Last updated 2 September 2026

Privacy Policy

This policy explains how personal data is handled when you visit the Service, press the button, submit a takeover or Defense Boost, or complete checkout.

1. Controller

The data controller for the Service is Touristas Technologies, Sifnos, Greece. Contact details and the currently published service address are in the Legal Notice.

2. Data we process

• Public owner data: name or brand, selected competition category, optional logo, optional message, button label, destination URL, initial takeover price, current or final button value, takeover dates, ownership status, Recorded Reach, click-to-reach rate, exact displaced and successor receipts, explicit reclaim predecessor and Comeback Chain totals, Takeover Tape matchups, all-time, category, and rolling Arena ranks, daily control time, qualifying payment times, rolling spend, boost count, and click count.
• Public Defense Boost data: optional backer name or brand, optional short message, verified boost amount, intended owner, and activation time. Attribution can be moderated without deleting the payment record.
• Checkout records: the submitted owner or boost details, requested amount, currency, status, accepted disclosure version, and identifiers supplied by Stripe. Optional receipt email is sent directly to Stripe and is not stored in our checkout-attempt or webhook-audit tables. We do not receive or store complete card numbers.
• Click, live-presence, reach, and abuse data: salted one-way fingerprints derived from network and browser information, surface names, short measurement windows, timestamps, the owner active when reach was recorded, and a limited click referrer value. The application does not store the raw IP address or full user-agent string in its own event tables.
• Technical data: hosting and security providers can process request information such as IP address, device/browser data, timestamps, and diagnostic logs.
• Website preview data: when a buyer asks the listing form to detect a brand, the Service requests the submitted public website and reads public page metadata such as its title, description, site name, logo, and favicon. The submitted URL can appear in short-lived security or diagnostic logs. Detected values are not purchased or published until the buyer continues through checkout and payment is verified.
• Usage analytics: aggregate page, navigation, outbound-click, share, embed-code, checkout-funnel, and verified-purchase events through Vercel Analytics, DataFast, and Google Analytics 4. DataFast's standard tracker uses first-party visitor and session identifiers for journey and revenue attribution. A verified-purchase event includes the Stripe Checkout Session identifier as the transaction ID, currency, value, and product mechanic; it does not include card details or the submitted owner message.
• Former launch alerts: before checkout opened, the Service collected a limited number of consented email addresses with consent and notification status. That form is now closed and no new launch-alert addresses are collected.
• Challenges: the public-facing name entered in the challenge composer, its aggregate challenge count, and first and most recent challenge dates. The name can become part of a public URL, page heading, social preview image, and the Most Wanted board.
• Challenge deduplication: a salted one-way fingerprint derived from network and browser information and a UTC-day bucket. The challenge tables do not store the raw IP address or user-agent string.
• Communications: information included in legal, privacy, payment, moderation, or rights complaints sent to us.

3. Why we process it

• Contract: to create checkout, activate a paid takeover or Defense Boost, redirect the button, measure delivered clicks, and maintain the public record.
• Legitimate interests: to secure the Service, prevent fake clicks and checkout abuse, troubleshoot failures, measure aggregate use, moderate content, and establish or defend legal claims.
• Legal obligations: to keep accounting, tax, complaint, payment, and compliance records where required.
• Consent: where an optional technology legally requires consent. Optional technologies will not be treated as necessary.

4. Public information

Takeover information is intentionally public and can be indexed, copied, linked, or archived by search engines and third parties. Do not submit personal information you do not want published. Ending ownership does not remove the historical archive.

The selected owner category and derived category rank appear on indexable category boards, receipt pages, and social preview images. A category is public promotional metadata and does not imply endorsement, affiliation, or factual certification.

Closed Daily Crown scorecards derive daily control time and aggregate verified payment and click totals from the public ownership ledger. They may remain indexed and shareable after the relevant day closes.

The 24H Arena derives each ownership receipt's rolling verified spend, qualifying payment times, rank, and rolling click count from the same public ledger. The live ranking may be indexed, copied, shared, or archived by third parties even after its underlying 24-hour window changes.

A verified reclaim can store the exact archived receipt selected before checkout and publish that predecessor relationship as a Comeback Chain. The chain and its cumulative values, clicks, control time, defenses, and reign count can be indexed, shared, copied, or archived. We do not infer chains from names, domains, logos, payment details, or fingerprints, and a published link does not verify legal identity or affiliation.

A verified takeover after the founding owner stores the exact active receipt it displaced and can publish both submitted owner names, receipt links, takeover price, and time on the Takeover Tape and social preview images. This receipt relationship can be indexed, copied, shared, or archived. It documents payment-backed succession and does not verify either party's legal identity, common ownership, brand affiliation, endorsement, or wrongdoing.

