Privacy Policy

Last updated: 28 August 2026

1. Controller

The data controller for BidPage (bidpage.app) is MEDUSH LTD, United Kingdom. Contact: privacy@bidpage.app.

2. What we collect

• Sellers: email address, auction content you publish (title, description, proof link, delivery terms), and your Stripe connected-account ID.
• Bidders: email address, bid amounts and times, and Stripe identifiers (customer and payment-method IDs).
• Card details never touch our servers. They are collected and stored by Stripe, our payment processor.
• Technical data: standard server logs (IP address, user agent, timestamps) kept briefly for security and abuse prevention.

3. Why we process it (legal bases)

• Running the auction and charging the winner — performance of a contract.
• Transactional emails (outbid, won, payment, delivery) — performance of a contract. We do not send marketing email.
• Fraud prevention, security and enforcing our rules — legitimate interests.
• Tax and accounting records — legal obligation.

4. Sharing

We share data only with the processors needed to run the service: Stripe (payments and seller identity verification), Cloudflare (hosting, database, security), Netlify (website hosting) and Resend (transactional email). In open auctions, other visitors see your bid amount alongside a masked version of your email. Sellers of an auction you win receive the information needed to deliver to you. We do not sell personal data.

5. International transfers

Some processors store data outside the UK/EEA (notably in the United States). Transfers rely on the providers' standard contractual clauses and equivalent safeguards.

6. Retention

Auction and transaction records are kept for as long as needed to operate the service and then for up to 6 years to meet tax, accounting and dispute obligations. Server logs are kept no longer than 30 days. You can ask us to delete data sooner where no such obligation applies.

7. Cookies and local storage

We do not use advertising or analytics cookies. The site stores your email and bid tokens in your own browser's local storage so you can revise your bids; this never leaves your device except to authenticate your requests to us. Stripe sets the cookies it needs for secure payment processing.

8. Your rights

Under UK and EU data-protection law you can request access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict certain processing, and complain to a supervisory authority (in the UK, the ICO). Write to privacy@bidpage.app; we respond within one month.

9. Changes

Updates to this policy will be posted here with a new date.