Privacy and cookies

1. Who is responsible

Boost My Brand, MB, company code 308093917, Dvarininkų g. 49, Klemiškės II k., LT-91290 Klaipėdos r., Lithuania is responsible for your data on Popbid (the “controller”). Questions or requests: info@popbid.eu.

2. What we keep

• Account: name, email, password (stored scrambled, we can’t read it), profile photo, your country (optional), the language you chose and when you accepted the terms.
• Shop (sellers): shop details; your legal name, address and date of birth or your business details; your tax number when the tax report needs it; contact details for buyers; the address you ship from, a phone number for the carrier and your shipping time. Business sellers can also upload a photo or PDF of their registration certificate (stored scrambled; only you and our team can open it). We keep the result of checking your registration number in official registers and our approval decisions with the reasons we gave you.
• Delivery (buyers): your name, mobile phone and the parcel locker or home address you choose, in Lithuania, Latvia, Estonia or Poland. Each order keeps its own copy. Parcels: the label we book for an order, its tracking number and drop-off code.
• Payments: Stripe keeps your card; we see only the brand, last 4 digits and expiry. For sellers, Stripe checks identity and bank details and tells us whether payouts are ready.
• Activity: bids and pre-bids, orders with their fees, saved items, shops you follow, reminders and saved searches.
• Problems and returns: what you write when you report a problem or start a return, the photos you add (stored scrambled; only the buyer, the seller and our team can open them), the answers and our decisions.
• Return claims and warnings: when a seller says a returned item came back worse, the claim, our decision, whether you paid it and any warning on your account.
• Bank disputes: when a buyer asks their bank to reverse a payment, the dispute, the evidence we send and the outcome.
• Short videos (sellers): the videos you add to your items (PopClips), which our video service keeps for us. Also our decisions when we hide or remove one.
• Private messages: what you and a buyer or seller write to each other, the photos you send and your reactions (like 👍 or ❤️), so you both keep a record of what was agreed about an item or order. See Your private messages.
• Live chat: what you write in a show’s chat, which everyone watching that show can see.
• Reviews: the stars and comment you give an order. They’re public on the shop page with your display name.
• Reports: reports you send or that are about you; our decisions.
• Invites: who invited you, who you invited and your credit.
• Emails we send you: a copy of each email, to check it was delivered.
• Technical: your IP address for a short time (to stop spam and attacks), the IP address and browser type of each login (kept with that login); if an account is closed for return abuse, a scrambled (hashed) form of the internet addresses it signed in from, so the person can’t come back at once; error reports (the page and browser type, no personal content).

3. Why we use it

• To run the service you asked for (your contract with us): your account, bidding, orders, payments, delivery, messages, invite rewards.
• Because the law requires it: accounting records, business sellers’ details shown to buyers, reporting sellers’ sales to the tax authority (DAC7), answering authorities.
• For legitimate interests that don’t override your rights: preventing fraud and abuse (including return abuse and blocking the connections of closed accounts), keeping the site safe, reviewing reports, answering bank disputes and defending legal claims, fixing errors and counting how Popbid is used (totals only, no tracking of individuals).
• With your consent: show alerts and saved-search emails, which you can switch off in Notifications or with the link in each email. If you live in an EU country we don’t serve yet, you can also tick a box in Account to get one email when we start serving it. Nobody is emailed without ticking it and you can untick it any time.
• With your consent (cookies): counting visits with Google Analytics, only if you choose “Accept all” in the cookie bar. See Cookies.

We don’t sell your data and we don’t show advertising.

4. Your private messages

Private messages are between you and the other person. We keep them so you can both look back at what was agreed about an item, a delivery or a return. It’s also the record if something goes wrong.

• Encrypted: messages and photos travel over encrypted connections. Before they’re stored, we encrypt them again with a key that’s kept apart from the database. Anyone who opens the database or photo storage, our own team included, sees only scrambled text.
• Our team can’t read them: Popbid’s team tools show a conversation only after you or the other person reports it. Even then our team uses it only to sort out that problem. The only other case is when the law makes us hand it over, for example a court order.
• Automatic safety check: before a message is sent, a computer checks it for email addresses, links, phone numbers and bank account numbers, because moving a deal off Popbid is how most scams start. A message that fails the check isn’t sent or saved. No person reads messages for this.
• Reactions: a reaction is stored as a word (for example “love”) next to the message, without encryption. It holds nothing you typed.
• Email alerts: if you don’t read a new message within a few minutes, we email you. The email includes the start of the message.

Popbid’s servers unscramble a message only to show it to the two of you, to run the safety check and to put the start of it in your email alert. This isn’t end-to-end encryption like some chat apps, which is what lets us check for scams and look into reports.

Live chat in a show is different: it’s public to everyone watching. The seller and our team can remove messages that break the rules.

5. Who sees your data

Other people on Popbid see your display name when you bid, chat or message. Buyers see a seller’s shop and, for business sellers, the business details. On Popbid a seller sees your display name and the carrier and the locker (or the city for courier) your parcel goes to, never your phone number or home address. Your name, phone number and locker or address go to the delivery company for the label. The label the seller prints shows your name and where the parcel goes (and your phone number when the carrier prints it); the seller may use it only to send that parcel. On Popbid buyers see only the city and country a seller ships from. The seller’s ship-from address and phone number go to the delivery company and the seller’s name and address are printed on the parcel as the sender.

