Privacy policy

Last updated: 7 September 2026

This explains what Bidding Star collects, why, and what you can do about it. Bidding Star is operated by Verus Major ("we", "us").

The short version: we collect what we need to run an auction and settle up afterwards. We never see your card number. We do not sell your data.

What we collect

When you create an account: your name, email address, and a password we store only as a hash. Optionally a phone number and a profile photo.

If you sign in with Google: your name, email address and profile picture from Google. We do not receive your Google password.

When you run an auction: your organization's name, description, logo, and the details of the auction and its items, including photos you upload.

When you bid: every bid you place, its amount and its time, and which items you have favorited.

When you pay by card: we record the amount, the time, whether it succeeded, and an identifier from Stripe. The card number, expiry and security code go directly to Stripe and never reach our systems.

When a payment is recorded offline: the amount, the method your organization chose — cash, cheque, bank transfer — and any note it added.

Automatically: your IP address, browser and device type, pages visited, and the timestamps of your requests. We keep these to run the service, spot abuse and diagnose faults.

We do not collect information from anyone we know to be under 18.

Why we use it

• To run auctions, place bids and determine winners.
• To tell you when you have been outbid, when an auction is closing and when you have won. You can change notification preferences on your profile.
• To collect payments and give organizations an accurate record of who has paid.
• To answer you when you contact support.
• To detect fraud, abuse and bid manipulation.
• To meet legal, tax and card-network obligations.

We do not use your data to build advertising profiles, and we do not run third-party advertising trackers on the auction pages.

Who sees what

The organization running an auction can see the name, email address and bid history of everyone who bids in it, and what each winner owes or has paid. It needs this to hand over items and collect money. Its use of that information is its responsibility, and our terms require it to use it only for running the auction.

Other bidders see bid amounts and times, and a bidder's display name. They do not see email addresses or contact details.

Anyone with the auction link can see the items, the current bids and the organization's own details. Auctions are unlisted — there is no public directory, and we do not ask search engines to index them — but a link can be forwarded, so treat an auction page as public.

Our service providers, only as far as they need to do their job:

Legal requests. We may disclose information where the law requires it, or to protect our rights or someone's safety.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

Payment data

Card payments are processed by Stripe under Stripe's privacy policy. Stripe is a PCI Level 1 service provider. Card details are entered into a form served by Stripe and transmitted to Stripe directly.

What we store is the amount, the outcome, the time, and Stripe's identifiers — enough to show an organization who has paid, and no more.

Cookies

We use cookies for two things:

• Signing you in. A session cookie, set when you sign in and cleared when you sign out. Without it you cannot stay signed in.
• Remembering small preferences, like whether you dismissed a message.

We do not use advertising or cross-site tracking cookies on the application. Stripe sets its own cookies on its payment forms for fraud prevention.

How long we keep it

Account information: while your account is open, and for a short period after you close it.

Auction and bid history: while the organization's account is open. An organization may delete an auction, which removes it from view.

Payment records: at least seven years, because tax, accounting and card-network rules require it. These survive account deletion — a deletion request cannot erase a record of a payment that happened.

Server logs: a rolling window, typically under 90 days.

Your choices

• See or correct your information. Most of it is editable on your profile.
• Turn off notifications. Notification preferences live on your profile. We will still email you about a payment you owe or a legal notice.
• Delete your account. Email support@biddingstar.com. We will delete what we are not required to keep, and tell you what we kept and why.
• Get a copy of your data. Ask and we will send it.

Depending on where you live, you may have additional rights — to know, to delete, to correct, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising them. Email support@biddingstar.com and we will not ask you to justify the request.

Security

Passwords are hashed. Traffic is encrypted in transit. Payment details never touch our servers. Access to production data is limited to what is needed to operate the service.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will tell you and the relevant authorities as the law requires.

Where your data is

Bidding Star is operated from the United States and your information is stored and processed there.

Changes

We may update this policy. If a change is material we will email account holders and update the date at the top.

Contact

Verus Major 1814 Pasadena Dr Austin, Texas 78757 support@biddingstar.com