Privacy notice

On the rest of this site the person running the auction writes as “I”. Legally, “I” and “we” are the same thing: SnowLabs UG (haftungsbeschränkt), the company that operates brandmyfold.com.

1. Who is responsible

Represented by Philip Jovanovic. Email: contact@brandmyfold.com. No data protection officer has been appointed; the company is below the thresholds of § 38 BDSG.

2. The short version

• This site sets no cookies of its own and uses no tracking pixels and no advertising networks. It counts page views with Vercel Web Analytics, which sets no cookies and cannot recognise you (section 3). There is no cookie banner because nothing here needs consent.
• If you only look: our hosting provider (Vercel) and our database provider (Supabase) see your IP address in order to deliver the page, the live bid updates and the page-view count. That is all.
• If you bid: we store what you type into the bid form, Stripe handles your payment (your card details never reach us), and we email you about your bid through Resend.
• Public by design: the bid amount and time of every paid bid appear on the site. Your company name, logo and website link appear only after we have approved them by hand.

3. Visiting the site: hosting, server logs and page-view statistics

The site is hosted by Vercel Inc., Covina, California, USA. Our server-side code runs in Vercel’s Frankfurt region. Like every web server, Vercel records for each request: your IP address, date and time, the address requested, the page you came from, browser and operating system, the amount of data transferred and the response status.

Purpose: delivering the site, keeping it secure and available, and finding faults. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in running a secure, working website. Vercel keeps these logs for a few days at most.

Page-view statistics. We use Vercel Web Analytics to see how many people visit, which pages they open, where they came from (the referring site and any campaign tags in the link), the country and region they are in, and the browser, operating system and type of device they use. It sets no cookies and stores nothing in your browser. To tell visits apart within a day, Vercel derives a hash from your IP address and browser details together with a value that changes every day, so the hash cannot be used to recognise you afterwards and is discarded with it; the IP address itself is not kept with the statistics. We only ever see aggregated counts, never an individual visitor. Vercel keeps the resulting statistics for up to twelve months. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing whether the site works and where its visitors come from. You can object at any time (section 13).

4. Live auction data

The bids you see come from a database hosted by Supabase, Inc. in the AWS Frankfurt region (eu-central-1). Your browser talks to Supabase directly: it loads the public list of bids and keeps a live connection open so that a new bid shows up without a reload. Supabase therefore sees your IP address and browser details for as long as you have the page open. Only the public bid data described in section 6 travels over that connection.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing a live auction, and yours in seeing one. Supabase also stores every bid (section 5) and the uploaded logos on our behalf under a data processing agreement.

5. Placing a bid

When you bid we process:

• What you enter in the bid form: your company or brand name, your email address and, where the form asks for them, a contact name, your website, your X username, your country and your VAT ID. Country and VAT ID are needed for the invoice; if the form does not ask for them, we ask winners for them afterwards.
• The logo or artwork you upload.
• The spot, the bid amount, the deposit, the time of the bid and its status (pending, top bid, outbid, won and so on).
• A SHA-256 hash of your IP address. We never store the address itself; the hash is used only to limit each address to five bids in ten minutes.
• The identifiers Stripe assigns to your deposit payment and, if it comes to that, to its refund.

Purposes: running the auction, refunding deposits, approving sponsors, delivering and invoicing the spot, and preventing abuse. Legal bases: Art. 6(1)(b) GDPR (the steps before, and the performance of, the contract you enter by bidding), Art. 6(1)(c) GDPR (retention duties under tax and commercial law) and Art. 6(1)(f) GDPR (the rate limit and fraud prevention). Fields marked as required are needed to place a bid; without them there is no bid.

6. What is published

A public auction is only fair if everyone sees the same board. For every bid whose deposit has been paid the site shows the bid amount, the time of the bid and whether it is the current top bid or has been outbid; until we have reviewed the bid it is labelled “Pending review”. Outbid bids stay on the board. Once we have reviewed and approved your bid, your company or brand name and your logo are shown next to it and on the device schematic and, if you gave one, linked to your website. Legal basis: Art. 6(1)(b) GDPR; publication is part of what you buy.

Never published: contact names, email addresses, X usernames, countries, VAT IDs, the IP hash and any payment identifier. The database exposes only the public columns to the browser; the rest is readable only by our server. Until approval your name is withheld and your logo sits in private storage; the site shows a neutral placeholder instead.

7. Paying the deposit: Stripe

Deposits, and later the balance, are handled by Stripe Payments Europe, Ltd., Dublin, Ireland, together with Stripe, Inc., USA. Stripe’s payment form is loaded only when you reach the payment step, not while you are just looking at the site.

