Privacy Policy

Last updated: 25 April 2026

This Privacy Policy describes how Buyments.com ("Buyments", "we", "us", "our") collects, uses, stores, and shares personal data in connection with our platform and services in the State of Kuwait. By using Buyments — as a merchant, customer, or visitor — you acknowledge the practices described below.

1. Who We Are

Buyments is a Kuwait-based Software-as-a-Service platform that enables merchants to accept payments and run online stores. For questions about this Policy, contact [email protected].

2. Information We Collect

Merchant account information:

  • Business name, owner name, email address, mobile number, and login credentials (passwords stored in hashed form).
  • Business category, store slug, and branding assets you upload.

Merchant KYC (Know-Your-Customer) documents:

  • Trade licence, civil ID, signature authorisation, bank IBAN confirmation, and any additional documents required by the Central Bank of Kuwait or our payment partners.
  • KYC files are stored in encrypted object storage (Cloudflare R2) and accessed through short-lived signed URLs (maximum 7 days).

Customer information (collected by merchants through our platform):

  • Name, phone number, email address, delivery address (where applicable).
  • Order, booking, digital product access, and course subscription history.
  • Communications sent or received through the platform.

Payment information:

  • Buyments does not store card numbers, CVVs, bank login details, or K-Net PINs.
  • Card and payment-instrument data is collected and processed directly by our payment partner UPayments under their own privacy practices.
  • We retain non-sensitive transaction metadata (order ID, amount, method, status, reference number, timestamps) required for settlement, accounting, and dispute handling.

Technical & usage data:

  • IP address, browser type, device identifiers, language preference, pages visited, referrer, and session timestamps.
  • Cookies and similar technologies (see Section 8).

3. How We Use Personal Data

  • Operate the platform, create and manage accounts, process orders, bookings, and subscriptions.
  • Authenticate users, including one-time password (OTP) verification via SMS / WhatsApp.
  • Process payments through UPayments and reconcile settlement to merchants.
  • Perform merchant KYC review and comply with anti-money-laundering (AML) and Central Bank of Kuwait requirements.
  • Send transactional notifications (order confirmations, receipts, status updates).
  • Send marketing communications via WhatsApp and email — only where the recipient has provided consent, and always with an opt-out option.
  • Detect, investigate, and prevent fraud, abuse, and security incidents.
  • Improve the product: analytics, debugging, performance monitoring.
  • Respond to legal requests and enforce our Terms.

4. Legal Bases

We process personal data on one or more of the following bases:

  • Contract — to provide the service you signed up for.
  • Legal obligation — KYC, AML, tax, and regulatory compliance.
  • Consent — for marketing and non-essential cookies.
  • Legitimate interests — fraud prevention, product improvement, security.

5. Sharing of Personal Data

We share data only as necessary with the following categories of recipients:

  • UPayments — payment processing, settlement, chargeback handling.
  • Cloudflare — CDN, image delivery (Cloudflare Images), and encrypted KYC document storage (R2).
  • Meta Platforms (WhatsApp Business Cloud API) — delivery of template-based marketing and transactional WhatsApp messages.
  • Email service providers — sending account, transactional, and support emails.
  • AI / language-model providers — where you interact with the onboarding AI agent, your messages are processed to generate responses; we do not sell chat content.
  • Competent authorities — where disclosure is required by Kuwaiti law, court order, or lawful request.
  • Successor entities — in the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections.

Buyments does not sell personal data to third parties.

6. Data Retention

  • Merchant KYC records are retained for the period required by applicable AML and tax regulations (typically a minimum of five years after account closure).
  • Order, invoice, and payment records are retained for the period required by Kuwaiti commercial and tax law.
  • Marketing contact data is retained until consent is withdrawn.
  • Technical logs are retained for a limited operational period (usually up to 12 months).

7. Security

We apply administrative and technical safeguards appropriate to the sensitivity of the data, including:

  • TLS encryption for data in transit.
  • Encrypted object storage for KYC documents with signed-URL access expiry.
  • Role-based access control in our dashboards and admin tools.
  • Password hashing, OTP-based verification, and JWT-based session management.
  • Monitoring, logging, and regular backups.

No system is 100% secure. If we become aware of a personal-data incident that is likely to affect you materially, we will notify affected users and the competent authorities as required by law.

8. Cookies

We use cookies and similar technologies to remember your language preference, keep you signed in, measure usage, and secure the service. You can disable cookies in your browser; certain features may not work without them.

9. Your Rights

Subject to applicable Kuwaiti law, you may request to:

  • Access the personal data we hold about you.
  • Correct inaccurate or outdated data.
  • Delete your data (subject to regulatory retention requirements).
  • Withdraw consent for marketing communications at any time.
  • Object to processing that is based on our legitimate interests.

To exercise any of these rights, email [email protected] from the address linked to your account.

10. International Transfers

Some of our service providers (e.g. Cloudflare, Meta, UPayments) may process data on infrastructure located outside the State of Kuwait. Where this occurs, we rely on contractual and technical safeguards to protect the data.

11. Children

Buyments is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the effective date of the latest version. Material changes will be communicated through the platform or by email.

13. Contact

For privacy questions, data-access requests, or complaints, contact [email protected].