Privacy Policy

The controller for personal data processed through the Service is Erwann Robin, operating GeoPoly as an individual. Privacy requests and questions: privacy@geopoly.bid.

We keep the Service small and collect only what it takes to run it.

• Account data. Your email address, or the phone number you verify over WhatsApp, plus a user id, a display name and any profile details you add. Sign-in sessions are kept in your browser so you stay signed in.
• Auction and ownership activity. Bids, amounts, timestamps, watchlists, territories you own, transfers, sales and the ledger entries behind them. Much of this is public — see below.
• Payment data. Card details and billing identity are collected by our payment provider, not by us. We store the provider’s confirmation identifiers, the amount, the currency, the status and the refund record so we can place, refund and reconcile bids. We never see or store full card numbers.
• Payout data. When you withdraw a balance, the payout method and the account details you enter, plus the status and reference of the transfer. We keep these for accounting and dispute handling.
• Advertising content. The creatives, text, links and destinations you publish on a territory, and the public metadata we fetch for a linked destination (title, description, favicon, preview image) so visitors can see where a link leads. Fetching that metadata tells the destination site that GeoPoly requested the page.
• Interaction counts. Views, clicks on advertising links, and watcher counts. We may record a timestamp, the territory or link, and a coarse or hashed network identifier to rate-limit and to filter fake activity — not to profile you.
• Technical data. Standard request data such as IP address, user agent and referrer, processed by our hosting and database providers to serve, secure and debug the Service, plus server error reports.
• Messages and notices. Disputes you open, rights or abuse notices you send, and support correspondence, kept as needed to respond and to keep a record.

We use strictly necessary cookies and browser storage for the sign-in session and for keeping a bid flow attached to your browser. Your theme preference (light or dark) is stored locally on your device. We do not run advertising or cross-site tracking cookies.

• Contract. To sign you in, take and refund payments, run auctions, record ownership, serve advertising, calculate royalties and pay out balances.
• Legitimate interests. To keep the market fair — rate limits, bid-manipulation and bot filtering, moderation — to display public market data, to measure and debug the Service, and to establish or defend legal claims. You may object to processing based on legitimate interests, as described below.
• Legal obligation. To keep tax, accounting, fraud and complaint records where the law requires it.

GeoPoly is a public market. Territory ownership, the current price, bid history and bid amounts, activity, watcher and view counts, public profiles and the advertising published on a territory are visible to anyone, including search engines. Your display name and profile are shown next to that activity.

Your email address, phone number, payout details and payment identifiers are not public. Do not publish anything in an advertisement or profile that you do not want shown publicly.

• Our payment provider, for checkout, refunds, payouts and dispute handling.
• Our WhatsApp phone-verification provider, for phone sign-in.
• Our hosting, database, authentication, email and map/geodata providers, so the Service can run and send transactional email such as outbid and win notifications.
• Professional advisers, authorities, or a buyer of the Service, where we must share to comply with the law, enforce the Terms, or transfer the project.

We do not sell your personal data and we do not share it for advertising. Some providers operate outside the European Economic Area; where they do, we rely on the safeguards they offer, such as standard contractual clauses.

• Account data: while your account exists, then for the periods below.
• Public market records — bids, ownership, transfers and ledger entries: kept indefinitely, because the market’s history and ownership chain have to stay verifiable. After account deletion we detach them from your identity where we can, but the transactions themselves remain.
• Payment and payout records: as long as accounting, tax, fraud and dispute rules require.
• Technical logs, IP data and anti-abuse records: only as long as useful for security, rate limiting and aggregate counts.

If the GDPR or a similar law applies to you, you may ask us to access, correct, delete or export the personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing was based on consent. You may also complain to a supervisory authority in your country of residence.

Email privacy@geopoly.bid. We may need enough detail to find your data. Note that deleting an account does not erase the public transaction record described above, and content you published elsewhere does not become private by being removed from GeoPoly.

Access to the database is restricted per user by row-level security rules, payment card data never reaches our servers, and traffic is encrypted in transit. No service is perfectly secure; tell us at privacy@geopoly.bid if you find a problem.

The Service is for adults. We do not knowingly collect personal data from children. If you believe a child has used the Service, contact us and we will delete what we can identify.

We may update this policy when the Service or the law changes. The date at the top of this page is the current version, and material changes are posted here.