Privacy Policy

BIDPOPULAR LLC, a limited liability company registered in the State of Washington, USA, operates BidPopular and is the controller of the personal data described here. Contact: BidPopAdmin@gmail.com.

• Identifiers & account data — email address, handle/username, avatar, profile bio and links, password hash (we never see your plaintext password).
• Commercial data — credit purchases, wallet balance and transactions, bids placed, slots won, receipts and disputes. Card details go directly to Stripe; we store only a payment reference and the last-four/brand Stripe returns.
• User content — clips you submit for live airing and their metadata (duration, upload state, moderation status), plus chat messages you post.
• Technical & usage data — IP address, device and browser type, app and player events, playback health/sync diagnostics, timestamps, and error logs.
• Communications data — email and push notification preferences, delivery status, and support or moderation correspondence.

We do not knowingly collect special-category (sensitive) data, and we ask that you not include it in bios, chat, or clips.

To create and secure your account; run auctions and deduct credits; process payments and refunds; transcode and air your clip live; moderate content and enforce our policies; send transactional emails and notifications you have enabled; produce aggregate creator analytics (views, unique viewers, sentiment); detect and prevent fraud, abuse, and security incidents; and meet legal, tax, and accounting obligations.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

Clips air live and are not published by us for on-demand playback. Anything visible in your clip while it airs — faces, voices, locations, personal details — is broadcast publicly to viewers at that moment and may be captured by third parties outside our control. Your handle, avatar, bio, bid activity, and chat messages are also public within the Service.

We share data only with vetted providers acting on our instructions: Supabase (authentication, database, storage), Stripe (payments), Cloudflare (video ingest/transcoding and delivery, CDN and security), and our transactional email and web-push providers. We may also disclose data to comply with law, respond to lawful requests, enforce our Terms, protect rights and safety, or in connection with a merger or asset sale. We do not sell or rent personal data.

We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires. When a retention period ends, data is deleted or irreversibly anonymized for aggregate statistics.

• Account and profile (email, handle, display name, avatar, bio, links) — for the life of your account, then deleted within 30 days of account closure, except where a longer period below applies.
• Wallet, credit, and payment records (transactions, top-ups, receipts, disputes) — up to 7 years after the transaction, for tax, accounting, chargeback, and fraud-prevention obligations. These survive account deletion because we are legally required to keep them.
• Clips and uploaded media — kept only to schedule and air your slot; source files and transient transcodes are removed on our ordinary technical schedule after the clip airs, is rejected, or is deleted by you (typically within 30 days). We do not publish an on-demand archive.
• Bids, auction results, and win records — retained as part of the transaction history above; the public bid history is de-identified when an account is deleted.
• Chat messages and moderation records — up to 24 months, or longer for a specific record that is subject to an open report, appeal, dispute, or legal hold.
• Security, access, and admin audit logs — 12–24 months, for abuse detection and accountability.
• Analytics and playback-health events — up to 14 months in event form, then retained only in aggregate, non-identifying form.
• Email delivery, suppression, and unsubscribe records — kept as long as needed to honor your choices and prove compliance; suppression entries are retained indefinitely so we do not email an address that opted out or bounced.
• Backups — encrypted backups roll off on a standard schedule (currently up to 90 days). Deleted data may persist in a backup until that copy expires, and is not restored into live systems.

You can delete your account from your account settings, or ask us to delete, access, correct, or export your data using our privacy rights request form. Here is what happens next:

1. Acknowledgement. You get a reference number as soon as the request is logged.
2. Verification. We confirm the request comes from you — normally by matching your account email — before we act. Authorized agents must provide written permission.
3. Review. We identify the data in scope and any records we must keep by law (for example payment history) or to resolve an open dispute, report, or security investigation. We will tell you what was kept and why.
4. Action. Deletion removes or anonymizes your data in live systems; remaining backup copies expire on the schedule above.
5. Response. Within one month for GDPR requests and 45 days for CCPA/CPRA requests, extendable where the law allows — we will tell you if an extension is needed.
6. Appeal. If we deny a request, reply to our decision to appeal it. EEA/UK users may also complain to their supervisory authority.

