1. Controller
[Swedish operator entity — configure before launch], [Registered address — configure before launch], is the controller for StateBid application data. Privacy requests: eaconsulting.supp@gmail.com.
2. Public listing data
We publish the normalized website or X destination, cached title, description, logo, state standing totals, verified activity, and aggregate click count. This data is necessary to provide the paid-placement marketplace and remains public while the service and legal record-keeping needs continue.
3. Payment data
StateBid stores internal bid attempts, amounts, timestamps, state and listing references, and Stripe Session, PaymentIntent, Charge, refund, and dispute identifiers. We do not receive or store complete card numbers. Stripe independently processes Checkout information under its own privacy terms.
4. Anonymous click measurement
When a visitor follows a sponsor link, StateBid sets a random first-party visitor cookie and stores a salted one-way hash scoped to the visitor, listing, state, and UTC day. It counts at most one click per combination per day. The cookie does not contain a name, email, or listing preference.
5. Lifetime visitor count
When the public map loads, StateBid uses the same random first-party visitor cookie to maintain a salted one-way hash and increment an aggregate lifetime visitor count. It does not store the cookie value itself, IP address, name, email, or browsing history for this statistic.
6. Security and operational data
We process short-lived IP and browser signals for rate limits, abuse prevention, Turnstile checks, webhook logs, error monitoring, moderation records, and operator-authentication audit. Public reports can be submitted without an account or email.
7. Retention
- Temporary listing previews and unused uploads expire after one hour and are removed through automated cleanup.
- Abandoned bid attempts are retained for up to 30 days for reconciliation and then removed or minimized.
- Raw deduplicated click events are retained for 30 days; non-identifying daily aggregates may be kept longer for public statistics.
- Security and ordinary error logs are retained for up to 90 days unless an incident requires longer investigation.
- Verified payment, reversal, moderation, and accounting records are retained for the service lifetime and any longer period required by applicable law.
8. Processors and transfers
Vercel provides application hosting, delivery, and logo object storage. Turso provides the hosted libSQL database. Stripe provides payment processing, fraud tools, receipts, and optional tax services. Cloudflare Turnstile may provide abuse prevention when enabled. These providers may process data internationally using their contractual transfer mechanisms. Exact entities and regional settings must be documented before live launch.
9. Legal bases
We process transaction and placement data to perform the agreement; fraud, security, measurement, and moderation data for legitimate interests; records to meet legal obligations; and optional technologies on consent where applicable.
10. Your rights
Depending on the GDPR and local law, you may request access, correction, erasure, restriction, portability, or object to processing, and may complain to the Swedish Authority for Privacy Protection (IMY). Public listing immutability does not override mandatory privacy rights; requests are assessed against legal and transactional record obligations.
11. No sale of personal data
StateBid does not sell bidder or visitor personal data and does not use application data to build cross-site advertising profiles.