Privacy Policy

1. What we collect

When you create an account and build a website on X404 ("the Platform"), we collect:

• Account details — your email address and account credentials.
• Business details — your business name, address, phone, category and the content you provide for your website (menus, services, product listings, images and similar).
• AI-processed content — website copy and SEO meta drafted for you by an AI service from the details above, and moderation records from automated content checks.
• Payment records — subscription and storefront payments processed through Razorpay (amounts, order references, transaction status).
• Support correspondence — messages you send us when you contact support.

2. How we use AI (Gemini)

We use Google's Gemini service to (a) draft website content and SEO meta from the business details you provide, and (b) screen submitted business details for inappropriate content. Content sent to Gemini is used to produce the drafted output and may be processed outside your country of residence. AI-generated content is a suggestion you review before publishing; moderation results are logged for manual review where flagged.

3. Who we share data with

We share data only with the service providers required to run the Platform:

• Supabase — database and file storage hosting your data.
• Vercel — hosting and serving your published website.
• Google Gemini — AI content drafting and moderation (see above).
• Razorpay — payment processing for platform subscriptions and merchant storefront payments.
• Brevo — transactional email (order confirmations, notifications, support replies).

Your published website and its content are public — anyone who visits your storefront can see them.

4. How long we keep data

We keep your data while your account is active and for a short period afterwards to allow account recovery and to fulfil legal obligations. Payment records may be retained longer where required by law.

5. Deleting your data

You can delete your account from your dashboard at any time. Deleting your account removes your websites, products, orders and associated data. To request deletion of data you cannot remove yourself, contact us at support@byinviteonlyclub.com.

6. Security

We encrypt credentials and secrets at rest, keep payment processing with PCI-compliant providers (Razorpay), and restrict access to production data. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

7. Children

The Platform is intended for businesses and is not directed at individuals under 18. We do not knowingly collect personal data from children.

8. Changes to this policy

We may update this policy as the Platform evolves. Material changes will be communicated through the Platform, and continued use after changes take effect constitutes acceptance.

9. Contact

Privacy questions: support@byinviteonlyclub.com.