← Back to bidday.lol

Privacy Policy

Last updated 31 August 2026

1. Who is responsible for your data

Bidday (bidday.lol) is operated by an individual based in Poland, who is the data controller for the purposes of the UK and EU General Data Protection Regulation. Write to the address below and we will give you the operator's name on request.

For anything in this policy — access, deletion, questions, complaints — write to hello@bidday.lol.

2. What we collect

Everything below comes either from the bid form or from the payment itself. We do not buy data about you, and we do not enrich or profile what you give us.

Data	Why	Visibility
Email address	It is your identity on the site. Your payments for a day are added together under it, and Stripe sends your receipt to it.	Never public
Company name	Displayed as the advertiser on the day you win, and in the public activity feed.	Public
Headline, link, logo	The ad itself, shown on the homepage on your day.	Public
Amounts and dates	Each payment, your running total and the day you bid on. This is what makes the auction verifiable to everyone bidding.	Public
Stripe payment reference	Ties a payment to your balance, prevents double-crediting, and lets us answer disputes and refund requests.	Internal only
IP address	Rate limiting only — to stop one machine hammering the payment endpoint or the visitor counter. Automatically deleted within one hour.	Never public

We do not collect names of individuals, postal addresses, phone numbers, or anything about you beyond the above.

3. Card details never reach us

Payment is handled entirely by Stripe. The card fields on this site are rendered inside an iframe served by Stripe, so your card number, expiry and CVC go straight from your browser to Stripe and are never transmitted to, processed by, or stored on our servers.

Stripe is an independent controller of that payment data and runs its own fraud checks, which include setting storage in its own frame and collecting technical signals about your device. That processing is governed by Stripe's privacy policy. We receive back only the payment reference, the amount, the status and the email you entered.

4. No cookies, no analytics, no tracking

This site sets no cookies and loads no analytics, advertising or social tracking scripts. The only data stored in your browser is two first-party local-storage entries:

• bidday.myBids — remembers which days you bid on, so the site can highlight them for you. There are no accounts, so this lives only in your browser.
• bidday.visited — a date, so the public visitor counter is incremented at most once per day per browser.

Neither is sent to us, neither identifies you, and clearing your browser data removes both. The visitor counter is a single aggregate number — we do not store per-visitor records.

5. What is public, and why it cannot simply be erased

Bidday is a public auction. Your company name, headline, link, logo, each payment amount, your running total and the day concerned are visible to everyone, appear in the live activity feed, and remain part of the site's record after the day has passed.

That permanence is deliberate and it is what other bidders rely on: it is how anyone can verify what a day actually cost and that they were genuinely outbid. Removing entries retrospectively would make the auction unverifiable.

So if you ask us to erase your data, we will remove or anonymise your display name, headline, link and logo, and we will delete your email from our records where we are not required to keep it. The amount, date and day of each payment will remain, unattributed, as part of the public auction record and of our accounting records. See section 9.

6. Our legal grounds for processing

• Performance of a contract — your email, company name, ad content and payment amounts. Without them we cannot credit your bid or run your ad.
• Legal obligation — retaining payment records for accounting and tax purposes under Polish law.
• Legitimate interests — rate limiting by IP to keep the site available; keeping payment records to answer chargebacks and refund claims; the aggregate visitor counter. We have weighed these against your interests and consider them proportionate, since the data involved is minimal and short-lived.

7. Records we keep in case of a payment dispute

Every payment on Bidday is final and non-refundable, including when you are later outbid. That is set out before you pay: it is stated on the homepage, in the Terms & Refund Policy, and you must tick a box confirming you understand it before the card form will accept your payment.

Because of that, and so we can respond if a payment is disputed with your bank, we retain for each payment:

• the Stripe payment reference, the amount and the exact time it was taken;
• the email address, company name and ad content submitted with it;
• the day it was placed on and the running total it produced;
• the version of the Terms & Refund Policy published at the time you paid.

If you open a chargeback, we will provide this material — together with the corresponding public feed entry — to Stripe and to your card issuer as evidence of what you purchased and of the terms you accepted. Being outbid is the documented mechanic of the site and is not a failure to deliver.

If something has genuinely gone wrong — a duplicate charge, a payment that was taken but never credited — email us first at hello@bidday.lol with the payment reference. We would rather fix it directly than argue it through your bank.

8. Who else processes your data

We use a small number of service providers, each bound to process data only on our instructions:

• Stripe — payment processing, fraud prevention and receipts.
• Supabase — our database, file storage and server-side functions. Our project is hosted in the European Union (Ireland).
• Vercel — hosting and content delivery for the site itself, including standard server logs.
• Namecheap — forwards mail sent to our @bidday.lol address.

We do not sell your data, we do not share it with advertisers or data brokers, and we do not use it to train anything. Uploaded logos are stored in a public bucket, because they have to be displayed publicly — do not upload an image you would not want to be public.

Stripe and Vercel may process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses.

9. How long we keep things

• Public bid and ad records — indefinitely, as the permanent record of the auction (subject to section 5).
• Payment and accounting records — five years from the end of the year in which the payment was made, as required by Polish accounting and tax law. We cannot delete these earlier, even on request.
• IP addresses — deleted automatically within one hour. They are never linked to a payment.
• Emails you send us — as long as needed to deal with the matter, and afterwards only where it relates to a payment or a dispute.

10. Your rights

If you are in the EEA or the UK you have the right to ask us for a copy of the data we hold about you, to correct it, to have it erased, to restrict or object to how we use it, and to receive it in a portable form.

Email hello@bidday.lol from the address you paid with — that is how we identify you, since there are no accounts. We will respond within one month.

Two limits, stated plainly: we cannot delete accounting records before the retention period above expires, and we cannot remove the amount and date of a payment from the public auction record. Everything else we can remove or anonymise.

If you think we have handled your data badly, please tell us first — but you also have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or to the authority in your own country.

11. Security

The site is served over HTTPS only, with a content security policy that restricts which scripts may run. Card data is out of scope by design, since it never reaches us. Logo uploads use single-use signed slots issued only at the moment a payment is created, so the storage bucket does not accept anonymous writes.

No system is perfect. If you find a security problem, please report it to hello@bidday.lol rather than disclosing it publicly.

12. Children

Bidday is a service for businesses and is not directed at children. Do not use it or send us data if you are under 18.

13. Changes to this policy

We may update this policy. The version in force is the one published here at the time you pay, and the date at the top shows when it last changed.

14. Contact

All privacy questions, data requests, refund queries and takedown reports: hello@bidday.lol.