Privacy Policy

Last updated: 13 September 2026

This policy explains what personal data nycsquarebid.lol (the "Site") collects, why, who it's shared with, and the rights you have. The Site is run by Riyad Bakhshiyev, trading as nycsquarebid.lol, based in Poland ("we", "us"), the data controller. You can contact us at hello@nycsquarebid.lol.

1. What we collect

• Account details. If you sign in with Google, we receive your name, email address, profile picture and Google account ID. If you sign up with email, we store your name, email address and password. Your password is stored only in encrypted (hashed) form by our sign-in provider, and we never see it.
• Ads and bids. The name, logo or ad image and link you submit, which spots you bid on, and the amounts and times.
• Payment details. Stripe processes payments. We don't see or store your full card number. Stripe tells us whether a payment succeeded, the amount, and the email and billing details you enter at checkout.
• Technical data. Our hosting providers record your IP address, browser type and the pages you request, to keep the Site secure and working.
• Browser storage. We use your browser's local storage to keep you signed in and to remember settings such as sound and your saved bids. We don't use advertising cookies or tracking pixels.
• Usage statistics. To understand how the Site is used, we record anonymous events: the pages viewed, which billboards are looked at, when a bid form is opened or a checkout is started, time spent on the page, the website that referred you, your country (worked out from your IP address) and your device type. We don't use cookies for this. Our analytics provider, DataFast, may keep a temporary identifier in your browser tab's session storage, which is cleared when you leave the site. Visits are grouped using a code calculated from your IP address and browser that changes every day and can't be turned back into your IP address; the IP address itself isn't stored. We also show how many people are on the Site right now and a running total of visits. These statistics aren't linked to your account.

2. How we use it, and our legal basis

• To run your account and your spots, including showing your ad and processing payments and refunds. Basis: performing our contract with you.
• To send emails about your account and purchases, such as verification codes, password-reset codes and receipts. Basis: performing our contract. We'll only send marketing emails if you agree to receive them.
• To keep financial records. Basis: our legal obligations under tax and accounting law.
• To keep the Site secure, prevent fraud and fix problems. Basis: our legitimate interest in running a safe, working service.
• To understand how the Site is used and improve it, through the anonymous usage statistics described above. Basis: our legitimate interest in improving the Site.

3. What's public

Anyone who visits the Site can see your logo or ad image on your billboard, and your name, link, profile name and the amount you paid in the listings and leaderboard. Please don't put personal information in your ad that you don't want to be public.

4. Who we share it with

We use these service providers to run the Site. They process data for us under data processing agreements:

• Supabase: database and sign-in.
• Resend: sending account emails, such as verification and password-reset codes.
• DataFast: cookieless website analytics (visits, traffic sources, countries and devices).
• Vercel: website hosting, and anonymous page-speed measurements (Speed Insights, no cookies).
• Stripe: payments. Stripe also acts as an independent controller for some payment data, under its own privacy policy.
• Google: Google sign-in, and the fonts used on the Site. Fonts load from Google's servers, which receive your IP address.

We don't sell your personal data or share it for advertising. We'll disclose it to authorities only if the law requires us to.

5. International transfers

Our providers store and process data in the United States as well as the EU. Where data leaves the EU, it's protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Account, ad and bid data: for as long as your account is open. We delete it within 30 days of your request to delete your account.
• Payment and invoice records: for as long as tax and accounting law requires, which can be up to 10 years.
• Server logs: for a short period set by our hosting providers.
• Usage statistics: up to 13 months.

7. Your rights

You have the right to access, correct or delete your personal data. You can also ask for a copy of it in a portable format, restrict or object to how we use it, and withdraw consent you've given. To use any of these rights, email hello@nycsquarebid.lol. We'll reply within one month. You can also complain to the data protection authority in the EU country where you live.

8. Children

The Site isn't meant for anyone under 18, and we don't knowingly collect data from children. If you think a child has given us personal data, please contact us and we'll delete it.

9. Security

We use encrypted connections (HTTPS) and limit who can access personal data. No system is completely secure, but we work to protect your data and will tell you about any breach where the law requires it.

10. Changes to this policy

We may update this policy. The new version will be posted here with a new date, and we'll tell you about important changes by email or on the Site.