Privacy Policy

This Privacy Policy explains how BidOrbit collects, uses, and shares information when you visit the site, click a listing, or pay for a rank. It sits alongside our Terms of Service.

Who is responsible

BidOrbit, operated as an individual business based in India, is responsible for personal data processed through the Service.

Address: Samriddhi, Bhayander East, Thane, Maharashtra, India - 401105
Email: bidorbits@gmail.com

What we collect

• Listing data. The URL or handle you submit, the category, the bid amount, and the public name, logo, and description we resolve for that destination (via Google favicon and unavatar.io lookups, or the identity you provide).
• Checkout data. Payment confirmation identifiers from Dodo Payments (order and checkout IDs) so we can place the ranking, and the email address you gave Dodo Payments at checkout, which their confirmation passes back to us. We keep that email privately, linked to your listing, so we can reach you about your own payment or listing - it is never shown on the board and never published. We never see or store your card number: card details and the rest of your billing identity are collected and held by Dodo Payments, not by us - see their own privacy notice.
• Listing performance data. When someone clicks through to a listing's destination, we add one to that listing's public click count. That count is not linked to you: your IP address is used only to stop one visitor inflating it, held for that purpose in a short-lived counter that expires within the hour, and is never stored against the click itself.
• Technical data. Standard request data such as user agent, referrer, and IP address, processed to operate and secure the Service and to rate-limit abuse.
• Analytics data. Page views and basic usage events, sent to our analytics processor, PostHog, to understand traffic and improve the Service. This does not use a persistent cookie or local-storage identifier - it is not linked to who you are across separate visits.
• Messages you send us. If you email a notice, a correction, or a privacy or grievance request, we keep that correspondence as needed to respond and to keep a record.

Cookies and local storage

We do not run a cookie-consent banner because we do not use advertising or cross-site tracking cookies. Browsing and bidding on the public board sets no cookie. It does write two values into your own browser's storage, neither of which is an identifier and neither of which is ever sent to us: your display theme choice, kept in local storage under bidorbit.theme as nothing but the word light or dark so the site opens the way you left it; and, if you complete a purchase, a short-lived key in session storage that lets the page finish showing your result if you reload during checkout - that one is discarded when you close the tab. Clearing site data in your browser removes both. The one cookie the Service sets is a strictly necessary sign-in session cookie for our own admin tool, used by site operators, not by bidders or visitors. Our analytics processor, PostHog, is configured to keep its visitor identifier in memory only for the duration of your visit - it is not written to a cookie or to local storage, and it does not persist once you close the tab.

Why we use this data

• Contract. To take payment, create or raise a listing, display rank, and provide the Service you asked for.
• Legitimate interests. To keep the board fair (rate limits, abuse prevention), display public listing metadata, debug outages, and defend legal claims.
• Legal obligation. To keep tax, accounting, and grievance records where the law requires it.

Public listings

Rank, spend, names, logos, and destination links on the board are public and can be seen by anyone, including search engines. Do not list a destination if you do not want that information shown.

Who we share data with

• Dodo Payments - checkout and payment confirmation.
• Hosting, database, and edge infrastructure needed to run the Service.
• Identity lookup helpers (favicon and avatar services) so we can show a name and picture for your listing.
• Professional advisers, authorities, or a buyer of the Service, only if required to comply with law, enforce the Terms, or transfer the project.

We do not sell your personal data.

Your rights

If you are in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) gives you the right to access, correct, and erase your personal data, to withdraw consent, to nominate someone to exercise your rights in the event of death or incapacity, and to file a grievance with us and, if unresolved, with the Data Protection Board of India.

If the GDPR or a similar law applies to you (for example, if you are in the European Economic Area), you may additionally ask us to access, correct, delete, or export personal data we hold about you, restrict or object to certain processing, and lodge a complaint with your local supervisory authority.

To exercise any of these rights, email bidorbits@gmail.com or use our Contact page. We may need enough information to find your data. Public listing content that is also on your own website or handle is not made private just by appearing on the board; you can ask us to remove the listing.

How long we keep it

• Public ranking entries stay while the listing is on the board and may remain in backups or activity history for a limited time after removal.
• Payment identifiers, amounts, and the checkout email attached to a listing are kept as long as needed for accounting, tax, and dispute handling.
• Raw payment-provider notification payloads are kept for a short retention window for debugging, then stripped out automatically, leaving only the record that the event happened. Payloads attached to a disputed payment are kept for a longer window, because a dispute can be raised months after the charge.
• Correspondence and grievance records are kept as long as needed to resolve the matter and meet legal record-keeping requirements.

Cross-border transfers

Some of our processors (for example Dodo Payments or hosting infrastructure) may be located outside India. Where we rely on them, we use the safeguards those processors make available, such as standard contractual clauses or an equivalent mechanism.

Children

The Service is for adults. We do not knowingly collect personal data from children. If you believe a child has used the Service, contact us and we will delete the data we can identify.

Changes

We may update this policy when the Service or the law changes. The date at the top of this page is the current version. If a change is material, we will post the updated policy here.