Privacy Policy

We collect very little: an email address so we can send you a receipt and let you manage your listing, the listing details you type in, and basic technical data needed to count clicks and stop abuse. We never see or store your card number — payment details go directly to our payment provider and never touch our servers. We do not sell your data, and we do not use it for advertising profiles.

[operator name not configured] is the data controller for the personal data described here. Contact: hello@bidmaxxing.fun.

For payment data, our payment provider is a separate controller and applies its own privacy policy. Where it acts as merchant of record for a sale, it is the seller for that transaction and determines how it handles your payment data.

When you buy a listing: your email address, and the listing content you provide — product name, website URL, short description, category and a logo image URL. We also store the amount paid, a payment reference from our payment provider, and timestamps.

When someone clicks a listing: the listing clicked, the time, the referring page, the browser user-agent string, and the IP address. This is what makes the public click counter meaningful and lets us detect click fraud.

To prevent abuse: we keep a short-lived counter of checkout attempts per IP address, so one person cannot flood the board.

What we never collect: card numbers, CVCs, bank details, passwords, or any special-category data. There are no user accounts and no passwords to store.

• To deliver what you bought — publishing the listing and emailing a receipt. Basis: performance of a contract.
• To confirm and reconcile payments, including matching a payment to a listing. Basis: performance of a contract and legal obligation.
• To count clicks and show public statistics. Basis: legitimate interest in operating and measuring the service, and in giving buyers an honest picture of what they paid for.
• To prevent fraud and abuse, including rate limiting and moderation. Basis: legitimate interest in keeping the service safe.
• To meet tax and accounting obligations. Basis: legal obligation.

Your listing — name, logo, description, link, position and the amount paid — is public by design. The whole premise of the board is that prices are visible. Recent purchases also appear in a live activity ticker showing the listing name and amount.

Your email address is never shown publicly. It is stored server-side only and is excluded from the public data the browser can read.

We do not sell your data, run advertising cookies, or build cross-site advertising profiles of you.

We use Google Analytics 4 to understand how the site is used in aggregate — which pages people open, roughly where they come from, and whether the site works on their device. It sets first-party cookies (names beginning _ga) so a returning browser is not counted twice.

We configure it to reduce what is collected: IP addresses are anonymised before processing, and Google Signals and ad personalisation are switched off, so your visit is not used to build an advertising profile or retarget you. Data is processed by Google, which may involve transfers outside your country under the safeguards in section 8.

If you are in the EEA, UK or Switzerland, analytics cookies are switched off until you allow them: nothing is stored on your device until you choose, and declining leaves the site fully working. Elsewhere, analytics run by default. You can change your mind at any time by clearing this site's data in your browser, which brings the choice back.

To opt out entirely, use Google's browser opt-out add-on, or any browser setting or extension that blocks analytics scripts. Nothing on this site stops working if you do.

We also use Plausible Analytics, which is cookieless and does not collect or store personal data.

Separately, we count unique visitors ourselves by storing a salted, irreversible hash of your IP address — enough to avoid counting one person twice, and useless for identifying you.

Our payment provider sets its own cookies on the checkout it hosts, governed by its privacy policy.

We use a small number of processors, each only for what is listed:

• Our payment provider — payment processing, billing, tax and receipts.
• Supabase — the database that stores listings, email addresses and click records.
• Vercel — application hosting, which processes request logs including IP addresses.
• Google Analytics — aggregate usage statistics, as described in section 6.
• Analytics provider — aggregate page-view statistics, as described in section 6.

We may also disclose data where legally required, or to establish or defend a legal claim. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Our processors operate globally, so your data may be processed outside your country, including in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard offered by the processor.

• Listings and amounts paid: for as long as the listing is published, and afterwards as part of the public record of the board.
• Email addresses: until you ask us to delete them, subject to the retention needed for tax records.
• Click records: retained in aggregate; the IP addresses attached to them are not needed long-term and are removed or truncated on request.
• Payment and tax records: as long as tax law requires, typically 6–8 years.
• Abandoned checkouts: pending records expire automatically and are deleted.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent where we rely on it.

If you are in the EEA or UK you may also lodge a complaint with your local supervisory authority. If you are in California, you have the right to know, delete, and correct your personal information, and not to be discriminated against for exercising those rights — note we do not sell or share personal information as those terms are defined under the CCPA.

To exercise any of these, email hello@bidmaxxing.fun. We respond within 30 days. Note that deleting a listing removes it from the board but does not reverse a completed payment — see the Refund Policy.

Data is transmitted over TLS and stored in a database protected by row-level security, so the public browser key can only read published listing data — never email addresses or payment records. Administrative access is restricted. No system is perfectly secure, but we do not store the category of data that makes a breach severe: there are no passwords and no card numbers to steal.

This service is not directed at anyone under 18 and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy. The “last updated” date at the top always reflects the current version, and material changes will be noted on this page.