Privacy Policy

[OPERATOR_LEGAL_NAME], [OPERATOR_ADDRESS], Portugal, is the data controller for personal data processed through thebid.live. Contact us at [OPERATOR_EMAIL] for anything in this policy.

Account details. Your name and email address. Bidders are asked for a phone number when placing their first bid, so an organiser can reach them about a table they win. Organisers also provide a business name.

Bidding activity. The tables you bid on, your bid amounts, and — if you use automatic bidding — the maximum you set. Your maximum is never shown to other bidders.

Identity verification (organisers only). To publish an event you complete identity verification through Stripe. Stripe collects your identity document and any selfie directly. We receive only the verification result, never the document itself.

Payment details. Handled entirely by Stripe. We store a reference to the payment, never your card number.

Technical data. Usage events, and error reports when something breaks.

To run the auction and take payment — necessary to perform our contract with you.

To verify organisers and prevent fraud — our legitimate interest in a trustworthy marketplace, and our legal obligations around payments.

To send transactional email (outbid alerts, winner receipts, sale notifications, password resets) — necessary to perform our contract. These are not marketing and cannot be opted out of while you hold an account.

To improve the product through usage analytics and error monitoring — our legitimate interest, balanced against your privacy.

We do not sell your data. We share it with processors who help us run the service:

Stripe — payments, payouts, identity verification. Supabase — database and authentication. Resend — transactional email. Vercel — hosting. PostHog — product analytics. Sentry — error monitoring.

Organisers see their bidders. If you bid on a table, the organiser of that event receives your name, email address and phone number — whether or not you win — so they can contact you about the table and their future events. They can also export those details. This is how the marketplace works, and bidding means accepting it.

Some processors are outside the EEA. Where that happens, transfers rely on Standard Contractual Clauses or an adequacy decision.

Account and bidding records are kept while your account is open and for seven years afterwards, which is the period Portuguese tax and accounting law requires for transaction records. Analytics and error data are kept for up to two years.

Under the GDPR you can request access to your data, correction of it, deletion, restriction of processing, portability, and you can object to processing based on legitimate interests. Email [OPERATOR_EMAIL] and we will respond within one month.

Deletion has limits: we must retain records of completed transactions for the tax period above, and an organiser's copy of contact details they already received is held under their own responsibility.

If you believe we have handled your data improperly you can complain to the Comissão Nacional de Proteção de Dados (CNPD), Portugal's supervisory authority.

We use cookies that are strictly necessary to keep you signed in, and analytics cookies to understand how the product is used. We do not use advertising cookies or track you across other websites.

We will notify you of material changes by email or in the app before they take effect. See also our Terms of Service.