Privacy Policy

1. Notice at collection

We collect the following categories for the stated purposes:

We do not sell or share personal information for cross-context behavioral advertising, use it for targeted advertising, or collect sensitive personal information to infer characteristics. We do not use your information for a materially different, unrelated purpose without giving notice and obtaining consent when required.

2. Sources of information

We receive listing information directly from the bidder; payment status and contact data from Stripe after checkout; and technical data automatically from requests to our site, hosting provider, security controls, transactional email provider, and cookie-free Vercel Web Analytics. Stripe may return billing name, phone, or address fields during payment processing. Outthrone’s application does not persist those fields in its payer database.

3. How we use information and our legal bases

• Perform the contract: create checkout, settle bids, publish and rank listings, verify listing control, enable requested edits, and provide support.
• Pursue legitimate interests: secure the Service, prevent fraud, deduplicate clicks, measure aggregate page use, troubleshoot, and improve operations.
• Meet legal obligations: accounting, tax, sanctions, court orders, and lawful regulatory requests.
• With consent where required: send optional marketing or use any future non-essential storage or tracking technology.

Transactional messages about a payment, listing, security issue, or material policy change are not marketing. We will not use checkout contact information for promotional email unless we have a lawful basis and provide the legally required identification and opt-out.

4. Public information

The paid listing is intentionally public: business name, destination website, tagline, board, rank, claim strength, lifetime amount, click count, and reign or season history may appear on public pages and in search engines. Do not submit personal information in a business name, tagline, or destination URL. Email, Stripe identifiers, and billing data are not displayed publicly.

5. When we disclose information

We disclose information only as reasonably necessary to:

• Stripe, which independently operates checkout and processes payments;
• Vercel for hosting and cookie-free aggregate Web Analytics, Supabase for database infrastructure, and Resend for requested transactional access emails;
• professional advisers, auditors, and vendors bound to appropriate confidentiality and data-use restrictions;
• comply with law or protect rights, safety, security, users, and the public; or
• complete a financing, merger, reorganization, or sale, subject to appropriate safeguards.

We do not disclose payment-card numbers because Stripe processes and stores them. A click on a listing takes you to an independent site, which receives the normal information your browser sends to that destination under its own privacy practices.

6. Retention

• Paid bid and payment records: generally seven years after the transaction for accounting, tax, fraud, and dispute records.
• Public listing and leaderboard data: while the listing is active; limited historical winner and aggregate records may remain after removal.
• Contact and payer records: while needed to administer a listing, then generally no more than three years after the last activity unless law, a dispute, or a deletion request requires a different period.
• Listing-access links and codes: 15 minutes; they are single-use and retained only as one-way hashes until routine cleanup. Listing-management sessions expire after 12 hours.
• Application rate-limit and click-deduplication keys: in volatile memory for about one hour, subject to an instance ending sooner.
• Web Analytics: Vercel resets its hashed visitor value every 24 hours; aggregate reporting is available for the plan’s reporting window, currently one to 24 months, and may be retained longer by Vercel under its service terms.
• Infrastructure logs: according to the configured retention of our hosting and security providers, which we review and limit to what operations reasonably require.

We may keep a minimal record longer when required by law, necessary to establish or defend legal claims, detect fraud, honor an opt-out, or preserve an accurate financial ledger. We delete or deidentify information when the applicable purpose ends.

7. Your privacy rights

Depending on where you live and whether a particular law applies to us, you may request access to, correction of, deletion of, or a portable copy of personal information, and may appeal a denied request. You may also object to or restrict certain processing and withdraw consent prospectively. We do not discriminate for exercising a privacy right.

Email legal@outthrone.com with “Privacy Request” in the subject. Describe your request and the email, listing, and board involved. We will verify the request by matching information we already hold and may request limited additional evidence. An authorized agent may submit a request with proof of authority. We will respond within the period required by applicable law and explain any denial and appeal route.

Because we do not sell or share personal information or use targeted advertising, there is currently no sale, sharing, or targeted-advertising opt-out to exercise. We do not track people over time across third-party sites, so browser Do Not Track and Global Privacy Control signals do not change our current processing. We will honor recognized universal opt-out signals before engaging in any processing to which they legally apply.

8. Cookies and device storage

Outthrone sets one strictly necessary HttpOnly session cookie after a listing owner verifies an expiring email link or code. It contains a random identifier and expires after 12 hours. We do not use advertising cookies, analytics cookies, tracking pixels, or local-storage identifiers. We use cookie-free Vercel Web Analytics for aggregate page-view reporting; its daily visitor hash is not stored on your device, resets after 24 hours, and is not associated with an IP address in our reports. Stripe may use essential security and checkout technologies after you leave for its hosted checkout. See our Cookie Policy for the current inventory and change process.

9. Security and incident response

We use administrative, technical, and organizational safeguards appropriate to the data we handle, including access controls, hosted payment processing, transport encryption, input validation, rate limiting, payment-webhook verification, single-use authentication links, hashed codes and session identifiers, short expirations, and HttpOnly session cookies. No system is perfectly secure. If a breach triggers a legal notice obligation, we will notify affected people and authorities as required.

10. International use

The Service is directed to U.S. businesses and operated with infrastructure in the United States. If we process information subject to the EEA, UK, or another international privacy regime, we will use an applicable transfer mechanism and honor the rights required there. You may contact your local supervisory authority, but we encourage you to contact us first.

11. Children

The Service is for adult business representatives and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child submitted personal information, contact us and we will investigate and delete it as required.

12. Changes and contact

We may update this Policy as our practices or law change. We will post the new effective date and provide additional notice of material changes when required. Prior versions are available on request.

Controller/operator: Outthrone · legal@outthrone.com