Privacy Policy

1. Who we are

Bidriot (bidriot.lol) operates a public ranking marketplace where projects, products and websites compete for position on a leaderboard through verified bids. This policy explains what we collect when you browse the leaderboard, submit a listing, place a bid, or manage a team.

2. What is public by design

Bidriot is a transparency-first product. The following is visible to anyone, including search engines, and is not private information:

• Listing name, URL, logo, description, category, tags and social links.
• The verified bid total attached to a listing, its all-time rank, today rank, category rank, rank movement and momentum score.
• Bid history for a listing (amounts and timestamps), battle history against rival listings, achievements earned, and aggregate click and impression counts.

We do not publish the identity, email address or payment details of the person who placed a bid. Bids are attributed to the listing, not to a named individual, unless you choose to add a founder name or social links to the listing profile yourself.

3. Data we collect

• Account data: email address, display name, avatar, and the authentication method you used (email/password or Google sign-in).
• Guest checkout data: if you bid before creating an account, we store the email address you enter so we can send your receipt and let you claim the resulting listing and bid.
• Bidding data: bid amounts, reservations you started but did not complete, Auto-Outbid configuration and its spend limits, wallet balance and wallet transactions.
• Payment data: processed by Stripe. We store the Stripe payment identifiers, amount, currency, status and receipt link. We never receive or store full card numbers, CVC codes or bank credentials.
• Listing analytics: impressions, outbound clicks and referrer for listing pages. Visitor identifiers are hashed; we do not build advertising profiles.
• Team data: team name, member roles, and email addresses used for invitations.
• Operational logs: security and error logs, including IP address and user agent for administrative actions, kept to detect abuse and bid manipulation.

4. How we use it

• To calculate ranking, dynamic pricing and Auto-Outbid decisions server-side.
• To take payment, hold short-lived bid reservations and issue receipts.
• To send transactional email: bid receipts, outbid alerts, rank changes, Auto-Outbid activity, wallet funding, listing moderation outcomes and team invitations. You can turn each category off in notification settings; receipts and account-security emails always send.
• To moderate listings and enforce the Terms.
• To produce aggregate platform analytics and revenue reporting for administrators.

We do not sell personal data, and we do not use your data to train third-party advertising models.

5. Legal bases

Where the UK/EU GDPR applies: we process account, bidding and payment data to perform our contract with you; moderation, fraud prevention and security logging rest on our legitimate interest in running a fair marketplace; optional notification emails rest on your consent, which you can withdraw at any time.

6. Processors we share data with

• Stripe — payment processing and receipts.
• Resend — delivery of transactional email.
• Our hosting and database provider — application hosting, authentication and encrypted data storage.

These providers act on our instructions. We also disclose data where we are legally required to, or to investigate fraud, chargeback abuse or coordinated bid manipulation.

7. Retention

Bids, payments and rank history form the public record of the leaderboard and are retained for as long as the platform operates, because removing them would falsify historical rankings. Account profile data is deleted on request. Expired or cancelled reservations are pruned once they are no longer needed for accounting. Payment records are kept for the period required by tax and anti-fraud law.

8. Your rights

You can access and correct your profile, notification preferences, listings and team membership from your account at any time. You may request export or deletion of your personal data by contacting us. Deleting your account removes your profile and contact details; it does not retroactively delete the bid amounts and rank history attached to a public listing.

9. Security

All bidding, pricing and Auto-Outbid logic runs server-side and is re-validated against the live board before any charge — a modified client cannot change what it is charged or what rank it receives. Database access is protected by row-level security so users can only read their own wallet, payment, notification and team data. Administrative actions are role-gated and written to an audit log. Payment card data never touches our servers.

10. Cookies and local storage

We use strictly necessary storage to keep you signed in and to remember an in-progress bid. We do not run third-party advertising or cross-site tracking cookies.

11. Children

Bidriot involves real payments and is not intended for anyone under 18.

12. Contact

Privacy questions and data requests: privacy@bidriot.lol. See also our Terms and Conditions.