Who is responsible
The controller of your data is Pedro Malheiro, who operates TickTopBid (full details in the Terms, under Operator). For anything about your data, email [email protected].
What we collect
When you add an account (Join): your email address, the TikTok @username, the categories you choose (optional), the link and ID of one of your TikTok videos (optional), the photo you upload (optional, reduced to 256×256 pixels in your browser), and when you accepted our Terms and which version.
When you pay (Join or Climb): the amount and date of each payment, the email given at checkout and the Stripe payment reference. Your card details are handled by Stripe and never reach us.
When you visit the site: minimal technical data such as your IP address, which our host Cloudflare uses to deliver the site, protect it from attacks and limit abuse. We don't store IP addresses in our database. We also use Cloudflare Web Analytics for aggregated visit statistics (such as page views, pages visited, referring sites, and country and device type); it uses no cookies and doesn't identify individual visitors. When you email us: your address and whatever you tell us.
To pay, you need to give an email address and, to join, the @username; without them we can't provide the service.
Why we use it
We use your data to publish and manage your entry, process payments, send confirmations and contact you about your entry, to perform our contract with you (GDPR art. 6(1)(b)). We keep payment and tax records and the record of your consent to the Terms and to the immediate start of the service to meet legal obligations, including tax and consumer law (art. 6(1)(c)). We use data to keep the site secure, prevent fraud, spam and abuse, handle reports, defend legal claims, answer your messages and understand how the site is used through aggregated visit statistics, based on our legitimate interest in running and improving a safe service and replying to you (art. 6(1)(f)), or on steps you ask for before a contract (art. 6(1)(b)). We don't use your data for advertising or marketing, and we make no automated decisions with legal or similar effects on you.
What is public
Each entry's @username, photo, categories, embedded video and total, the amount and date of each payment to it, and the Founding badge are public; anyone can see, share and copy them. Email addresses, payment references, card or bank details, the consent record and technical data are never public.
Who we share it with
We use a few providers, who process data on our behalf and under contract unless stated otherwise: Cloudflare (hosting, server functions, storage of profile photos, forwarding of emails sent to [email protected], aggregated visit statistics, and security); Supabase (our database, with servers in London, United Kingdom); Stripe (payments; Stripe is also an independent controller for some payment data, for example to prevent fraud, see Stripe's Privacy Policy); Resend (sending payment confirmation emails, so it receives your email address and the confirmation); and Microsoft Outlook (where emails to [email protected] are received and answered).
When you open an entry that has a video, the video loads from TikTok's official player, directly from TikTok, which may collect data about your visit and set cookies under its own Privacy Policy. When you submit an account, our server sends the @username and video link, which are public, to TikTok's official embed service to check that they exist.
We also share data with our accountant and public authorities where the law requires it. We never sell your data.
Transfers outside the EU
Some providers process data outside the European Economic Area. The United Kingdom (Supabase) is covered by a European Commission adequacy decision; transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified and/or on the European Commission's Standard Contractual Clauses.
How long we keep it
Your entry (@username, categories, video link, photo) is kept while it is on the leaderboard; if it is removed, it disappears from the site and the photo is deleted. Payment records (amounts, dates, email, payment references, consent record) are kept for the period required by Portuguese tax law, currently 10 years, even if the entry is removed. Unpaid checkouts are deleted after 30 days, and photos uploaded for them after 2 days. Emails you send us are kept as long as needed for your request and up to 2 years afterwards. Cloudflare keeps security data for short periods under its own policies.
Your rights
Under the GDPR you can ask to access, correct or delete your data (except what we must keep by law, such as tax records), to restrict or object to its use, and to receive it in a portable format. Email [email protected] from the address you used, or give us the @username and payment details so we can check it's you. It's free, and we reply within one month. You can also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the authority of the EU country where you live.
Age
The paid service is only for people aged 18 or older. We don't knowingly collect data from anyone under 18, and we delete it if we find out.
Cookies
We don't use advertising or analytics cookies, and we don't track you across other sites; our visit statistics (Cloudflare Web Analytics) work without cookies. Cloudflare may set strictly necessary cookies to protect the site against bots and attacks; these don't need your consent. TikTok's player, which loads only when you open an account that has a video, may set its own cookies and collect data under TikTok's policies. Stripe's payment page uses Stripe's own cookies to process payments securely and prevent fraud. You can clear cookies in your browser at any time.
Changes
We may update this policy; the version and date are at the top of this page, and we'll make significant changes clear on the site.