Privacy Policy

Effective: July 11, 2026

This policy describes what Bajar (thebajar.com) collects, why, and what your choices are. The short version: we collect what running a marketplace requires — your account, your uploads, your purchases — and nothing built for tracking you.

1. What we collect

  • Account: email address, username, and a salted hash of your password (we never store the password itself). Signups are held unverified until you confirm your email; unverified signups are deleted automatically within about two days.
  • Content you upload: design files and listing images, plus previews we generate from them (such as stitch-out animations).
  • Purchases: what was bought, the amount, and a payment reference. Payment itself happens at Stripe — we never see or store card numbers. Sellers additionally complete Stripe's identity/payout onboarding, which Stripe collects under its own privacy policy.
  • Operational logs: standard server logs (IP address, request data) kept briefly for security and debugging.

2. Cookies

We set exactly one cookie: session, which keeps you logged in for 24 hours. It is strictly necessary for the Service, first-party, and not used for tracking — which is why you don't see a cookie banner here. If we add analytics, we will use a cookie-free, privacy-respecting tool; if that ever changes, this policy and the site will change accordingly.

3. What we use data for

  • Running the marketplace: accounts, listings, delivery of purchased files, payouts (performance of our contract with you).
  • Transactional email — verification links, password resets, purchase-related notices — sent via Resend. We do not send marketing email without your consent.
  • Security, fraud prevention, and debugging (legitimate interest).
  • We do not sell personal data, run ads, or share data with brokers.

4. Who processes data for us

  • Stripe — payments and seller payouts (KYC).
  • Resend — transactional email delivery.
  • Railway — application hosting and database.
  • S3-compatible object storage — uploaded files and generated previews.
  • We may add error monitoring (e.g. Sentry) and cookie-free analytics; such tools receive only what their function requires.

Data may be processed in the United States. Where required, we rely on standard contractual safeguards offered by these providers.

5. Retention

  • Account data: for the life of your account.
  • Purchase records: retained as required for accounting and tax obligations, even after account closure.
  • Uploaded content: until you delete it — except files already sold, which buyers retain access to.
  • Unverified signups: deleted automatically within about two days.

6. Your rights

You can access and update your account details in your profile. For a copy of your data, correction, or deletion of your account, email [email protected] — we honor deletion requests except where the law requires retention (e.g. transaction records). EU/UK residents additionally have GDPR rights (access, rectification, erasure, portability, objection) and may lodge a complaint with their supervisory authority; California residents have equivalent CCPA rights. We do not discriminate for exercising them.

7. Security

Passwords are stored only as bcrypt hashes; traffic is encrypted in transit; file access goes through expiring signed URLs; database credentials never yield usable login tokens. No system is perfectly secure — if a breach affects you, we will notify you as the law requires.

8. Children

The Service is not directed at children and requires users to be 18 or older.

9. Changes & contact

Material changes will be announced on the Service or by email before taking effect. Data controller: Bajar [OPERATOR LEGAL NAME], reachable at [email protected]. See also our Terms of Service.

enes