Privacy Policy

Who is responsible for your data

MG IT SOLUTIONS SRL (registration J2025037319006, tax identification 51854008), registered at Str. Burdujeni 6-8, Bl. N11, Sc. A, Et. 4, Ap. 15, 032729, Sector 3, București, Romania, is the data controller for personal data processed through slaaay.lol.

For any question about this policy or to exercise your rights, write to georgescu.mihnea0@gmail.com.

Paddle.com Market Ltd acts as merchant of record for purchases. For payment data it is an independent controller, not our processor, and its own privacy notice applies to the information you give it at checkout.

What we collect, and why

We have deliberately kept this small. There are no user accounts, no passwords and no profiles.

When you place a bid:

• The website address or X handle you submit, the category you choose, and the amount you pay. This is published on the board — that is the point of the service.
• A title, description and icon read automatically from the link you submit, which are published alongside it.
• A record of the transaction, including the amount, its status, and the identifier Paddle assigns to it, so we can credit your listing when payment completes.
• If Paddle sends it to us, the billing email associated with the transaction, so we can link a purchase to a customer and answer support questions.

When you simply visit:

• A random identifier stored in your browser's local storage, used to count how many people are online and how many distinct visitors the site has had. It is not linked to your identity and we do not use it to track you across other websites.
• A random identifier stored in a cookie, used only to remember which browser created a listing so the same browser can manage it. It contains no personal information.
• Aggregate counts of clicks on each listing. These are totals per listing; we do not build a record of what an individual visitor clicked.
• Anonymous usage statistics through Umami, which is cookieless and does not collect personal data or fingerprint visitors.

Our web host keeps standard server logs, which include IP addresses, for security and troubleshooting.

Our legal grounds for using it

Under the GDPR we rely on the following:

• Performance of a contract — publishing your listing and processing your bid once you have asked us to.
• Legitimate interests — keeping the site secure, preventing abuse, counting clicks and visitors, and understanding aggregate usage so we can improve the service. We have weighed these against your privacy and kept the data minimal and non-identifying.
• Legal obligation — retaining accounting and tax records for the period Romanian law requires.

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects for you.

Who else processes it

We use a small number of service providers:

• Paddle.com Market Ltd — payment processing, invoicing and tax as merchant of record.
• Vercel — hosting and delivery of the site.
• Turso — the database storing listings, bids and counters, hosted in the EU (Ireland).
• Umami — privacy-focused, cookieless analytics.

Two further services are contacted directly by your browser rather than by us, which means they can see your IP address and which page requested the image:

• Google's favicon service, used to show a website's icon when the site itself does not expose a usable one.
• unavatar.io, used to show the profile picture for X handle listings, because X does not permit us to retrieve it ourselves.

Some of these providers are located outside the European Economic Area. Where that is the case, transfers are made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

How long we keep it

Listings, bids and the click counts attached to them are kept for as long as the board exists, because the leaderboard and its history are the published record of the service.

Records connected to a payment are kept for the period required by Romanian accounting and tax law, currently ten years for accounting documents.

Visitor and presence identifiers are kept only as long as needed to produce the counters shown on the site. Anonymous analytics are retained in aggregate.

Your rights

Under the GDPR you have the right to:

• Ask what personal data we hold about you and get a copy of it.
• Have inaccurate data corrected.
• Ask us to delete data, where we do not have an overriding obligation or ground to keep it.
• Ask us to restrict how we use it, or object to processing based on legitimate interests.
• Receive data you gave us in a portable, machine-readable format.
• Withdraw consent at any time, where we relied on consent.

Write to georgescu.mihnea0@gmail.com and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

One limit worth stating plainly: a listing is a public advertisement that other people have seen and may have paid to outrank. We can remove a listing from display on request, but we will normally keep the underlying transaction record, because we are required to retain accounting records and because the board's history is part of the published service.

If you are unhappy with how we have handled your data, you can complain to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) at https://www.dataprotection.ro/, or to the supervisory authority in your own country.

Cookies and local storage

We do not use advertising or tracking cookies, and we do not share data with ad networks.

We store two random identifiers on your device — one cookie and one local storage entry — both described above. They are strictly necessary to operate the service and to count visitors, and neither identifies you or follows you to other sites.

Our analytics provider does not set cookies at all.

Children

The service is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Security

Data is transmitted over encrypted connections and stored with reputable providers. We do not hold card details at any point — those go directly to Paddle.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority, and you where required, within the time limits set by the GDPR.

Changes

If we change this policy we will update the date at the top of this page. Where a change materially affects how we use your data, we will make that clear on the site.