Recorded Reach totals and the derived click-to-reach rate are public at Service and ownership-receipt level. A reach event represents a bot-filtered heartbeat from the main page or official iframe, deduplicated by salted visitor fingerprint, surface, and thirty-minute window. It is not a named-person profile or lifetime unique-person count.

The official live Button iframe can display the current owner's public name, logo, call to action, value, click count, and destination on third-party websites. Loading it sends an ordinary request to our hosting and analytics providers; that request can include technical data and a referrer identifying the embedding page. Clicking the owner button creates the same pseudonymous, deduplicated click record used on the main page.

Optional backer names and messages are intentionally public when a Defense Boost applies. They can be copied, indexed, shared, or archived. Use an anonymous boost if you do not want public attribution. We may hide attribution after moderation or a valid rights request while retaining non-public payment and compliance records.

Personalized challenge pages are marked not to be indexed, but anyone with the URL can view, copy, share, screenshot, or archive them. The public-facing name and aggregate count can also appear on the indexable Most Wanted board. Their URLs can appear in ordinary hosting, security, and aggregate analytics records. Enter only a public-facing name and never private, sensitive, or confidential information.

A Most Wanted count represents deduplicated explicit challenge submissions. It is not a page-view count, opinion poll, accusation, endorsement, or evidence of affiliation. We may hide or disable a target after moderation or a valid rights request.

Owner logos are loaded directly from the owner-provided URL, including inside the live widget. When a visitor views a page containing that logo, the logo host can receive ordinary request information such as the visitor's IP address, browser details, and referring page. We do not control that host's processing.

5. Service providers and recipients

• Stripe: hosted checkout, payment processing, fraud controls, receipts, refunds, and disputes. Stripe is our payment processor and may separately process information for its own legal and security purposes; it is not the seller of the advertising service.
• Vercel: hosting, serverless execution, security, logs, and aggregate analytics.
• DataFast: website analytics, visitor-journey measurement, and revenue attribution using its standard first-party tracker.
• Google Analytics: consent-mode and, when permitted, analytics-storage measurement for pages, clicks, checkout funnel events, and verified purchases. Advertising storage and personalization signals remain disabled.
• Supabase and PostgreSQL infrastructure: storage of configuration, takeover and Defense Boost history, checkout state, webhook records, click events, and rate limits.
• Professional advisers and authorities: where reasonably necessary to comply with law, resolve disputes, protect rights, or complete a business transfer.

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, standard contractual clauses, or another lawful safeguard offered by the relevant provider.

6. Retention

• Public takeover records remain in the archive while the Service operates, subject to valid deletion or legal requests.
• Applied Defense Boost amounts and their connection to an owner remain part of the payment and value ledger. Optional public attribution may be hidden or deleted where legally appropriate.
• Payment and order identifiers are retained for accounting, tax, fraud, chargeback, and dispute periods.
• Live-presence fingerprints expire after approximately 24 hours and are counted as active only when refreshed within the displayed short window. Reach-event evidence is normally retained for up to 90 days while monotonic aggregate totals remain public. Click-level records and other pseudonymous fingerprints are retained only as long as reasonably useful for measurement, deduplication, abuse investigation, and aggregate reporting.
• Challenge deduplication events are normally deleted after approximately 90 days. The public aggregate target and count can remain while the Service operates, subject to moderation, legal requests, and applicable data-protection rights.
• Legacy launch-alert records are retained only while operationally or legally needed, or until consent is withdrawn, subject to a limited suppression record where necessary to honor the withdrawal.
• Infrastructure logs follow the retention settings of the relevant hosting and security providers.

7. Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent where processing relies on consent. These rights can be limited by legal obligations, fraud prevention, freedom of expression, public archival context, or the rights of others.

You may complain to the Hellenic Data Protection Authority or another competent supervisory authority. To make a request, use the contact details in the Legal Notice and provide enough information to locate the relevant record.

8. Cookies and local storage

The core application does not use advertising cookies and does not require an account cookie. Google Analytics storage starts denied and is enabled only after an affirmative analytics choice, which is retained in local storage. Stripe Checkout runs on Stripe's domain and follows Stripe's own privacy and cookie disclosures. See our Cookie Policy for the current details.

9. Security and children

We use access controls, signature verification, restricted database roles, pseudonymization, rate limits, and encrypted transport. No online service can promise absolute security. The paid Service is intended for adults and is not knowingly directed at children.

10. Changes

We will update this page when processing materially changes. The date at the top identifies the current version.