Privacy Policy

This Privacy Policy explains how Buy and Hold Co., Ltd. ("we", "us") collects, uses, and protects your information when you use the Buy and Hold platform at nopoly.ai (the "Service"). By using the Service, you agree to this Policy.

1. Information we collect

• Account details — your name, email address, and phone number when you register, and your Google profile basics if you sign in with Google.
• Content you submit — messages, prompts, files, and configurations you send to the AI assistant and tools.
• Usage data — token usage, feature activity, and technical logs (e.g. IP address, browser) used to run, secure, and improve the Service.
• Payment information — card payments are processed by Stripe; we do not store full card numbers. For cryptocurrency payments we record the on-chain transaction hash, amount, and network.
• Contact messages — anything you send through the contact form.

2. How we use your information

• to provide, maintain, and improve the Service;
• to authenticate you and secure your account;
• to process payments and manage subscriptions;
• to enforce usage limits and prevent abuse or fraud;
• to respond to your requests and support enquiries;
• to comply with legal obligations.

3. Service providers

We share the minimum necessary data with providers who process it on our behalf, including:

• AI providers (Anthropic, Google, OpenAI) to generate assistant responses and media from your prompts;
• Stripe for card payment processing;
• Google for optional sign-in;
• Hosting and database providers (e.g. Vercel and our managed database) to run the Service.

We do not sell your personal information. Your prompts are sent to AI providers only to fulfil your requests, subject to their terms.

4. Cookies

We use strictly necessary cookies to keep you signed in and to remember preferences such as language and theme. We do not use them for third-party advertising.

5. Data retention

We keep your information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You can request deletion of your account and associated data as described below.

6. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us through the form below.

7. Security

We use industry-standard measures such as encrypted connections, hashed passwords, and access controls to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. International transfers

Your information may be processed in countries other than your own, including where our providers operate. Where required, we take steps to ensure appropriate safeguards for such transfers.

9. Children

The Service is not directed to children under 18, and we do not knowingly collect their personal information.

10. Changes

We may update this Policy from time to time. Material changes will be reflected by updating the date above.

11. Contact

Questions or requests about your privacy? Reach us through the contact form.