Privacy Policy

• What you give us: the URL you submit and your contact email. That is the whole submission form.
• What payment creates: Stripe checkout and payment identifiers, amounts, and timestamps. Your card details never reach our servers - payment runs entirely through Stripe's hosted checkout.
• What the service generates: a screenshot of your site, the auto-made promo video, and screening records (the verdict and its reasons). Screens and videos are stored in Cloudflare R2.
• What is collected automatically: your IP address for rate limiting and security logs, a one-way hashed visitor signature (never the IP itself) that lets the public homepage counter tell visits apart without cookies, and, when enabled, privacy-friendly page analytics from Plausible, which is cookieless and does not identify individuals.

• Operate the leaderboard and show placements where they rank.
• Screen every submission against our halal and safety policy.
• Process payments through Stripe and issue receipts.
• Generate and deliver your promo video by email.
• Send transactional email only: receipts, status changes, video delivery.
• Rate-limit and block abuse.
• Understand aggregate usage of the site.

We do not sell or rent your data, we do not run advertising trackers, and we do not send marketing email.

Where the GDPR or UK GDPR applies: we process your data to perform our contract with you (the placement, the video, the payment records), for legitimate interests (security, rate limiting, aggregate analytics), or with your consent (updates you explicitly ask for). Where the CCPA applies: nothing we do constitutes a sale or sharing of personal information as those terms are defined.

• Stripe: payments. Stripe handles card data under its own privacy policy.
• Cloudflare: site delivery, file storage (R2) for screenshots and videos, and transactional email sending.
• Plausible Analytics: cookieless aggregate page analytics (when enabled). See their privacy policy.
• Cloudflare Turnstile: bot protection on the submit form.
• Social platforms: when your listing is featured, our posts appear on Facebook, Instagram, and YouTube, each governed by their own policies.

Screening runs on infrastructure we control. Every processor handles data only to deliver its part of the service.

The public site sets no advertising or tracking cookies, so there is no consent banner. For visitors, Cloudflare Turnstile may set a functional anti-bot token on the submit form. Our team's admin pages use a single functional session cookie. Analytics (when enabled) is cookieless and cannot identify you across visits.

• Submissions and screening records: up to 12 months after the window they belong to.
• Payment records: as long as tax and accounting law requires.
• Screenshots and promo videos: kept while your placement is live, then per storage needs. The download link in your delivery email stays live for at least 7 days - download the video to keep it.
• Rate-limit and security logs: up to 12 months.

You can ask us to access, correct, export, or delete your personal data, or to stop processing it, by emailing [email protected]. We answer within 30 days. We may keep records the law requires us to hold - for example payment history - even after a deletion request. California residents have the same rights plus the right not to be discriminated against for exercising them.

All traffic runs over TLS. Secrets live in a managed secret store, never in code. Access follows least privilege, backups are encrypted, and if a breach ever affects your data we follow a 72-hour notification process.

Bid Spotlight is for adults: 18+. We do not knowingly collect personal data from minors. If you believe a minor submitted data, write to us and we will delete it.

Our processors operate globally, so your data may be processed outside your country. They do so under their data-protection terms, and we use them only to deliver the service.

We may update this policy as the service evolves. The version live at bidspotlight.com/privacy applies to your use at the time. Material changes get a new last-updated date at the top of this page.

Any privacy question, request, or complaint: [email protected]. A person reads every message.