Legal · eight articles · cookieless analytics, no consent banner
Privacy
A public board is mostly public by design. What follows is the exact line between the part everyone can read, the part kept where only the accountant and the mail server see it, and the part that is never written down at all.Document Analytics Self-hosted Cookies 1 functional Data location EU Binding language English
The whole data ledger, at a glance The eight articles below are the disclosure. These three columns summarise them and are not themselves terms.
Published 5 items URL, title and description Your site's icon, copied and served from here Legal name, where VIES returns one Country and category Amount paid and click count Readable by anyone, and in the public JSON feed.
Kept, unpublished 5 items VAT number and its VIES result Stripe customer id Payment records, kept as Estonian law requires Checkout email, for outbid notices only VIES-down request, and its link stops after a week Never on the board, never in the feed, never passed on.
Never stored 5 items Your IP address The language-guess country lookup Third-party analytics of any kind Tracking pixels and click tracking in email Any cookie beyond the lang setting In memory only, gone when the process restarts.
Language This page is available in English only. The English version is binding.
What is public
Everything a visitor can read off your listing, and why the name VIES returns, where it returns one, is among it.1.1 Your URL, your title and description, your site's own icon, whatever legal name VIES returns for you, your country, your category, your amount and your click count. Publishing the legal name is the point of the VAT gate. It puts the name VIES returns beside a bid rather than one somebody typed, and where a member state returns none, the country stands on its own. 1.2 The icon is fetched from your page once, when the bid is placed, and a copy is stored here. It is served from overbid.eu rather than from your server, so nobody reading the board is announced to you, and it is drawn into the share images for your listing. Nothing is fetched from your site again afterwards. To change it or take it down, email support@overbid.eu. 1.3 Your VAT number itself is stored but never published, and it is not in the public JSON feed. A machine-readable list of EU VAT numbers is a harvesting kit.
What is stored
Four records, each with a reason it exists and a rule for how long it stays.2.1 The VAT number you submitted and the VIES result for it, so a repeat bid does not have to ask the Commission again. Your Stripe customer id. Payment records, which are accounting documents and are kept as long as Estonian law requires. 2.2 The email address you gave Stripe at checkout, taken from the completed payment and kept on the listing it paid for. Nothing on the bid form asks for one. It is never published, never shown on the board, and never passed to anyone. 2.3 It is used for one thing: telling you when another bid pushes that listing down the board. Nothing else is ever sent to it.
If VIES is down when you bid
The one place on the site that asks for an address before a payment, and the short life of what it keeps.3.1 The Commission's VAT service goes down one member state at a time, and while yours is down no bid from your country can be verified. If that happens the page offers to write to you when it comes back. It is the only place on this site that asks for an address before a payment. 3.2 Giving it stores two things: the VAT number you were trying to check, and the address to write to. It buys nothing. The number is not verified, no rank is held, and nothing is reserved. 3.3 Both are stored the moment you submit the form, because that is how the confirmation gets sent. That confirmation is the only message an unconfirmed address ever gets. Opening the link does nothing on its own; only pressing the button on it counts. 3.4 The link stops working a week after you asked. That is a date rather than a habit, because the check happens when the link is used. A cleanup then deletes the record, normally within a day. Write to support@overbid.eu to have it removed sooner. 3.5 Once confirmed, we write once at most, when VIES answers for your member state again. At most, because the address is marked as written to before the mail server is asked, so a crash in between costs you that message rather than sending it twice. We would rather miss it. The address is deleted as the message goes out, and a cleanup takes anything that survived, normally within a day. There is no list to be on and nothing to unsubscribe from. 3.6 A send that fails outright is tried again. One that fails in a way that leaves us unsure whether the message went out is not, because a duplicate is worse than a miss for something you asked for once.
The outbid email
One kind of message, capped, plain text, with an unsubscribe that needs no login.4.1 At most one per listing per hour, plain text, and only when your listing loses a place. It says where you were, where you are now, and what taking the old rank back would cost. There is no tracking pixel and no click tracking. The links in it are ordinary links. 4.2 Every one carries an unsubscribe link that works without a login. Opening it asks for confirmation, and confirming stops the emails for that listing while leaving its rank untouched. Mail clients offering their own one-click unsubscribe work too. A message already handed to the mail server may still arrive after that. 4.3 Ask us at support@overbid.eu to remove the address entirely rather than just switching the emails off.
What is never stored
The counters and the language guess both run in memory and leave nothing behind.5.1 Your IP address. The live counters need to tell visitors apart, so the server keeps a truncated hash of the address in memory and nothing else. It is never written to disk and is gone when the process restarts. 5.2 Your IP is also read once, in memory, to guess which language to show you before you have chosen one. It is looked up against an offline country database, used for that guess, and discarded. It is not logged and not stored. 5.3 Page views are counted by a Plausible instance this business runs itself. It sets no cookie and stores no IP address. What it records is the page, the referring link, and the country, browser and device type the request reports; repeat visits are recognised by a hash that is rebuilt daily and cannot be traced back to you. It is served through overbid.eu rather than from another address, so your browser never contacts a second host to be counted. No third party receives any of it. 5.4 The one exception is /traffic, which publishes those numbers to everybody. That page frames the dashboard itself, so opening it does ask your browser to contact the host serving it. The page says so above the frame, and no other page here loads anything from anywhere but overbid.eu.
Processors
Four parties, all inside the EU, and nothing resembling a marketing stack.7.1 Stripe processes payments and issues invoices. The European Commission's VIES service validates VAT numbers. Hosting is in the EU. 7.2 Outbid emails are sent by the same EU server the site runs on, through its own mail relay. There is no mailing-list provider and no marketing platform, so your address is not uploaded anywhere. 7.3 When something breaks, the error and the stack are sent to Sentry in Germany so it can be fixed. Your address, your headers, the language cookie and anything in the URL after a question mark are removed first, and no log line is sent at all. It is switched off entirely unless it is configured.
Contact
One address, answered by the person who wrote the code.8.1 Write to support@overbid.eu to ask what is held about your listing, or to have it removed.