This policy explains how we collect, use, store, and protect your personal data, and the rights you hold. It is written to align with the EU GDPR, the UK GDPR, and comparable regimes (including the CCPA/CPRA for California residents); where local law grants you stronger rights, that law prevails.

1. What we collect

1. Data you give us: the URL, name, description, and category you submit for a listing; order details needed to process payment; billing entity name and tax ID when you request an invoice; the contact details you leave in a support ticket.
2. Eligibility data: business licence and industry permits collected for categories that require them, used solely for eligibility review and record-keeping.
3. Data collected automatically: device and browser data (user agent, screen size, language), access logs (IP, timestamp, referrer), and cookie / similar-technology identifiers.
4. We do not collect sensitive personal data unrelated to the service, and we do not ask you for identity-document photos unless the law explicitly requires it.

2. How we collect it

1. Directly, through forms you complete and files you upload on this site.
2. Automatically, through cookies, local storage, and server access logs, for availability and security.
3. From the payment provider's webhook (order id, amount, timestamp). We never receive your full card number or your payment password.

3. Why we use it

1. To perform our contract with you: create the placement, update rankings, issue invoices, process refunds.
2. For our legitimate interests: content screening, eligibility checks, fraud and abuse prevention, and cooperating with lawful requests from authorities.
3. For security and operations: detecting and handling scrapers, credential-stuffing, and fraudulent activity.
4. On a de-identified basis: publishing aggregate platform statistics such as total transaction value and listing counts. This aggregate data is not personal data.
5. We do not use your personal data for automated marketing decisions, and we do not send you marketing unrelated to this service.

4. Sharing, processors & disclosure

1. We do not sell your personal data. We do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.
2. We use a limited set of processors strictly on a need-to-know basis: the merchant-of-record (MoR) payment provider, the cloud hosting provider, and the invoicing provider. Each is bound by a data-processing agreement and may not use the data for its own purposes.
3. Public listing data: the listing name, description, icon, URL, and cumulative amount you submit are public by default on the leaderboard. Do not submit anything you are unwilling to publish.
4. We may disclose data where legally required, in response to a valid judicial or regulatory request, or where necessary to protect life, health, or property.

5. Retention & location

1. Our primary processing region is the European Economic Area. Where we transfer personal data outside the EEA — for example to a processor in another region — we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with supplementary technical measures.
2. Retention: order and invoice records for at least 3 years (tax and e-commerce record-keeping duties); access logs for at least 6 months; eligibility documents for 2 years after the review ends.
3. Once a retention period ends, we delete or anonymise the personal data.

6. Your rights

1. Access & portability: request a copy of the personal data we hold about you, in a structured, machine-readable format.
2. Rectification: correct inaccurate data. Listing descriptions may be edited once per calendar month.
3. Erasure: request deletion where a lawful ground applies (purpose fulfilled, consent withdrawn, or unlawful processing).
4. Restriction & objection: restrict or object to processing based on our legitimate interests, including profiling.
5. Withdraw consent: withdraw any consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
6. Lodge a complaint: with your local supervisory authority (in the EU/UK, your national data-protection authority).
7. To exercise these rights, open a support ticket. We respond within 30 days, extendable by a further 60 days for complex requests, with notice.

7. Minors

1. This service is aimed at businesses and is not directed at children. We do not knowingly collect data from children under 16 (EEA/UK) or under 13 (US).
2. If you are a minor in your jurisdiction, please review this policy with a parent or guardian and obtain their consent before using the service.
3. If we learn we collected a minor's data without the required consent, we will delete it promptly.

8. Contact & complaints

1. For any privacy question or request, open a support ticket or email privacy@example.com. We respond within 30 days.
2. If you are unsatisfied, you may complain to your local data-protection supervisory authority.
3. Last updated: 2026-09-10. Material changes are announced on-site at least 7 days in advance.