Privacy Policy

Controller

Sven Guettner
Walter-Hohmann-Str. 19
45128 Essen
Germany

Email: support@outbids.app. There is no statutory obligation to appoint a data protection officer for this activity.

What you publish yourself

A listing is public by design. The destination you submit, the fetched title, description and preview image, the category, the verified total, the rank and the click count are shown to everyone and may be indexed by search engines. Do not submit a destination whose content you do not want public.

Legal basis: Article 6(1)(b) GDPR, performance of the contract you requested by submitting.

Email address at checkout

If you enter an email address it is passed to Stripe for the receipt and stored with your listing so we can reach you about that listing. It is never published, never sold and never used for marketing. Legal basis: Article 6(1)(b) GDPR.

Payments

Payments are processed by Stripe with Managed Payments, which makes Stripe the merchant of record. Stripe collects the payment data directly on its own checkout page. We never see or store card numbers. We receive a payment confirmation containing the checkout session identifier, the amount, the payment status and any email you provided.

Stripe entities: Stripe Payments Europe, Limited, Dublin, Ireland, and Stripe, Inc., South San Francisco, USA. Transfers to the USA are covered by the EU standard contractual clauses and Stripe's certification under the EU US Data Privacy Framework. Stripe's own privacy notice is at stripe.com/privacy. Legal bases: Article 6(1)(b) GDPR for the purchase and Article 6(1)(c) and (f) GDPR for fraud prevention and statutory retention.

Hosting and server logs

The site runs on Cloudflare Workers with Cloudflare D1 and Workers KV. Cloudflare processes the connection data that is technically necessary to deliver a page, including IP address, request time, requested URL, referrer and user agent, and uses it for delivery, caching, TLS and attack mitigation. Provider: Cloudflare, Inc., USA, and Cloudflare Germany GmbH, Munich, acting as our processor under Article 28 GDPR with standard contractual clauses in place. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a secure and functioning site.

Click counting

Outbound links run through a redirect on this domain so the public click count stays comparable between listings. To count one visitor once per listing per board day we derive a short irreversible hash from your IP address, your user agent and a rotating daily value, and store only that hash together with the listing and the day. The raw IP address is not written to our database and the hash cannot be linked back to you after the day rolls over.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest and the interest of every listed party in an honest, spam resistant public click count. Retention: 90 days, then deleted.

Cookies and local storage

Strictly necessary items only, unless you choose otherwise: a short lived cookie that matches your return from Stripe checkout back to your submission, and local storage entries that remember your colour theme and your cookie choice. These are covered by section 25(2) of the German TDDDG and need no consent.

If you press Accept all we additionally load Google Analytics 4, which sets the _ga cookies, and Cloudflare Web Analytics, which sets none. IP anonymisation is on and Google Signals and ad personalisation are switched off, so no advertising profile is built. Nothing is loaded before you accept, and you can withdraw at any time on the cookie page with effect for the future. Legal basis for the optional items: Article 6(1)(a) GDPR and section 25(1) TDDDG. The full list is on the cookie page.

Metadata fetching

When you submit a destination our server requests that page once to read its public title, description and preview image, and repeats this periodically to keep cards current. The destination's own server sees a request from Cloudflare's network with our user agent. No personal data of yours is sent in that request.

Email to support

Mail to the support address is received through Cloudflare Email Routing and forwarded to the operator's mailbox. Content, sender address and headers are processed to answer you and are kept as long as needed for that, then deleted, subject to statutory retention for business correspondence. Legal basis: Article 6(1)(b) and (f) GDPR.

Retention

Listings and their bid records are kept while the listing is active and afterwards for as long as commercial and tax law require, which for billing relevant records is up to ten years under German law. Click hashes are deleted after 90 days. Support mail is deleted once the matter is closed unless retention applies.

Recipients

Data is disclosed only to the processors named here, namely Cloudflare for hosting, delivery and email routing, Stripe for payments and, if and only if you accepted analytics, Google for Google Analytics 4. Beyond that, disclosure happens only where we are legally required to do so. Listing content is public by its nature. Nothing is sold and there is no advertising network on this site.

Your rights

You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection to processing based on legitimate interests (21), and you may withdraw consent at any time with effect for the future. An informal email to support@outbids.app is enough. If you want a listing removed, tell us the destination and we will verify that you control it.

Complaints

You may lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is: Landesbeauftragte fuer Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestrasse 2 to 4, 40213 Duesseldorf, Germany.

Changes

We update this policy when the processing changes. The current version always carries the effective date shown above.