1. Who is responsible
Bidwins is the data fiduciary for personal data processed through bidwins.lol, under the Digital Personal Data Protection Act, 2023. Questions go to support@bidwins.lol.
2. What we collect when you pay
- The listing itself — the URL, category and optional handle you submit, plus the title, description and icon we read from that page. All of this is public by design.
- Payment records — the amount, currency, order and payment identifiers, and status.
- Your email, if you give one, so we can send the receipt and reach you about the listing.
3. What we never see: your card details
Card numbers, UPI PINs, CVVs and net-banking credentials are entered on Razorpay’s checkout and go directly to Razorpay. They never reach our servers and we could not store them if we wanted to. Razorpay is a PCI-DSS compliant payment aggregator authorised by the Reserve Bank of India, and processes that data under its own privacy policy.
4. Analytics, and what we chose not to do
The “N online” and “visitors today” counters work from a random token stored in your browser. That token is not linked to your identity and is deleted after 30 minutes of inactivity.
We do not store your IP address, build a device fingerprint, or run third-party advertising or analytics trackers. Listing icons are loaded from the listed site’s own domain rather than a favicon service, specifically so that browsing the board does not report your IP to a third party.
5. Click tracking
Clicking through to a listed site passes through a counting redirect on our servers and appends a utm_source parameter. We record that a click happened and on which day. We do not record who clicked.
6. Cookies and local storage
We set no advertising or tracking cookies. Your browser’s local storage holds two things: your light/dark theme preference, and the anonymous presence token above. Clearing site data removes both, and the site keeps working without them.
7. Who else processes your data
- Razorpay — payment processing and refunds.
- Our hosting provider — running the site and storing listings and payment records.
We do not sell personal data, and we do not share it for anyone else’s marketing.
8. How long we keep things
Listings and their payment history stay public while the board exists — that transparency is the product. Payment records are kept as long as Indian tax and accounting law requires, currently eight years. Presence tokens are deleted within 30 minutes.
9. Your rights
Under the DPDP Act you may ask for a copy of your personal data, ask us to correct it, withdraw consent, or nominate someone to act for you. Write to support@bidwins.lol and we will respond within 2 working days.
We can take your listing down on request. We cannot erase payment records we are legally required to retain, and removing a listing does not refund it.
10. Children
The service is not directed at anyone under 18 and we do not knowingly process a child’s personal data. If you believe we have, tell us and we will delete it.
11. Security, stated honestly
Payments are verified by signature before any listing changes, traffic is served over HTTPS, and card data never touches our systems. No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires.