BidletsPrivacy Policy
In short: we collect what's needed to run auctions: bidders' email addresses and bids, and organizers' account details. We share bidders' details only with the organizer of the auction they bid in. We never see or store card or bank details. We use analytics to understand how Bidlets is used and how people find us. We don't sell personal information.
Who this covers
Organizers are people who sign in to run auctions. Bidders are people who bid using a Bidlets bid box on an organizer's website. For bidders, the organizer decides what to do with your information after the auction; Bidlets processes it on the organizer's behalf to run the auction.
What we collect
- Bidders: your email address, the items you bid on, bid amounts and times, the web page you bid from, and, to prevent abuse, your IP address and browser information. If you win, the payment method you chose on the payment page, any tip you chose, and whether you reported or the organizer recorded your payment.
- Organizers: your email address, the account and auctions you create, team members you invite, payment-method settings (such as a Venmo username), and records of when you accepted these terms (including IP address and browser). If you connect Square, an access token for your Square account, stored on our servers only.
- Technical logs: our hosting provider records basic request logs (such as IP address and pages requested) for security and troubleshooting.
We do not collect card numbers or bank details. Payments happen on the payment provider's own site.
How we use it
- To run auctions: record bids, show the current bid, send bid confirmations, outbid notices, results, winner and payment emails.
- To bill organizers for tips and, as described in the Terms, to tell winners if their tip wasn't passed on.
- To keep the Service secure: prevent spam, fraud and abuse (for example rate limits).
- To operate and improve the Service, measure how it's used and how people find it (including marketing campaigns), and to contact organizers about their account.
Who we share it with
- The organizer of an auction sees the email address, bids and payment status of bidders in that auction.
- Winners see the organizer's contact address on the payment page and in emails.
- Service providers who host and send email for us (Google Cloud and Google Workspace), provide analytics (PostHog), and payment providers an organizer chooses (such as Square), only as needed to provide the Service.
- Legal reasons: if required by law, or to protect people or the Service.
We don't sell personal information, and we don't share it across organizers.
Analytics
On Bidlets pages (our website, sign-up and sign-in, the organizer app and winners' payment pages) we use PostHog analytics. It records pages visited, clicks, the device and browser type, approximate location from your IP address, how you arrived (for example the referring site or campaign tags in the link), and actions such as signing up. Once an organizer signs in, this activity is linked to their account email. Secret values in links (such as payment-link keys) are removed before anything is sent.
The bid box on organizers' websites doesn't load analytics or set cookies. Instead, our server records events such as a bid box being viewed, a bid placed or a payment recorded. Bidders appear in these records under a pseudonymous ID derived from their email address; we don't send bidders' email addresses to our analytics provider.
Cookies and storage
- Sign-in: organizers get one cookie that keeps them signed in.
- Analytics: on Bidlets pages, PostHog uses a cookie and browser storage to recognize returning visitors and remember how they first arrived.
- Bid box: remembers your email address and your last bid on your own device (browser storage) so you don't have to retype them. It sets no cookies.
How long we keep it
- Bid and auction records: while the organizer's account is active, so organizers can keep their records. Organizers can ask us to delete an auction.
- IP address and browser information on bids: removed 90 days after the auction closes.
- Sign-in links: deleted automatically within a day after they expire.
- Failed-email retry records: deleted automatically after 14 days.
- Backups: kept for up to 8 weeks.
Your choices and rights
You can ask us to access, correct or delete your personal information by emailing notifications@bidlets.com. Bidders can also contact the organizer of the auction directly. Depending on where you live (for example in the EU, UK or California), you may have additional rights, including to object to processing or to complain to a data protection authority. We'll respond within the time the law requires.
Security
Data is stored with Google Cloud, encrypted at rest and in transit. Access is limited to what's needed to run the Service. No system is perfectly secure; tell us at notifications@bidlets.com if you find a problem.
Children
The Service isn't intended for children under 13, and we don't knowingly collect their information.
Changes
We'll post updates here and change the version above. For material changes, organizers will be asked to review them when they next sign in.
Contact
Wild Nisse Ventures · notifications@bidlets.com