Privacy notice
This notice explains data processing for BestBid.lol, a public paid-ranking advertising service. The service operator is responsible for this processing. Use the contact page for privacy questions, requests about your information or reports about a listing. No BestBid account is required to browse or bid.
1. Information you submit
A guest bid includes a website or supported social profile, the chosen ranking and a target amount. Listing records can also include a name, description, tagline, logo and public destination. A listing may identify a person other than the payer; submit personal information only when you have authority to use it for the placement.
If you contact support, we receive your message, the contact information you choose to provide and any evidence needed to investigate it. Existing account access uses an email address, account identifier and authentication records. The public site does not offer account registration or Google login. Contact messages are stored in a private Supabase inbox; when transactional email is configured, Resend may also process a copy as an operator notification.
2. Payments and order records
Stripe collects payment details, email and any billing information required in its hosted checkout. BestBid’s application does not collect full card numbers or card security codes. We receive transaction references, amounts, currency, payment status, timestamps and available receipt links. Authorized support staff may consult relevant transaction and billing information in Stripe to handle a payment enquiry, refund or dispute.
Guest orders use a private status link to show the purchase’s progress. Anyone with that link may be able to view its order status. Keep it private; share the public ranking URL instead. A card payment does not create a public BestBid account or publish your billing email on the leaderboard.
3. Public information
Agent wallet purchases also record quotes, accepted terms, payment protocol and transaction references. Stripe and, for x402, Coinbase process the payment authorization. Blockchain transfers are public and may reveal wallet addresses, amounts and transaction history. BestBid never requests wallet private keys or seed phrases. Keep quote and order access tokens private; application metrics contain aggregate operational data only.
Listing content, destinations, ranking positions, recorded bid totals and associated public activity are intended for public display. Ranking and listing data can be indexed by search engines, read by automated agents, copied or shared by other visitors. Do not submit confidential information as listing content. We cannot control copies retained by independent sites.
4. Technical data and essential storage
When you save a project or ranking, its public name and link are stored in this browser’s local storage to provide your requested collection. The collection is not uploaded to BestBid, does not sync between devices, and does not subscribe you to email. Remove items on the Saved page or clear site data to delete the collection.
Hosting, database and payment systems process technical information such as IP addresses, request times, browser details and error or security logs to deliver and protect the service. BestBid displays an approximate count of browsers active during the previous two minutes. A daily rotating, protected one-way identifier updates a private first-seen and last-seen receipt; the presence record does not store the raw IP address or browser description. BestBid also counts outbound listing clicks in aggregate. That counter uses a necessary, HttpOnly first-party cookie and protected one-way identifiers to deduplicate activity by title and limit abuse. Raw IP addresses and browser details are not stored in either public counter.
Existing account sign-in uses necessary authentication cookies or browser storage. Stripe and other external services may use their own necessary session and fraud-prevention technologies under their notices. BestBid uses Google Analytics 4 to measure page views, traffic sources and interactions so we can understand and improve the service. We use advanced consent mode: before you choose, or after you reject analytics cookies, analytics and advertising storage remain denied while Google receives limited cookieless measurement pings, including consent state and technical request information. Accepting enables analytics storage for more detailed measurement. Advertising storage and personalization remain disabled in every case, and you can change your choice at any time through the Privacy choices control. Google processes this technical data under its own privacy notice. Blocking essential storage may affect sign-in or checkout; rejecting analytics cookies does not.
5. Purposes and legal bases
We use the information to provide purchased advertising, calculate and display rankings, confirm orders, handle support and refunds, moderate submissions, prevent fraud and maintain payment records. Where EU or UK data-protection law applies, the relevant bases are performance of a contract for purchases and requested services, legal obligations for required accounting and compliance records, and legitimate interests for proportionate security, moderation and service administration. Optional processing that requires consent must be offered separately.
Providing the destination and required payment details is necessary to place a bid. You can browse without supplying those details. Rankings are calculated from paid totals and the published tie-break rules; they do not assess personal characteristics, creditworthiness or product quality. Contact us to challenge an incorrect record or moderation decision.
6. Providers and other recipients
We use Vercel for hosting, Supabase for database and existing account services, and Stripe for payments. Transactional email may be delivered through the configured authentication mail service or Resend when enabled. These providers receive information needed for their role; Stripe also processes information for its own payment, compliance and fraud-prevention purposes. We may disclose necessary records to professional advisers or authorities when required by law or to establish or defend a legal claim.
Provider details are available in the Vercel privacy notice, Supabase privacy notice, Stripe privacy notice and Resend privacy notice. Clicking an external listing or opening X takes you to a separate service governed by its own privacy rules.
7. International processing
Our providers may process information outside your country. Their notices describe their international operations and transfer arrangements. Contact us for information about the locations and safeguards applicable to your data. Where a restricted international transfer is involved, the applicable data-protection requirements and safeguards must be met.
8. Retention
Retention depends on the record and its purpose: listing data is needed while a placement is published; order and ledger records support payment reconciliation, refunds, disputes and applicable accounting obligations; support and moderation records are needed to resolve and document a case; technical records support security and incident investigation. A legal obligation or unresolved claim may require longer retention. Presence receipts are removed after one day and are treated as online only for two minutes after their latest qualifying request.
Public removal does not automatically delete associated payment history. We assess deletion or anonymization requests against the continuing need for the record and applicable law. This notice does not promise automatic deletion on a fixed schedule that the service does not implement. Contact us for the retention criteria applicable to a specific record.
9. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, or withdraw consent for processing based on consent. These rights can have exceptions, including records needed for legal obligations or claims. You may complain to your competent data-protection authority without first contacting us.
Start a request through the contact page. We may need proportionate evidence to confirm that you are entitled to the information or action requested. Do not post identity documents, card details, receipts or private status links publicly. We will explain any information needed privately and respond within the applicable legal period. No BestBid signup is needed to make a privacy request.
10. Children and changes
Bidding is for adults aged 18 or over. The service is not directed to children. Contact us if you believe a child’s personal information has been submitted improperly. We will update this page when our practices change, show the revision date and provide any additional notice required by applicable law.