Privacy · 18 September 2026
Only what the
ranking needs.
Who is responsible
Lazy Uzer Studio is the controller for personal data processed through bid.design. Email support@lazyuzerstudio.com. Ranking and listing mechanics are on How it works. Contract terms are on the Terms page.
What we collect
We collect what we need to run the board, take payment, host games, stop abuse, and keep a guest or claimed player connected.
That includes the site or X handle you submit, category, preview and replacement images, bid or Credit amount, public name and description we resolve or you edit, and payment-status identifiers from Stripe. Stripe collects card and billing details; we do not store full card numbers. A host-scoped session cookie keeps a guest or claimed player, Credit wallet, match history, and owned projects on bid.design. Preference cookies such as reduced motion may also be stored. Network addresses are converted to versioned one-way risk hashes and are not kept raw. If you protect a player with email, we store that address to send the magic link. If you write to us, we keep the correspondence needed to respond and to keep a legal record.
Live presence
The canvas may share a random session label and cursor coordinates with other current visitors. At most five remote cursors are shown. This presence data is ephemeral, is not added to the ranking database, and disappears after the session leaves or times out.
Why we use it
We use this information to create and fulfil placements, run games and Credit wallets, prevent abuse, provide receipts or status notices, maintain the public archive, debug outages, and meet legal or accounting obligations. Where GDPR or similar law applies, we rely on contract to provide the service you asked for, legitimate interests to keep the board fair and secure, legal obligation for tax and complaint records, and consent where you ask us to email a protection link.
Public listings
Approved names, URLs or X handles, previews, rank, total bid, and payment method may appear on the board and in search engines. Do not list a destination if you do not want that shown. Fetching public metadata may disclose to the destination that bid.design requested the page. Wallet buckets, private payment data, fraud signals, and submission status links are never shown in the gallery.
Images and review
Submitted, captured, and replacement images are stored in a private bid.design area of Supabase Storage and delivered through short-lived signed links. Approved public previews use an ingested copy. Abandoned uploads and raw capture artifacts are kept no more than 24 hours unless they are held for a legal or safety review. New work stays private until a reviewer approves the captured version. We send bounded submission text and a short-lived image link, when available, to OpenAI's moderation API to produce a safety signal for the reviewer. That signal does not approve or reject a submission by itself. Review packets and decisions are retained for audit and safety. OpenAI's API data controls and abuse-monitoring retention apply to the data it processes.
Who we share with
Limited data may be processed by Vercel for hosting, Supabase for identity, product data, images, and presence, Stripe for payments, Resend for transactional email, Google Web Risk for URL threat checks, OpenAI for text and image safety signals, and an isolated page-capture service for review artifacts. Their own privacy terms govern their processing. Some processors may be outside the European Economic Area; where we rely on them we use appropriate safeguards such as standard contractual clauses or an equivalent they provide. We do not sell personal data. We may share data with advisers, authorities, or a buyer of the service if required by law, to enforce the Terms, or to transfer the project.
Retention and rights
Payment, ranking, and Credit-ledger records are kept for integrity, accounting, tax, fraud, and dispute handling. The host-scoped player cookie can last for up to one year unless you clear it; authentication and preference cookies may have shorter lifetimes. Click and abuse hashes are kept only as long as useful for rate limiting. Public placements may remain in the archive or backups for a limited time after a takedown.
If GDPR or similar law applies, you may ask us to access, correct, delete, or export personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where we relied on it. You may also lodge a complaint with a supervisory authority where you live. Email support@lazyuzerstudio.com. We may need enough information to find your data. Public listing content that also exists on your own site or profile is not made private just by appearing on the board; you can ask us to remove the listing.
Children
The service is for adults. We do not knowingly collect personal data from children. If you believe a child has used bid.design, contact us and we will delete the data we can identify.
Changes
We may update this policy when the service or the law changes. The date at the top is the current version. If a change is material, we will post the updated policy here.