Privacy Policy

1. What we collect

• Creators: name, email address, profile details, Stripe account identifiers and, where you set one, a securely hashed password (we never store the password itself). Identity documents and bank details are collected by Stripe, never by WorthIt.
• Supporters: the amount paid and, only if voluntarily provided, a display name, email address (for receipts) and message. Card details are handled entirely by Stripe and never touch WorthIt servers or forms.
• Analytics: privacy-conscious event counts (page views, button clicks, payments) with coarse device category, referrer domain and attribution tags. We do not fingerprint visitors, do not use third-party advertising trackers, and do not store full IP addresses beyond short-term operational logs.

2. How we use it

• To operate payments, receipts and creator dashboards.
• To show creators which of their work generated payments.
• To send transactional email (account verification, password resets, payment notifications).
• To prevent fraud and abuse.

3. What we never do

• Sell personal data.
• Expose supporter email addresses publicly or to other supporters.
• Show supporter names publicly when a payment is marked anonymous.

4. Processors

We use Stripe (payments), Resend (transactional email), Neon (database hosting), Vercel (application hosting), Upstash (abuse-rate limiting) and, if you choose Google sign-in, Google (authentication). Each processes data under its own terms and our instructions.

5. Cookies

Signed-in creators receive a single strictly necessary session cookie so the dashboard knows who you are. Public creator pages set no cookies: supporters can view and pay without any. We use no advertising, analytics or cross-site tracking cookies anywhere.

6. Retention and rights

Closing a creator account disables its pages and payment buttons immediately, revokes login access and disconnects WorthIt from the creator’s Stripe account. Remaining creator profile, content and analytics data is retained for 30 days, then permanently deleted. Payment records are kept as long as legally required for financial record-keeping, but are detached from the deleted creator profile and stripped of supporter names, email addresses and attribution data. The creator-owned Stripe account remains open unless the creator closes it with Stripe. You can request access to or correction of your personal data by contacting privacy@getworthit.co.uk, subject to legal retention obligations.