Companies that help us run Popbid (processors). They work only on our instructions, under contracts that protect your data:

• Supabase: database and login (servers in Frankfurt, Germany)
• Cloudflare: website hosting, photo storage (in the EU), short videos and spam protection
• LiveKit: live video
• Resend: sending emails; Hostinger: our own email inbox
• Siųsk pigiau (the shipping service) and the carrier that takes your parcel (Omniva, Unisend, SmartPosti, Venipak, DPD or Nova Post): they receive your name, phone number and locker or address, only to deliver it

Stripe handles payments and checks sellers’ identity. You see Stripe’s card form when you save a card. For identity and fraud checks Stripe is also responsible for the data itself (a controller); see stripe.com/privacy.

Banks, through Stripe. If a buyer asks their bank to reverse a payment, we send Stripe (and through Stripe the bank) the facts of the order: the buyer’s name and email, the delivery address or locker, the tracking and delivery record, the terms they accepted and how many messages were exchanged (never what they say). We do this to answer the claim, which is our legitimate interest.

Google Analytics (Google Ireland Limited), only if you chose “Accept all”: counts visits for us. It sees which pages are opened, how people arrive (for example from an ad or a search), the type of device and browser and the rough location (country and city). It uses a random number stored in a cookie and never receives your name, email, address or account. Google works on our instructions (a processor) and doesn’t keep your IP address for this. Google may process the data in the United States, under the EU–US Data Privacy Framework.

Some of these companies are based in the United States. Where data leaves the EU it’s protected by the EU–US Data Privacy Framework or the EU’s standard contract clauses. For a copy of these safeguards write to info@popbid.eu.

Official registers. To check a business seller’s registration number we look it up (only the number, VAT number and name) in public registers: the European Commission’s VAT number checker (VIES), the Polish Ministry of Finance VAT list and the Latvian and Estonian company registers.

We share data with authorities only when the law requires it.

6. How long we keep it

• Account, shop, products, shows and photos: until you delete your account. That includes registration documents (you can remove them yourself in Shop settings) and the history of our approval decisions.
• Orders, payments and fees: 10 years, as Lithuanian accounting law requires (without your account once it’s deleted). The name, phone number and address kept for an order are erased 90 days after the parcel is delivered (or the order is refunded or cancelled) or sooner when you delete your account. They are kept longer only while a bank dispute about the order is open. The carrier, the locker name or city and the parcel size stay with the order.
• Sellers’ legal and tax details (name, address, date of birth or business details, tax number) and their sales: up to 10 years after the year they relate to, for the tax report (DAC7) and the accounts, also after the shop is deleted.
• Problem reports, returns and their photos: while the case is open and for 1 year after it is closed (longer only while a bank dispute or legal claim about the order is open).
• Short videos: until the seller or our team removes them or the product or shop is deleted. Then they are deleted from the video service within minutes. We keep the reason and date when our team removes one.
• Bids and live chat: kept with the show under the display name you had, until the seller deletes the shop. If you delete your account they are no longer linked to it.
• Return claims: with the order (10 years, for the accounts). Warnings: counted for 12 months. The scrambled internet addresses of an account closed for return abuse: 90 days.
• Copies of emails we sent: 90 days. A waiting-list sign-up you never confirmed: 30 days.
• Carrier reports about your parcel (on its way, ready, delivered) and your locker pickup code: kept with the order. The pickup code is visible only to you.
• Messages you sent stay in the other person’s conversation after you delete your account, no longer linked to you.
• Reviews: while the shop exists. If you delete your account, your reviews stay (so shop ratings stay honest) but no longer show your name.
• Reports and our decisions: up to 2 years after the decision.
• Error reports: up to 6 months. IP addresses for spam protection: minutes. A login’s IP address and browser type: until you log out or the login ends.
• Google Analytics visit data: up to 14 months, then Google deletes it.

7. Your rights

You can ask to see, correct, delete or move your data, object to how we use it or restrict it. Most of it is in your hands:

• Download my data in Account gives you a copy of everything we keep about you.
• Edit your profile and shop at any time.
• Delete my account in Account removes it.

Where we use your data with your consent (for example show alerts) you can withdraw it at any time. For anything else write to info@popbid.eu; we answer within a month. You can also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or to the data protection authority where you live.

8. Automatic checks

Some safety rules work automatically: new buyers can spend up to €500 per show until their first order arrives. Bidding pauses after 3 unpaid orders in a year. Private messages with email addresses, links, phone numbers or bank account numbers aren’t sent. If one of these affects you and you think it’s wrong, write to us and a person will look at it.

9. Cookies

Popbid uses cookies that are needed for the site to work and, only if you choose “Accept all”, analytics cookies (Google Analytics). The cookie bar shows on every page until you choose and “Decline non-essential” is as easy as “Accept all”. The legal basis for these cookies is your consent. Your choice is saved on your device. You can change your mind at any time with Cookie settings at the bottom of every page and in Account. If you decline, the tools stop at once and we delete their cookies on popbid.eu.

• Login: keeps you logged in. Until you log out.
• popbid_invite: remembers a friend’s invite link until you join. 30 days.
• pb_lang: remembers the language you chose. 1 year.
• pb_mode: remembers that you switched to selling. 30 days.
• Stripe: set on payment pages to prevent card fraud. Up to 1 year.
• Security: our hosting provider may set a cookie to tell people from bots.
• _ga and _ga_… (Google Analytics, only after “Accept all”): a random number to count visits. 2 years.

Your browser also remembers a few settings on your device, such as your cookie choice and that you’ve seen the live chat rules.

10. Children

Popbid is for people aged 18 and over. If we learn that an account belongs to someone younger, we close it.

11. Changes

If we change this policy in a way that matters, we tell you by email or on the site before it applies.