Privacy notice

This describes what Bidhaven actually stores and where it actually goes. It was written by reading the code, not by copying a template.

Who is responsible

Registered legal name: TODO(owner) — not supplied yet
Geographic address: TODO(owner) — not supplied yet
Email: TODO(owner) — not supplied yet
Company registration number (CVR): TODO(owner) — not supplied yet
VAT number: TODO(owner) — not supplied yet

Stripe is not simply a supplier here. Because Managed Payments is enabled, Stripe is the merchant of record for your purchase and decides for itself what to do with your payment data — including deleting the records of your purchase from Bidhaven’s own Stripe account if you ask Stripe to. Treat Stripe as responsible for the payment, and Bidhaven as responsible for the city.

What Bidhaven stores

Your email address. Held by Supabase Auth so you can sign in. You give it either by asking for a sign-in link or by signing in with Google.
Your business details — name, headline, logo, website link and colour. These are public on purpose: they are printed on your building and on your page at /b/your-business, visible to anyone. Do not put anything there you would not put on a billboard.
Your orders — which lot, how much, when, the Stripe session and payment identifiers, and the date you accepted the terms and asked for immediate publication.
City visitor totals — one all-time visit integer and the current number of open city tabs. The all-time number is a single counter, not a visit history. The live number exists only in Supabase Realtime memory while tabs are connected. Neither contains an IP address, account, visitor identifier, timestamp, page path or location.
Server logs, kept by Vercel, which record request paths and IP addresses for a short period as a normal part of running a website.
Anonymous page-view statistics, only if you allow them. Vercel Web Analytics receives the page path without its query string, timestamp, referring site, coarse location, browser, operating system and device type. It does not receive your account or order id. Vercel derives a daily visitor hash from the request and discards it after 24 hours; it does not use cookies or follow you across sites or days.

Bidhaven does not store your card number. It never sees it — the card details are typed on Stripe’s page, not on Bidhaven’s.

Cookies and browser storage

Bidhaven runs no advertising or cross-site tracking. Anonymous Vercel Web Analytics runs only if you select Allow analytics. It sets no cookie, strips query strings before sending page views, and is not tied to your account or orders. The city also displays a live count of open tabs and one aggregate all-time visit total; neither count is attached to a person, account, IP address, page or location. What is stored in your browser is:

A sign-in cookie set by Supabase, which is what keeps you signed in. Strictly necessary; sign out and it goes.
Two settings in your own browser, in localStorage: bidhaven.welcome.seen, so the welcome card stops reappearing, and bidhaven:sound, which remembers whether you muted the city. Neither leaves your device and neither identifies you. Clearing your browser data clears both.
One per-tab flag in sessionStorage: bidhaven:visit-counted. It stops a refresh in the same tab adding another visit. It never leaves your device, contains no identifier, and disappears when the tab session ends.
Your analytics choice in localStorage: bidhaven:analytics. It contains only granted or denied and never leaves your device.

Change your analytics choice

You can allow or withdraw anonymous analytics at any time. Turning it off stops future page views; it cannot remove statistics that have already been aggregated.

Anonymous analytics are disabled on this device.

Where it is processed

Supabase — sign-in, the database and the logo images. Hosted in Ireland (eu-west-1).
Vercel — hosting, logs and, with your permission, anonymous Web Analytics. Bidhaven’s server code is pinned to Vercel’s Dublin region (dub1) so it sits beside the database rather than in the United States, which was the platform default. Vercel’s global cache and analytics intake operate globally; analytics page views carry no account, order or query data.
Stripe — payments, receipts, refunds and disputes. Stripe is a global company and processes payment data outside the EU under its own terms.
Google — only if you choose “Continue with Google”. If you use a sign-in link instead, Google is not involved.

Supabase and Vercel are both US-headquartered companies with EU infrastructure, so access from the United States for support or operations cannot be ruled out even though the data is stored in Ireland. That is stated here rather than glossed over.

Email

The only email Bidhaven causes to be sent today is the sign-in link, sent through Supabase. Bidhaven runs no newsletter and no marketing email. If that changes, this page changes with it and the version identifier at the bottom moves.

How long it is kept

Your account and business details: for as long as you own a lot in the city.
Order records: kept after that, because they are the record of a sale and of your consent, and because tax records have to be retained.
Server logs: a short retention window set by Vercel, not by Bidhaven.
Anonymous analytics: Vercel discards the daily visitor hash after 24 hours. Aggregated reporting follows the retention period of the project’s Vercel plan.

What you can ask for

You can ask what is held about you, ask for it to be corrected, ask for it to be deleted, or object to it being held. Write to the address on the contact page.

Two honest limits. A building that is already in the city is public, and taking your listing down does not remove it from anyone’s screenshot or from a search engine’s cache. And the record of a completed sale cannot simply be erased, because it is also a tax record.

For anything to do with the payment itself, ask Stripe directly — Stripe holds that data on its own account, and Stripe honours deletion requests for Managed Payments transactions.

Complaints

If you are in the EU you can complain to your national data protection authority. In Denmark that is Datatilsynet.

TODO(owner): whether Bidhaven needs a data processing agreement on file with Supabase and Vercel, and whether Bidhaven and Stripe are joint controllers for the purchase, are questions for a lawyer. See docs/MERCHANT_OF_RECORD.md.

Last updated 2026-08-24 · policy version 2026-08-24.1, which is the version recorded against every order placed while this page was live.