It looks like it collects payment info via Paypal but it does leak personal info (name, address, email) via HTTP.