Draft for legal review · not in force yet

Privacy notice

This draft describes how Who Paid For This handles information today. It is not the final notice. Before it takes effect, the operator’s legal name and address, a version and effective date, the applicable retention periods, and the rights that apply in each service location need to be confirmed with counsel.

What we collect

• Contact and request details: your email address when you subscribe to handover notices, and the name, company or brand, work email, preferred dates, campaign objective, and other details you include in a takeover request.
• Campaign submissions: copy, links, images, video, audio, fonts, 3D files, and other materials you upload or place in a campaign. Approved campaign material and related sponsor details may be made public on the homepage and in the archive. Do not include sensitive personal information unless it is necessary and you have a lawful reason to provide it.
• Account and security information: account email, organization and role, authentication/session data, and hashed request keys and counters used to limit abuse. The application’s rate-limit table stores hashed keys rather than the raw key.
• Booking and payment records: requested dates, duration, quote, reservation and balance amounts, customer contact details, payment-provider references, and payment or refund status. Dodo Payments handles payment and billing details on its hosted checkout; this site does not receive or store full card numbers.
• Campaign engagement events: a random browser session identifier, event type, timestamp, and limited context such as a referring host, campaign tags, scroll depth, or time engaged. These events are associated with a campaign so its owner can see aggregate engagement. The identifier is stored in session storage and is not used by this service to follow you across other websites.
• Homepage traffic counts: timestamp-only records used for internal traffic pricing. They contain no visitor identifier and are deleted after seven days. Browser analytics events do not directly set the price; the application uses verified daily totals or an owner-set rate.
• Cloudflare Web Analytics receives page-view and browser performance measurements through its browser beacon. Cloudflare may also receive technical request information when your browser loads the page or beacon. The analytics is used for site measurement, not to set booking prices.
• Abuse-prevention information: when a booking challenge is shown, your browser sends a Turnstile response token to our server for verification with Cloudflare. Cloudflare may process browser/device and network signals to assess whether the request is automated. The application also stores hashed rate-limit keys and counters.
• Service and security logs: our hosting, database, email, asset-storage, payment, and security providers may process technical information such as IP address, device/browser details, request time, and URLs as part of delivering, securing, and troubleshooting their services. Provider log retention is controlled by the provider and its settings.

Why we use it

• To respond to a request, evaluate a campaign, manage dates, and provide the service you asked us to provide.
• To verify reservations and payments, deliver an approved campaign, answer support requests, and resolve payment, refund, or service disputes.
• To protect the site, prevent abuse, maintain records needed for accounting or legal obligations, and understand aggregate campaign engagement.
• To send a handover notice after you confirm that subscription. You can unsubscribe at any time.

Depending on your location and the purpose, processing may rely on steps you ask us to take before a contract, performance of a contract, your consent, our legitimate interests in operating and securing the service, or legal obligations. The final notice must confirm the applicable legal bases.

What may be public

After approval, campaign content, sponsor or organization name, booking dates, and the completed campaign archive may be visible to anyone. Do not submit contact details, personal information, or other material for publication unless you have the right to publish it. Your campaign owner may also place third-party links or tracking technology in approved material; this draft does not cover the privacy practices of those third parties.

Who operates and processes it

Who Paid For This is the service name shown on this site. The legal name and service address of the business responsible for it have not yet been added to this draft and must be supplied before the notice takes effect. The contact for privacy questions is hello@whopaidforthis.com.

Depending on the feature you use, information is handled by Vercel (hosting), Supabase (authentication and database), Cloudflare (asset storage, Turnstile, and Web Analytics), Resend (email delivery), and Dodo Payments (hosted checkout and payment processing). These providers process information under their own service terms and may process it in different countries. We do not sell personal information or use it for cross-context behavioral advertising. We do not publish subscriber email addresses.

How long we keep it

Homepage timestamp records are deleted after seven days. Rate-limit counters are deleted after their limit expires plus a one-day cleanup buffer. Session storage generally lasts only for the current browser tab or session. Handover-list addresses remain until you unsubscribe or ask us to remove them; a minimal suppression record may be retained to honor your opt-out. Campaign engagement events do not currently have an automatic deletion schedule and remain with their campaign records. Requests, account, order, and payment-status records are kept as needed to provide the service, handle disputes, and meet accounting or legal obligations; fixed periods for those records still need to be set. Uploaded campaign assets and approved archive copies do not currently have a published deletion period and may remain available as described in the Platform Terms. Dodo Payments may retain payment records under its own terms.

Cookies and browser storage

The control room uses authentication cookies to keep an authorized operator signed in. The campaign experience uses session storage for a random engagement identifier, a first-visit flag, and temporary drafts; a local storage preference remembers whether you enabled sound. Cloudflare Web Analytics and Turnstile run through third-party browser scripts when configured. This draft does not describe those providers’ own storage in full; see their notices before the final version is published.

International processing and security

Our service providers may process information outside your country. The final notice should identify the relevant countries and any transfer safeguards required by the laws that apply to the operator and its customers. We use access controls, private storage, and service-provider security features intended to protect information, but no internet service can promise that every transmission or system will always be secure. If we learn of a personal-data breach that triggers a legal notice duty, we will follow the applicable law.

Your choices and rights

Every handover email carries an unsubscribe link. Depending on where you live, privacy law may also give you rights to request access, correction, deletion, a copy of your information, or to object to or restrict some processing. Email hello@whopaidforthis.com to make a request. We may need to verify your identity and may retain information where the law permits or requires it. The final notice should identify the responsible regulator and any additional location-specific rights.