PRIVACY.

WHAT WE COLLECT

• Submission data: legal first and last name, public display name, optional X handle, project name, tagline, destination, video and media metadata, selected bid amount, and the policy versions accepted.
• Operational data: private management-token hash, project and placement identifiers, status history, destination and media checks, abuse signals, reports, moderation decisions, job history, request identifiers, and security records.
• Payment data: Stripe Checkout, payment, refund, dispute, amount, currency, and provider identifiers. We do not store card numbers, card security codes, or full payment credentials.
• Usage data: privacy-minimized page, playback, qualified-view, watch, project-visit, device, consent, and security events used for aggregate metrics and abuse prevention.

PUBLIC + PRIVATE DATA

• The public board may show the founder's chosen public identity, project name, tagline, video, rank, active placement credit, qualified views, watch percentage, and project visits.
• Legal founder names, private management tokens, payment-provider identifiers, security signals, moderation evidence, and non-public audit records are not returned by the public API.
• Project destinations are checked and normalized before publication. Public visits use the checked destination without affiliate, referral, or tracking parameters.

HOW WE USE DATA

• To create and publish submissions, calculate live position, deliver media, process and reconcile payments and refunds, and provide the service requested by the founder.
• To prevent fraud and abuse, secure private links and media, investigate reports, enforce policies, maintain audit history, diagnose failures, and protect Paid Attention, its users, and third parties.
• To produce aggregate public metrics and understand site performance. Analytics never activates payment credit, determines rank, or makes moderation decisions automatically.
• To comply with tax, accounting, payment, dispute, law-enforcement, sanctions, regulatory, and other legal obligations that apply to the operator.

LEGAL BASES

• Contract and steps requested before entering a contract: submission, media processing, payment, publication, placement, private project access, and refunds.
• Legitimate interests: securing the service, preventing abuse, measuring essential aggregate performance, defending legal claims, moderating content, and maintaining reliable operations, balanced against affected rights.
• Consent: non-essential analytics or similar storage where consent is required. Consent can be withdrawn without affecting processing already carried out lawfully.
• Legal obligation: financial, tax, accounting, sanctions, regulatory, dispute, and lawful-request records where retention or disclosure is required.

SERVICE PROVIDERS + TRANSFERS

• Cloudflare provides network delivery, security checks, structured storage, object storage, temporary video processing, and related infrastructure.
• Stripe provides Checkout, payment processing, refunds, disputes, fraud prevention, and payment records. Stripe receives payment and transaction information under its own notices and terms.
• DataFast may receive consent-aware site and business events if analytics is enabled. Payment activation and ranking do not depend on DataFast.
• Providers may process information outside the user's country. The operator must document the applicable transfer locations and safeguards before production processing begins.

RETENTION + SECURITY

• Published project and placement records are retained while needed to operate the board and preserve its public and financial history.
• Payment, refund, dispute, tax, fraud, moderation, security, audit, and legal-hold records may be retained longer where required to meet legal obligations or establish, exercise, or defend claims.
• Media and operational data are removed or anonymized when no longer needed, subject to backup, fraud, dispute, moderation, and legal-retention requirements.
• We use private object storage, signed media access, hashed management tokens, restricted owner routes, provider signature checks, and operational logging. No system can be guaranteed completely secure.

YOUR RIGHTS + CHOICES

• Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent for processing based on consent.
• A request to remove a public project does not require immediate deletion of financial, fraud, audit, dispute, moderation, backup, or legal records that must or may lawfully be retained.
• Where required, non-essential analytics load only after the applicable consent choice. Essential payment, publication, security, and limited operational processing remains necessary to provide and protect the service.
• You may complain to the competent data-protection authority. EEA users may contact the authority in their country of residence, work, or the place of an alleged infringement.

CONTROLLER + CONTACT

The legal operator of Paid Attention is the controller for the product data described here. The verified operator name, registered address, dedicated privacy contact, exact retention schedule, provider transfer safeguards, and applicable supervisory authority must be published before production payments are enabled. Until then, use the public operator contact shown in the site footer for product questions.