Legal

Privacy Policy

Launch note: update retention periods, company details, lawful bases, rights language, analytics providers, and jurisdiction-specific disclosures with counsel before live launch.

Information used to operate listings

When a placement is submitted, we process the destination, canonical identity, public page title/description/images, category, requested target amount, and payment-attempt status. Public listing pages expose placement data such as rank, confirmed spend, category, recency, and aggregated click count.

Payments

Dodo Payments hosts checkout and processes payment information. We store only the identifiers, metadata, amounts, statuses, and signed event information required to create and reconcile marketplace placements. Raw card data should not pass through this application.

Outbound click measurement

To reduce fake or duplicate clicks, the redirect endpoint may use a random HTTP-only visitor identifier, timestamp, listing identifier, a one-way hash derived from network information, and a coarse user-agent classification. Raw network addresses are not written to the marketplace click-event table by this implementation.

Cookies

The public redirect flow may set rm_vid, a random HTTP-only first-party identifier used for click deduplication. Admin access uses a separate secure session cookie. The core public marketplace does not require third-party advertising cookies.

Metadata fetching

When you submit a destination, our server requests its public HTML to resolve redirects and collect display metadata. Requests use security controls designed to prevent access to private/local network addresses.

Security and retention

Financial events and spend events may be retained for accounting, dispute, fraud-prevention, and audit purposes. Click-level anti-abuse data should be retained only as long as reasonably necessary for abuse detection, then deleted or aggregated according to your final retention policy.

Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or receive certain personal data. The final deployed policy must state the rights and process applicable to the jurisdictions you serve.

Contact

Privacy requests: [email protected].