Privacy Policy

1. What we collect

• Account: your email address and a session cookie. No passwords exist.
• Lid profile: display name, company, city, region, and the shipping address stickers go to.
• Work verification: we keep the verified domain and a one-way hash of the work email used, never the work email itself, and we never send anything to it after the one verification code.
• Media: sticker images brands upload and the placement photos owners submit for review.
• Payments: handled by Stripe. Card and bank details go straight to Stripe; we never see or store them.
• Sign-in security: the IP address, coarse location (country and city), and browser of each sign-in. We use it to protect accounts and to sanity-check segment claims, never for advertising.

2. What brands see about you

Brands target aggregate segments: a company, a city, a region, a tier. Nobody can bid on you as an individual, and browsing brands see nothing about you at all.

Once you accept a campaign, that brand sees the placement they are paying for: the employer you verified, your tier, your city, the zone your sticker is on, and its rate. Your employer is the thing they bought, so it is named. You are not: they see a masked stub of your email (the first letter only) and a numeric lid label, never your name, your full email, your handles, or your address. If you would rather no brand ever learn where you work, do not verify a work email; an unverified lid trades at Explorer rates and stays employer-free.

They also see the lid photos for that placement: the one taken when it went live, and the newest cycle photo, each only after we have checked it. They are paying monthly for a sticker they will never stand in front of, and the photo is the only thing that shows it is still there. Photograph the lid and nothing else. A photo we reject is never shown to anyone, and no brand ever sees a photo for a placement they are not paying for.

3. How we use it

To run the marketplace: matching campaigns to lids, shipping stickers, reviewing placement photos, billing brands, and paying owners. We send transactional email about your account and placements. We do not sell your data, run third-party ads, or use third-party analytics trackers.

4. Where it lives

Data is stored with Cloudflare (database and media storage) and Stripe (payments). Email is delivered through Resend. These providers process data on our behalf under their own security terms.

5. Cookies

One httpOnly session cookie keeps you signed in for up to 30 days. There are no tracking cookies.

6. Retention and deletion

We keep your data while your account is active. Email hello@bidmylid.com to delete your account; we remove your profile, media, and verification records, keeping only what payment regulations require us to retain.

7. Changes

If this policy changes in a way that matters, we email you before it takes effect.