Privacy Policy

This policy explains how BidTier, operated by Sizth LLC (“we”, “us”, the data controller), handles personal data when you use the board, list a product, place a bid, or contact us. We try to collect as little as we can to run the service.

1. Information we collect

Account & profile

• Account details — email address, a username/display name, and a hashed password. We never store your password in plain text.
• Profile — an optional avatar image and your language preference.
• Social sign-in — if you log in with Google or GitHub, we receive the provider name, a provider user ID, and the email on that account.
• Security data — two-factor (TOTP) secret and recovery codes if you enable 2FA, a hashed API key if you create one, and short-lived email-verification, password-reset, and email-change tokens.
• Referrals — a referral code and, if you signed up through someone's link, who referred you.

Listings & content you submit

• Product listings — name, tagline, description, website URL, logo, and gallery images.
• Hiring, fundraising and investor information you choose to add — job roles, apply links, work mode, HQ/location, funding stage, and team size.
• Support tickets and any attachments you send us.

Payment & billing data

• Bids and payments are processed by Stripe. We do not see or store your full card number — that stays with Stripe.
• We store a Stripe customer ID, a record of each bid/payment (amount, method, and a Stripe reference), and — for guest bids — the buyer email Stripe gives us, so we can link the payment to the right listing.
• If you fill in billing details for a receipt, we store the company name, tax/VAT ID, and postal address you enter.

Technical & security data (collected automatically)

• Sessions — for each signed-in device we record the IP address, the browser user-agent, and last-active time, so you can review and revoke your sessions.
• Security & audit logs — sensitive actions are logged with the acting user, the action, and the IP address, to protect accounts and investigate abuse.
• Reports — when a listing is reported we record the reporter's IP address (and account, if signed in) to prevent abuse of the report system.

2. How we use it

• To run the service — publish listings, rank the board, process bids, and show the free daily spotlight and hiring board.
• To create and secure your account, sign you in, and support 2FA.
• To take payment through Stripe and issue receipts.
• To send you service messages (security alerts, billing, ticket replies). You can opt out of non-essential emails in your notification preferences; transactional security/billing emails can't be switched off.
• To detect, prevent, and act on spam, fraud, abuse, and Terms violations.
• To comply with legal, tax, and accounting obligations.

Where the law requires a legal basis (e.g. GDPR), we rely on: performing our contract with you (running your account and bids), our legitimate interests (keeping the service safe and preventing abuse), your consent (analytics cookies), and legal obligation (retaining financial records).

3. Cookies

• Strictly necessary — a signed session cookie (and a refresh and CSRF cookie) to keep you logged in and submit forms safely, plus a small cookie that remembers your language and your cookie-consent choice. These are always on; the service can't work without them.
• Analytics — if analytics are enabled, the script loads only after you accept cookies in the banner. Decline and no analytics cookies are set.
• A short-lived referral cookie is set only if you arrive through a ?ref= link, to credit the referrer.

4. Who we share it with

We don't sell your personal data. We share it only with the service providers we need to operate BidTier, and only as far as needed:

• Stripe — payments, receipts, and (if enabled) tax calculation; receives your email, name, billing address, and tax ID as applicable.
• Cloud object storage (an S3-compatible provider such as AWS S3 or Cloudflare R2) — stores avatars, listing images, and ticket attachments.
• Email provider — to deliver account, security, and ticket emails.
• Google / GitHub — only if you choose social sign-in.
• Cloudflare Turnstile — bot protection on forms, if enabled.
• Have I Been Pwned — to check new passwords against known breaches using k-anonymity; your actual password is never sent.
• Error-monitoring / ops tooling — to keep the service reliable.

We may also disclose data if required by law, to enforce our Terms, or to protect the rights and safety of our users.

5. Retention

We keep your data while your account is active. Login sessions are pruned after a period of inactivity. When you delete your account (see below), most personal data is removed after the grace period — but we retain financial and tax records (invoices, billing details, payment ledger) for as long as the law requires.

6. Your rights & controls

• Access / export — download everything we hold about you as JSON from your account's data-export tool.
• Correction — edit your profile, listings, and billing details any time.
• Deactivate — hide your account and sign out everywhere; signing back in restores it.
• Delete — request deletion from your account page. After a 30-day grace period (sign in before then to cancel), your account is anonymised: identifying data is scrubbed while legally-required financial records are kept as a PII-free record.
• Depending on where you live, you may also have the right to object to or restrict certain processing, or to lodge a complaint with your data-protection authority.

To exercise any right, use the tools in your account or email bidtier@sizth.com.

7. Security

Passwords are hashed, sessions are revocable, 2FA is available, and payment card data never touches our servers. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach where required.

8. Children

BidTier is not intended for anyone under 18, and we do not knowingly collect data from children.

9. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for those transfers.

10. Changes

We may update this policy as the service evolves; we'll revise the “last updated” date above and, for material changes, let you know.

11. Contact

Privacy questions or requests? Email bidtier@sizth.com or use our contact page.