Privacy policy

Buy My Agent is operated by BUYMYAGENT TECHNOLOGIES INC., a Canadian corporation. For personal data we process to run the marketplace, we are the data controller; you can reach our Privacy Officer through our contact page. We process personal data in Canada and the United States (see “Where your data is processed” below) and currently offer the service only in those markets; it is not directed to the EEA, the United Kingdom, or Switzerland.

We collect what we need to run the service: a creator's page details and email; a subscriber's email and payment status from Stripe (never card numbers). The agents run on external platforms, so we do not receive or store your conversations with them.

When you subscribe to an agent, we do not share your email address with the creator unless you choose to. Sharing your email is optional and off by default: you can turn it on at checkout or anytime from your account (under your subscription), and you can turn it off again whenever you like. If you don't share it, the creator can't see your email and the two of you can't contact each other directly — you can still open the agent, and you can still reach us for billing or refund help. If you do choose to share it, we give the creator your email and subscription status so they can contact you and provide support (for example, to answer a question or process a refund); they are an independent creator and the merchant of record for your purchase, are required to use your information only to run their own agent and support their customers (not for unrelated marketing), and should stop using it if you later withdraw sharing. Your payment card details are never shared with creators — Stripe handles those directly.

We don't sell personal information, run ad trackers, or train public models on your content. You can request a copy of, correction of, or deletion of your personal data — subject to records we must keep for tax and accounting. Make any request via the contact page and we'll action it.

Where your data is processed

We run the marketplace on trusted third-party processors that may store and process your data in the United States: Stripe (payments and payouts), Supabase (our database and sign-in), Resend (transactional email), and Vercel (hosting). We share only what each needs to do its job — never your card numbers (Stripe handles those directly) and never your conversations with agents (which we never receive).

Cookies & analytics

We use a small number of strictly-necessary cookies to keep you signed in and to protect the site (a session cookie and security cookies). We do not use advertising or cross-site tracking cookies. Our analytics are cookieless: to count visits we derive a one-way hash from your IP address and browser that is salted and rotated every day, so it can't identify you or follow you from one day to the next; we never store your raw IP, and we keep only the page visited, an approximate country from your network, and the site that referred you. Because no advertising or cross-site profile is created, we don't show a cookie-consent banner — but the essential cookies are always required for the site to work.

Aggregated marketplace insights

We collect marketplace activity such as agent category, pricing, page views, searches, purchases, subscription duration, cancellations, refunds, ratings and conversion trends. We use this information to operate, secure, analyze and improve Buy My Agent.

We may combine information across multiple agents and creators to create aggregated or de-identified benchmarks, reports and market insights, and we may publish, license or sell those aggregated insights to third parties. These insights will not include names, email addresses, account identifiers, payment details, private access links, subscriber-level records, customer conversations or exact creator-level financial results, and are not designed to identify a particular subscriber, creator or account.

We do not sell personal information. We use aggregation, minimum reporting thresholds, and other safeguards intended to prevent individuals or individual accounts from being identified. A creator's own performance data is included in commercial insight products only with their separate opt-in, which they can withdraw at any time.

Reports, safety evidence & retention

When you report an agent, we collect only what we need to investigate and may keep report evidence and limited abuse signals to prevent fraud and ban evasion. Some records must be retained for legal, accounting, safety, or regulatory reasons even after an account closes. We restrict safety evidence to authorized staff. You can request access to or correction of your personal information, subject to lawful exceptions. Retention periods follow our internal retention schedule and applicable law.

Agents are external

Buy My Agent does not host or operate the agents themselves and does not receive or store your conversations with them. When you open an agent, you leave Buy My Agent for the creator's own site, which has its own privacy practices. We process account details, subscription records, reviews, and reports needed to run the marketplace.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to withdraw consent — subject to legal exceptions and records we must keep for tax and accounting. Residents of California and certain other U.S. states also have the right to know, delete, and correct their personal information, to opt out of the “sale” or “sharing” of personal information and of targeted advertising, and not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioural advertising. You, or an authorized agent, can make a request through our contact page; we will verify and respond as the law requires.

Children

Buy My Agent is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 (or, for U.S. children, under 13). If we learn we have, we will delete it — contact us if you believe a child has given us information.

Data security & breach

We use reasonable administrative, technical, and physical safeguards to protect personal information — for example we store only hashed session tokens and never store card numbers. No method of transmission over the internet or electronic storage is completely secure, so any information you send us is at your own risk, and we can't be responsible for a breach caused by events beyond our reasonable control. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you and the relevant authorities where the law requires.

Disclosure for legal reasons

We may disclose your personal information where we believe in good faith it is necessary or appropriate: to comply with a law, regulation, subpoena, court order, or other legal process; to respond to a lawful request from a government or law-enforcement authority; to enforce our Terms and policies; or to investigate, prevent, or address fraud, security or technical issues, intellectual-property infringement, or activity that is illegal or could harm you, us, or others. We disclose only what is reasonably necessary for the purpose.

Emails we send

We send you service and transaction emails — for example email verification, receipts, subscription and security notices, and legally-required notifications. These aren't marketing, and you can't opt out of them while you have an account, because we need them to run the service and keep you informed. If we ever send marketing or newsletter emails, they will include an unsubscribe link, and opting out of those will not affect the service emails above.

Effective date: August 1, 2026.