We send Stripe the deposit amount, the currency, your email address (Stripe emails you a receipt) and a reference to your bid. Your card number, expiry date, security code and any billing details you type into Stripe’s form go straight to Stripe and never touch our servers. Stripe uses this data to process the payment, to run fraud checks (Stripe Radar) and strong customer authentication (3-D Secure), and to meet its own legal obligations, for which it acts as an independent controller. Refunds go back to the card you paid with. Details: stripe.com/privacy.

During the payment step Stripe sets two cookies in your browser, __stripe_mid (one year) and __stripe_sid (30 minutes), which it uses to recognise fraud. They are strictly necessary for the payment you asked for (§ 25(2) no. 2 TDDDG); the underlying processing rests on Art. 6(1)(b) and (f) GDPR.

8. Emails we send: Resend

We email you when your bid goes live, when you are outbid or your payment lost a race with a higher bid, when we have looked at your upload and need a different one (that email carries a one-time link to change it), when we remove your bid and refund the deposit, when the closing date moves and, if you win, with the payment request and the invoice. We also answer whatever you write to us. There is no newsletter and no marketing email.

These emails are delivered by Resend, Inc., San Francisco, USA, on our behalf, from an @brandmyfold.com address. Resend receives your email address and the content of the message (your name if we have it, your company, the spot and the amounts) and keeps delivery logs for a limited time. Legal basis: Art. 6(1)(b) GDPR.

9. Contacting us

If you email us we keep the message and our reply for as long as it takes to deal with it and, where it counts as business correspondence, for the statutory six years. If you message us on X, X Corp. and Twitter International Unlimited Company (Ireland) process that conversation under X’s own privacy policy; please do not send payment or invoice details over X.

10. Cookies and local storage

This site sets no cookies, and neither does Vercel Web Analytics (section 3). It stores one value in your browser’s local storage, bmf.currency, when you switch the display between euro and US dollar, so that the choice survives a reload. That value stays on your device, is never sent to us and can be removed through your browser settings. It is strictly necessary for a function you asked for (§ 25(2) no. 2 TDDDG). Stripe’s cookies in the payment step are described in section 7. Because nothing on this site requires consent, there is no consent banner.

11. Recipients and transfers outside the EU

Apart from the providers named above, Vercel, Supabase, Stripe and Resend, each bound by a data processing agreement under Art. 28 GDPR or acting as its own controller as described, we pass your data on only where the law requires it (for example to the tax authorities or a court) or with your consent.

Vercel, Stripe, Inc. and Resend are based in the United States, and Supabase is headquartered outside the EU although our data sits in Frankfurt. Where one of these providers is certified under the EU-US Data Privacy Framework, transfers rest on the European Commission’s adequacy decision for it; otherwise they rest on the EU standard contractual clauses (Art. 46(2)(c) GDPR). Copies of the relevant clauses are available from us on request.

12. How long we keep data

• Bids that never paid a deposit (abandoned or failed payments): deleted, together with any uploaded logo, 30 days after the auction closes.
• Bids that paid a deposit and were refunded (outbid, lost a race, rejected): the charge and the refund are accounting records, so the bid details are kept for the retention periods of German commercial and tax law (§ 257 HGB, § 147 AO, currently six to ten years depending on the record) and then deleted. The logo file is deleted 30 days after the auction closes; the company name and bid amount stay on the public bid history.
• Winning bids: contract and invoice data for the same statutory periods. The logo stays on the device and on the site for the duration of the project and remains visible in photos of the device that we have published.
• IP hashes: deleted when the auction closes; they serve no purpose after that.
• Server logs at Vercel: a few days. Page-view statistics at Vercel: up to twelve months, aggregated and without IP addresses. Email logs at Resend: a limited period set by Resend.

13. Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), and to receive the data you gave us in a portable format (Art. 20). Where we rely on consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (sections 3, 4, 5 and 7), you may object for reasons arising from your particular situation. We then stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms.

To exercise any of these rights, email contact@brandmyfold.com. You also have the right to complain to a data protection supervisory authority. The one responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany (datenschutz.hessen.de); you may also turn to the authority where you live or work.

14. No automated decisions

We make no decisions about you by automated means alone and do no profiling. The rate limit merely asks you to wait a few minutes. Stripe’s fraud checks can decline a payment; that is Stripe’s decision under its own rules, and you can try another card or contact us.

15. Changes

The version on this page applies. The date at the top tells you when it last changed. If a change affects bids that are already live, we email the bidders concerned.

Related: Impressum · Terms