Privacy Policy

1. Controller

Sebastian Theo is the data controller for top3.lol. For UK users, the UK GDPR and Data Protection Act 2018 apply. If you are elsewhere, local laws may also apply; we still handle requests in good faith at the email above.

2. What we collect

• Google account details (email, name, profile photo) when you sign in.
• Listing content you submit (URL or handle, tagline, logo, category).
• Optional encrypted Stripe restricted keys if you verify MRR, plus aggregate revenue metrics we derive.
• Bid and payment records (amounts, Stripe session identifiers).
• Marketplace messages (buyer name, email, message, optional offer amount).
• Technical data such as hashed IP addresses used to limit click abuse, and standard server logs from our host.
• Optional Google Analytics 4 events if analytics is enabled on the site.

3. Why we use it (lawful bases)

• Contract: to run your account, listings, and paid leaderboard placement.
• Legitimate interests: security, fraud prevention, product analytics, and operating a public directory.
• Legal obligation: keeping payment records where tax or accounting law requires.
• Consent: where we rely on it for non-essential cookies (see Cookies below).

4. Processors

We use Google (Firebase Authentication, Firestore, Storage, and optionally Analytics), Stripe (payments and optional MRR reads from a key you provide), and Vercel (hosting). They process data on our instructions under their own terms and transfer tools.

5. International transfers

Some processors store data in the United States or other countries. Where required, we rely on their standard contractual clauses or equivalent safeguards.

6. Retention

We keep account and listing data while your account is active. Payment and bid records are kept as long as we need them for accounting and disputes (often several years). Marketplace offers are kept until they are no longer needed. Session cookies expire or are cleared when you sign out. Encrypted Stripe keys are kept until you disconnect them or we delete the listing.

7. Security

We use HTTPS, httpOnly session cookies, and encryption for stored Stripe restricted keys. No method of transmission or storage is completely secure.

8. Your rights

Depending on your location you may ask to access, correct, delete, or restrict personal data, object to certain processing, or receive a copy. Email olbiapro@gmail.com. UK users may complain to the Information Commissioner's Office (ico.org.uk). We may need to verify your identity. We may retain data we must keep by law even if you ask us to erase an account.

9. Children

The service is not intended for anyone under 18. We do not knowingly collect their data.

10. Cookies

We use a session cookie (__session) so you stay signed in. If Google Analytics is enabled, Google may set additional cookies. A dedicated cookie banner is not currently shown; if you enable analytics for UK or EU visitors you should treat non-essential cookies as requiring consent under PECR/ePrivacy.

11. Changes

We may update this policy. The date at the top will change. Continued use after an update means you have seen the new policy.