Reasonable requests are free. We may decline requests that are manifestly unfounded or repetitive, and we will explain why.

We use encryption in transit, hashed credentials, row-level security on user data, role-based admin access, and audit logging. No system is perfectly secure; please use a strong, unique password.

Legal bases. We process personal data to perform our contract with you (account, auctions, credits, airing your clip); on our legitimate interests (security, fraud prevention, service improvement, aggregate analytics), balanced against your rights; to comply with legal obligations (tax, accounting, lawful requests); and with your consent where required (web push notifications and any non-essential cookies) — consent can be withdrawn at any time without affecting prior processing.

Your rights. Access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), data portability, and the right not to be subject to solely automated decisions with legal or similarly significant effects. Content moderation decisions include human review on request.

How to exercise them. Use our privacy rights request form, or email BidPopAdmin@gmail.com from your account address. We verify your identity and respond within one month (extendable by two further months for complex requests). There is no fee for reasonable requests.

International transfers. We are based in the United States, and our providers may process data in the US and other countries. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) plus supplementary technical measures such as encryption.

Complaints. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.

In the past 12 months we have collected the categories of personal information listed above — identifiers, commercial information, internet/network activity, audio-visual information (your clips and chat), and approximate location inferred from IP — for the business purposes described in "Why we use it," from you directly and from your use of the Service. We disclose personal information to service providers only, under written contracts limiting their use of it.

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Your rights: to know/access the categories and specific pieces we hold, to delete, to correct, to opt out of sale/sharing (not applicable — we do neither), to limit the use of sensitive personal information (we do not collect it for inferring characteristics), and to be free from discrimination or retaliation for exercising these rights.

Submit a request through our privacy rights request form or by emailing BidPopAdmin@gmail.com from your account address; we will verify your identity through your account and respond within 45 days (extendable by 45 more). An authorized agent may submit on your behalf with written permission and identity verification.

Residents of states with comprehensive privacy laws (including Washington, Colorado, Connecticut, Virginia, Utah, Texas, and Oregon) may have similar rights to access, correct, delete, and port their data, and to appeal a denied request. Use the same request form or contact address and we will apply the protections your state provides, including the Washington My Health My Data Act where relevant (we do not collect consumer health data).

We use strictly necessary cookies and local storage to keep you signed in, remember checkout and player preferences, and secure the Service. Full details are in our Cookie Policy.

BidPopular is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a minor has created an account, contact us and we will delete it.

We will notify you of material changes in-app or by email and update the date above. Questions or requests: BidPopAdmin@gmail.com, or see our Trust & Safety page.

Data controller: BIDPOPULAR LLC, State of Washington, USA.

Does BidPopular sell my personal information?

No. We do not sell or rent personal information, and we do not use it for cross-context behavioral advertising. We share data only with vetted providers acting on our instructions, such as our authentication, payment, video delivery, email and push providers.

How do I request access to, correction of, or deletion of my data?

Submit the privacy rights request form at /privacy-requests, or email us from your account address. You will get a reference number immediately, we verify the request comes from you, and we respond within one month for GDPR requests and within 45 days for CCPA/CPRA requests. Reasonable requests are free.

What happens to my data when I delete my account?

Account and profile data is deleted within 30 days of account closure. Payment and credit records are kept up to 7 years because tax, accounting and chargeback rules require it, and your public bid history is de-identified. Encrypted backups roll off on a schedule of up to 90 days and are never restored into live systems.

Are the clips I upload published on demand after they air?

No. Clips air live only and we do not publish an on-demand archive. Source files and transient transcodes are removed on our ordinary technical schedule, typically within 30 days after the clip airs, is rejected, or is deleted by you. Anything visible while your clip airs is broadcast publicly at that moment and may be captured by third parties outside our control.

What privacy rights do I have in the EEA, UK or California?

EEA, UK and Swiss users have rights of access, rectification, erasure, restriction, objection and data portability under the GDPR, and may complain to their supervisory authority. California residents have rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive information, and to be free from discrimination. Residents of other US states with comprehensive privacy laws have comparable rights, including the right to appeal a denied request.