This is a draft. It has not been reviewed by a lawyer yet and is published here so it can be. Ask us anything about it at legal@sowing.me.
This says what Sowing.me collects, why, who else sees it, and what you can ask us to do about it. It describes how the platform actually works today.
What we collect
Because you gave it to us
- Your email address and a display name, when you sign up. A password, stored only as a hash we cannot reverse.
- If you sign in with Google or Facebook: the account identifier they give us and the email address attached to it. We do not receive your password, and we ask them for nothing else.
- If you make a creator page: whatever you put on it — your name, bio, category, links, picture, banner, tiers and posts. That page is public by design.
- What you write when you give: an optional message to the creator, which the creator can see.
Because you paid
- Which creators you support, what you paid, when, and whether it was refunded or disputed.
- Not your card. Card numbers go from your browser to Stripe and never reach us. We keep Stripe's reference for the payment and, if you save a card, the brand, last four digits and expiry — enough to show you which card is on file.
Because the platform ran
- Session cookies that keep you signed in. They are marked secure and HttpOnly, so scripts on a page cannot read them, and they are not used for advertising.
- Ordinary server logs: IP address, what was requested, when. We use these to keep the service working and to catch abuse, including rate-limiting sign-in attempts.
We do not use advertising trackers, we do not sell personal information, and we do not use your content or your data to train AI models.
Why we use it
To run your account and keep you signed in; to show creators' work to the people entitled to see it; to take payments and pay creators; to send the few emails the service needs (confirming your address, resetting a password, receipts); to enforce the Content Policy; and to meet our legal and tax obligations.
Who else sees it
- Creators you support see that you support them, your display name, your tier, when you joined, and any message you wrote. They do not see your email address, your card or your other subscriptions.
- Stripe processes payments and holds the card details. Their privacy policy applies to that.
- Google or Facebook, if you choose to sign in with them, learn that you signed in.
- Our hosting and email providers, only as needed to deliver the service.
- The authorities, where the law actually requires it, or to report the sexual exploitation of a child.
Nobody else. We do not sell or rent your data.
Staff access is logged
Sowing.me staff can see payment records through an admin console, because refunds and disputes sometimes need a person. Every such view of a supporter's payment details is written to an append-only audit log — who looked, at what, when and why — before the page is shown. If the log cannot be written, the page is not shown.
How long we keep things
- Your account and its content: while your account exists.
- Payment records: kept after an account closes, because tax and accounting law requires it (usually seven years).
- Staff access logs: one year.
- Server logs: a short operational period.
- Uploads: stored privately. Every image or file is served through a link that expires, so an old link stops working — nothing you post is left sitting on a public URL after it is removed.
Your choices
You can ask us to:
- show you what we hold about you;
- correct it — most of it you can edit yourself in Settings or on your creator page;
- delete your account and personal data, except records we must keep by law (payment records) and content another person paid to access, which we may keep for the period they paid for;
- export your data in a machine-readable form;
- stop a particular use, where the law gives you that right.
Write to [privacy@sowing.me]. We will answer within 30 days. You will not be treated differently for asking.
Depending on where you live, you may also have the right to complain to a data protection authority. Nothing here removes that.
Children
Sowing.me is not for children. You must be at least 18 to pay for anything here, and accounts are not intended for under-13s. If we learn we hold a child's data, we delete it.
Where your data is
Sowing.me is operated from [COUNTRY — for counsel] and data is stored on our own infrastructure there, apart from what Stripe and our email provider hold. If you are in another country, using the service means your data is handled here.
Changes
We will post changes here and update the date at the top. If a change materially affects how we use your data, we will email you first.
Contact: [privacy@sowing.me]. Kingdom Impact Technology Group, [REGISTERED ADDRESS — for counsel].