1. Controller
The data controller for outbidception.lol is Tanomedia, Portugal. For anything privacy-related, write to hello@tanomedia.com.
2. What we collect and why
Listing data you submit (published publicly)
The link, listing name, optional handle and optional message you enter in the order form. This is the product: it is displayed publicly on the arena, in share images and in the throne history. Tracking parameters are stripped from links before publication. Do not submit anything you are not happy to see on a public list.
Payment data
Payments are handled by Stripe on a Stripe-hosted checkout page. Stripe collects your card details and an email address for the receipt; we never see or store card numbers. We store the Stripe session identifier, the amounts paid and the timestamps so we can deliver the placement, keep accounting records and handle disputes.
Optional alert email
If you choose to enter an email address for outrank alerts, we store it with your listing and use it only to tell you when your listing has been pushed down. Alerts are sent via Resend. Every alert includes a way to stop them.
Presence
To show how many people are looking at the board, your browser stores a random identifier in localStorage and sends periodic heartbeats. The identifier is not linked to your listing or payment. IP addresses are used transiently in memory for rate limiting and are not written to our database.
Server logs and analytics
Our hosting provider, Vercel, keeps short-lived request logs (IP address, user agent, requested URL) for security and debugging. We use Vercel Web Analytics, which is cookieless and aggregates page views without identifying you.
Favicons and click-throughs
Site icons shown next to listings are loaded by your browser from Google's favicon service, so Google sees that request. When you click a listing, we count the click on our side before redirecting you; we store the count, not who clicked.
3. Legal bases
- Contract (GDPR art. 6(1)(b)): listing data, payment records, delivery of the placement.
- Legitimate interest (art. 6(1)(f)): presence counts, rate limiting, server logs, aggregate analytics, fraud and abuse prevention.
- Consent (art. 6(1)(a)): outrank alert emails. You can withdraw at any time.
- Legal obligation (art. 6(1)(c)): retaining accounting and tax records.
4. Retention
- Public listing data: for as long as the arena exists, or until removed for moderation or at your verified request.
- Payment records: for the period required by Portuguese accounting and tax law (currently up to 10 years).
- Alert email addresses: until you ask us to delete them or withdraw consent.
- Presence identifiers and heartbeats: minutes. Server logs: per Vercel's default retention, typically days.
5. Processors and international transfers
We share data only with providers that help us run the service:
- Stripe: payment processing.
- Vercel: hosting, logs, cookieless analytics.
- Turso: database hosting.
- Resend: transactional alert emails.
- Google: favicon service, requested directly by your browser.
Some of these providers process data in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified and otherwise on the European Commission's Standard Contractual Clauses.
We do not sell personal data, we do not run advertising networks, and we do not set tracking cookies. The only thing we are selling is a row on a list, to you.
6. Your rights
Under the GDPR you may request access to your data, rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interest. Email hello@tanomedia.com; we reply within one month. Note that erasing a listing also removes the placement, and payments remain non-refundable as described in our Refund & Dispute Policy. Accounting records are kept for as long as the law requires even after an erasure request.
You also have the right to lodge a complaint with a supervisory authority, in Portugal the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or with the authority in your own EU country.
7. Children
The service is for adults. You must be 18 or older to submit a listing or make a payment. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.
8. Changes
We may update this policy. The effective date at the top changes when we do, and material changes will be noted on the site. Our Terms of Service describe the commercial side of the deal.