Privacy
Policy.

This Privacy Policy explains how Buffpict processes information when you visit buffpict.com, create an account, upload product materials, generate marketplace content, contact support, or use administrative and billing features. It applies to the Buffpict website, application, APIs, and related communications.

By using Buffpict, you acknowledge the practices described here. If you act for a company or another person, you confirm that you are authorized to provide their information and product materials.

Account information may include your name, email address, password hash, profile image, language, timezone, role, and account preferences. Buffpict never stores your password in readable form.

Product information may include photographs, product names, verified attributes, instructions, marketplace choices, prompts, generated images, listing titles, descriptions, feature bullets, search terms, tags, edits, export files, and project history.

Support information includes ticket subjects, messages, attachments you choose to provide, and correspondence required to resolve a request. Billing records may include transaction identifiers, pack names, currency, amount, status, refunds, disputes, and credited Lightning. Full payment-card details are intended to be handled by the payment provider rather than stored by Buffpict.

We may process IP-derived security information, browser and device type, operating system, timestamps, requested routes, referring page, session identifiers, authentication events, rate-limit counters, error reports, generation status, and audit events. IP addresses may be transformed into protected hashes for abuse prevention.

We use essential cookies for sessions, CSRF protection, and OAuth state. These cookies are necessary for authentication and account security. Buffpict does not need advertising cookies to provide the core service.

We use information to create and secure accounts; provide projects, generation, editing, SEO, export, credits, and support; verify email ownership; process authentication; maintain ledgers and payment records; detect fraud and abuse; enforce rate limits; investigate errors; comply with applicable obligations; and improve reliability and usability.

Product photographs and verified attributes are processed to deliver the requested output. Buffpict should not intentionally invent factual product claims. Users remain responsible for reviewing generated content before publication and for ensuring that supplied claims are accurate and lawful.

Depending on your location, processing may rely on performance of a contract, steps requested before entering a contract, legitimate interests in operating and protecting the service, compliance with applicable obligations, and consent where required. You may withdraw consent where consent is the applicable ground, without affecting earlier processing.

You may sign in with Google. Google provides Buffpict with an account identifier, email address, email-verification status, name, and profile image according to the permissions shown during sign-in. Buffpict does not receive your Google password. Google processes information under its own privacy terms.

Email-and-password accounts require verification. Verification codes are single-use, expire after a short period, are stored only as cryptographic hashes, and are protected by attempt and resend limits.

To provide generation features, Buffpict may transmit the product image, verified product information, selected marketplace, prompt, and requested output settings to configured AI infrastructure providers. Provider availability and retention practices depend on the production service selected by Buffpict.

Hosting, database, object storage, email delivery, error monitoring, and payment providers process limited information necessary for their functions. We seek to limit access by purpose and use contractual and technical safeguards appropriate to the service.

Buffpict does not sell personal information. We may disclose information to service providers acting on our instructions; to professional advisers under confidentiality duties; during a corporate transaction subject to appropriate protection; to protect users, Buffpict, or others; or when disclosure is reasonably required by applicable process.

Administrators and support personnel receive role-limited access. Sensitive administrative actions are recorded in audit logs. We do not authorize service providers to use account or product information for unrelated advertising.

Providers and infrastructure may operate in countries other than your own. Where required, Buffpict will use appropriate transfer mechanisms and safeguards. Laws and government-access rules may differ between jurisdictions.

We retain active account information while the account is open and as needed to provide the service. Projects and generated assets remain until deleted, archived under product rules, or removed under retention controls. Security logs, payment records, credit-ledger entries, webhook evidence, and audit records may be retained longer where required for integrity, fraud prevention, disputes, accounting, or compliance.

Expired verification and password-reset credentials are invalidated. Account deletion removes or schedules removal of account content, subject to limited records that must be retained or cannot safely be altered, including immutable financial ledger evidence. Backups expire through controlled rotation rather than immediate selective deletion.

Safeguards include encrypted transport, one-way password hashing, secure session cookies, CSRF protection, OAuth PKCE and state validation, signed asset access, role-based authorization, rate limiting, webhook-signature verification, least-privilege service accounts, protected environment configuration, and audit logging.

No system can guarantee absolute security. Protect your credentials, use a unique password, sign out from shared devices, and contact support if you suspect unauthorized access.

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or information about processing. Account settings provide profile editing, session management, data export, and account deletion. Some requests may require identity verification.

You may disconnect Google access through your Google Account and may stop non-essential communications where offered. Essential security, transactional, and service messages cannot always be disabled while an account remains active.

Upload only photographs, trademarks, personal information, and product data that you are authorized to use. Avoid uploading government identifiers, medical information, financial credentials, biometric material, or unrelated personal information. If a photograph contains a person, you are responsible for having an appropriate basis and permissions.

Buffpict is intended for business users and is not directed to children under 13. Users must meet the minimum age required in their country to enter an online service agreement. If we learn that a child provided personal information contrary to applicable requirements, we will take reasonable steps to remove it.

Generated images and text may be inaccurate, incomplete, unsuitable, or similar to other content. Always review marketplace rules, intellectual-property rights, safety statements, regulated claims, prices, dimensions, compatibility, and other factual information before publishing. Buffpict stores generation provenance and verified facts to support review but does not replace professional judgment.

We may update this policy when the product, providers, or applicable requirements change. Material changes will be communicated through the service or account email when appropriate. The effective date identifies the current version.

For privacy questions or requests, use the authenticated Support section in Buffpict. You may also write to privacy@buffpict.com after that mailbox is activated. Include enough information to identify your account and request, but do not send passwords, payment-card numbers, or private API keys.