Privacy

We store the account name, email address and listing content you provide, along with ownership and verification records. Listings, public boost labels, ranking stake and aggregate click counts are visible to visitors. Password-based accounts use stored password hashes, not readable passwords.

Card entry and processing take place through Stripe. Our application stores transaction references, amounts, status and payer contact information needed for orders and support, not full card numbers.

Authentication cookies keep you signed in. Session records can include your IP address, browser identity, user ID and expiry time. These authentication records are separate from the hashed data used to count outbound clicks. Hosting infrastructure also handles request data to deliver and protect the service.

The listing click counter does not store a raw IP address in its click-event records. It stores a salted hash derived from the address, listing and UTC date, plus the referring host and country code when available. Known bots are excluded from the public count and counted separately in daily aggregates.

A daily cleanup job removes click-event records older than 48 hours. With the scheduled daily run, records normally remain for up to about 72 hours; a delayed job can retain them longer. Daily aggregate counts remain. Hashing is pseudonymisation, not a guarantee of anonymity. Read the measurement method and limitations.

The service uses Stripe for payments, Vercel for hosting and Neon for the database. Transactional email delivery uses Resend when configured; delivery requires the recipient address and message content. These providers process information needed for their respective functions.

When you open an advertised destination or load an image from an external provider, your browser contacts that provider. Its own privacy practices apply. A listing is not a claim that BidToViral controls the destination's data handling.

Contact thraijuna@gmail.com to request access, correction or deletion of your personal information, or to ask about retention and applicable rights. We may need to verify your identity before acting on a request. This contact route does not limit any rights available under applicable law.

Deleting an account does not automatically erase separate listing contact details or transaction records. Payment references and payer information may remain where needed for financial records, disputes or legal obligations. A deletion request is reviewed across these records rather than treated as a promise of automatic anonymisation.