Privacy policy

Draft for review. This is a starting structure written from what the software actually stores, not legal advice. The parts marked “to complete” need the business’s decisions and a solicitor’s review before launch. The text cannot be published while this notice or any marker is still in it.

Who we are

Wild Bid is run by . We are the controller of the personal information described here. Contact us at .

What we collect, and why

Your account: name, email address, password (stored only as a one-way hash), and optionally a phone number. We use these to run your account and contact you about it.
Sign-in security: a record of recent sign-ins (time, browser, and a shortened internet address) kept for 90 days so you can spot one that was not you, and scrambled codes for your internet connection and browser that help us spot people opening several accounts. We use these for security and fraud prevention only.
Payments: what you bought, the amount, when, and Stripe’s reference for the payment. Stripe takes your card details on its own page; we never see them. We also keep the exact wording you agreed to at the time of the order, with the time, your address and your browser type, as proof of your consent.
ID documents: if you send a photo of an identity document so we can check who you are, only our staff see it, and it is deleted once checked (and in any case after 30 days if nobody has checked it). We keep the result of the check.
Messages to us: what you write through the contact form, and our replies.
Competition entries: [what is stored about bids and winners, and how long. To complete.]

Who we share it with

Stripe, to take payments.
Our hosting, email and security providers (Hostinger, Cloudflare), who process data for us.
A text-message provider, only if you choose to verify your phone number.
Google Analytics, only if you accept analytics cookies (see the cookie policy).
[Any prize supplier, courier or other recipient of a winner’s details. To complete.]

We do not sell your information.

How long we keep it

Account details: until you close your account. We keep a closed account for 30 days, then delete your personal details.
Sign-in history and connection codes: 90 days.
Payment records: six years, because the law requires it.
Records of what our staff did to an account: addresses and browser details are removed after 12 months; everyday entries are deleted after 24 months; money, refund and admin-account entries are kept six years.
Contact-form messages: 12 months after they were dealt with.

Your rights

You can ask to see, correct or delete what we hold, to restrict or object to how we use it, and to move it. You can download your data and close your account yourself from Settings. If you are unhappy with how we handle your information you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

Wild Bid is for people aged 18 and over.

Changes

If we change this policy in a way that matters, we will tell you.