Privacy & Cookie Policy

This page explains what personal data Billboard FC processes, why, who helps us process it, and what rights you have under the EU General Data Protection Regulation (GDPR). Short version: we set no cookies, we run no trackers, and we keep only what is needed to run the auction and show the winners. Last updated 15 September 2026.

Draft. The highlighted details are still to be filled in, in lib/site.ts. Have the text reviewed before accepting real payments, and update section 6 if you ever add analytics or embedded third-party content.

1. Data controller

YOUR NAME OR COMPANY, ADDRESS, VAT number VAT NUMBER. Contact for privacy matters: EMAIL.

2. What we process and why

Bid data. When you bid you give us a brand name, a website address, an amount and, if you like, a creative (image, GIF or video). We use these to run the auction and, while you lead or hold a spot, to display your brand on the billboard, in the list of latest bids and on the leaderboard. This information is public by design: everyone visiting the site can see it. Legal basis: performance of the contract you enter into by bidding, art. 6(1)(b) GDPR.

Email address. You give us an email address with your bid. We use it only to send the payment link if you win, or if the offer passes to you, and to answer questions about your bid. It is never shown on the site and never used for marketing. Legal basis: contract, art. 6(1)(b).

Payment data. Payment happens on Stripe's checkout page and card details never reach our servers. Stripe tells us the payment identifier, the amount and whether it was paid or refunded, which we keep in order to know who won a spot and to handle disputes. Under Managed Payments, Stripe is the seller of record and an independent controller for the purchase, its invoicing and its tax. Legal basis: contract, art. 6(1)(b), and our legal obligations on accounting and tax, art. 6(1)(c).

Technical data. Our hosting provider records standard server logs: IP address, time, page requested, browser type. We use them only to deliver the site and to investigate faults or abuse. Legal basis: our legitimate interest in running a secure service, art. 6(1)(f).

Correspondence. If you write to us we keep the exchange for as long as it takes to handle the matter. Legal basis: legitimate interest, art. 6(1)(f), or contract, depending on the request.

We do not build profiles, we make no automated decisions with legal effects, and we never sell or rent personal data.

3. Who processes data for us

• Vercel Inc. (USA): hosting of the site and its server code, server logs, and storage of uploaded creatives through Vercel Blob.
• Neon Inc. (USA; database region REGION, e.g. eu-central-1 Frankfurt): the database holding rounds, bids and current placements.
• Stripe Payments Europe, Ltd. / Stripe, Inc. (Ireland / USA): checkout, payment, invoicing and tax as merchant of record. Independent controller for the purchase; see Stripe's privacy policy.
• Resend, Inc. (USA): delivery of the payment-link emails.

These providers may process data outside the European Economic Area, mainly in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. Choosing an EU region for the database keeps the auction data itself in the EEA.

4. How long we keep it

• Bids that led or won a spot, with the brand, website and creative: for as long as the site runs, because the history of the rounds and the leaderboard are part of the service. You can ask us to remove your brand from past rounds; see section 5.
• Bids that were outbid, cancelled or not paid in time, including the email address given with them: 12 months, then deleted.
• Payment records: 10 years, as tax and accounting law requires.
• Server logs: as kept by Vercel, typically days to weeks.
• Correspondence: 24 months after the matter is closed.

5. Your rights

You can ask us to give you access to your personal data, to correct it, delete it or export it, to restrict or object to its processing, and you can withdraw consent wherever processing rests on consent. Write to EMAIL and we answer within one month. Two limits are worth knowing: a brand name and website that led or won a spot are shown publicly as part of the service that was bought, and payment records must be kept for the legal retention period even after everything else is deleted.

You also have the right to complain to a supervisory authority. In Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it); elsewhere in the EU, the authority where you live or work.

6. Cookies and similar technologies

This site sets no cookies. We use no analytics, no advertising tags, no fingerprinting and no social media buttons. Fonts and every other file are served from our own domain, so opening the site sends no request to any third party. The notice at the bottom of the page is informational: under the ePrivacy rules consent is needed only for non-essential cookies and similar storage, and we have none.

The one thing we keep in your browser is a single local-storage entry recording that you closed that notice, so it does not reappear on every page. It holds no identifier, is never sent anywhere, and exists only to honour your choice. Clearing your browser data removes it.

Two things happen outside this site and follow their own provider:

• When you win and open your payment link you are taken to Stripe's checkout page, which sets its own strictly necessary cookies to complete the payment and prevent fraud. See Stripe's cookie policy.
• After paying, Stripe sends you back here with a bid identifier in the address bar. We read it once to show you the result and then remove it from the address. Nothing is stored.

If you upload a creative it is stored on Vercel Blob at a public address, because it is meant to be shown in the stadium. Please do not upload images or videos containing other people's personal data without their permission.

7. Security

The site is served over HTTPS only. Card data is handled exclusively by Stripe, a PCI DSS Level 1 provider. Access to the database and to file storage is restricted to the operator through credentials that never reach the browser. Every bid decision is recorded so that disputes can be traced.

8. Children

The service is for businesses and adults. We do not knowingly process data of anyone under 18. If you believe we have, write to us and we will delete it.

9. Changes

If we change what we process, who processes it or how, we update this page and the date at the top. Substantial changes that affect you are announced on the site before they apply.