the Protection of Personal Information (APPI).

11Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email or through a notice on our platform. The 'Last updated' date at the top of this policy indicates when it was last revised.

12Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@bupay.jp
• Support: support@bupay.jp

We will respond to your inquiry within 30 days.