Privacy Policy

1. Data controller

BidAKey is operated by QWERTY KEY SRL, CUI 44393084, Str. Oituz no. 3A, Baia Mare, Maramureș, Romania. For privacy questions or requests, email contact@qwertykey.ro.

2. Data we handle

• brand name, email, website, description and contact details;
• VAT / Tax ID, if a business purchase is selected at payment;
• selected key or strap, bid value and history, terms acceptance and review status;
• logo, selected strap colour, artwork file, filename and review result;
• for preorders: name, email, phone, delivery and billing address, company details, product, quantity, chosen card text, price and accepted terms version;
• Stripe payment identifiers and statuses, but not full card numbers;
• messages, operational records, IP address and technical security logs.

An approved bidder's name, website, description, logo and strap colour may be shown publicly on the claimed spot. The VAT / Tax ID collected for invoicing is not displayed publicly.

3. Why we use data

We use data to verify email and artwork, administer bids, process and refund payments, communicate results, produce and deliver the limited edition, administer preorders, issue invoices, prevent fraud, secure the service and comply with legal obligations.

Our legal bases are pre-contractual steps, contract performance, legal obligations, legitimate interests in operating and protecting the service, and consent where required.

4. Providers and transfers

We do not sell personal data. We may share only what is necessary with providers for hosting and databases, storage, email, security, payments, invoicing and delivery, and with advisers or authorities where legally required. Stripe handles card details under its own notice.

Some providers may process data outside the European Economic Area. Where needed, we rely on adequacy decisions or approved contractual safeguards.

5. Local storage and cookies

Public chat displays nicknames and messages from the last 2–3 hours. A signed cookie identifies your chat session for up to 30 days; your nickname and sending cooldown are saved locally for convenience. To limit spam and enforce temporary blocks, the server uses a session identifier and a cryptographic fingerprint of the IP address, without publishing either. Expired messages are hidden immediately and removed from the active database during automatic cleanup, scheduled every 5 minutes. Guest sessions are cleaned up after 24 hours of inactivity, verified sessions expire after 30 days, and blocks after 24 hours. Linking an email is optional and requires a code valid for 10 minutes, sent through MailerSend. Email addresses stay private and linking does not subscribe you to marketing. Linked profiles may display a bidder badge, the total of publicly approved bids, and held or lost spots. Chat accounts are deleted after 90 days of inactivity. Do not post personal information in chat.

We count page views and outbound sponsor clicks in aggregate without storing the IP address, user agent or a persistent identifier in the analytics tables. For the realtime number shown on the site, the browser maintains a temporary Supabase Presence connection while the page is open.

If Google Analytics is enabled, it starts only after you consent. Your choice is stored locally in the browser and can be changed through “Analytics settings” in the footer. Google Analytics may process device information, visited pages and traffic sources under its own terms. We do not use this data for personalised advertising.

To safely resume a preorder, sessionStorage temporarily holds the checkout key and entered delivery and billing details. We do not store card data. This local data is removed after displaying final confirmation or when the browser session ends.

Logo previews remain in page memory and disappear on reload. After submission, artwork is stored privately for review.

For optional email alerts, we store your verified email address, language, selected preferences and confirmation or unsubscribe date. MailerSend delivers only the public activity you selected: new records, outbids or all approved bids. Address verification is also required to change preferences. Unsubscribe using the link in any alert; this does not stop necessary messages about your own bids and payments.

If you enable notifications, we store your browser subscription endpoint, delivery keys and language to send public auction activity through your browser’s push service. The subscription is not linked to your email or bids. Delete it through “Notifications on” → “Turn off”; you can also revoke permission in browser settings. We remove subscriptions reported as expired by the push service.

6. Retention

Verification challenges expire quickly. Unsuccessful bid records and files may be retained for up to 12 months for administration, security and disputes, then deleted or anonymised unless a longer duty applies. Transaction records, invoices and winning-bid data are retained for statutory periods and as needed for production and legal claims.

7. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent. Email contact@qwertykey.ro. You may complain to Romania's data-protection authority.

8. Security and changes

We apply reasonable technical and organisational safeguards, but no online service is risk-free. The service is intended for people aged 18 or over. We may update this policy when the service or law changes; the date above identifies the current version.