Privacy Policy

Effective August 25, 2026. Last updated August 25, 2026.

This Privacy Policy describes how topdeals.lol (https://topdeals.lol) collects, uses, and shares information when you browse the site, click a listing, or pay for a ranking. It is part of our Terms of Service.

Who is responsible

The controller for personal data processed through the Service is Tiny lab startups LLC, a company based in Massachusetts.

What we collect

We keep the Service small. We collect only what we need to operate the board, process payments, stop abuse, and understand traffic.

  • Session identifier. A random session ID is stored in an HTTP-only, SameSite Lax PHP session cookie. We use it to protect checkout and forms (CSRF), enforce rate limits, and keep the board usable while you browse. It is not your name and is removed when you close your browser, unless your browser restores sessions.
  • Checkout and listing data. The URL and deal you submit, the bid amount, and the public name, description, and image we fetch for that destination. We store the payer email and payment identifiers received from Stripe to place and manage the listing, including allowing the listing owner to request an update link by email.
  • Payment data. Card details are processed by Stripe, not stored by us. Stripe may provide us with payment confirmation, billing details, and amounts. See Stripe's own privacy notice.
  • Clicks. When you visit a listing from the board, we add one to the public click counter for that listing. We do not store the time, your IP address, or a visitor ID with each individual click.
  • Technical data. Standard request data such as user agent, referrer, and IP address may be processed by our host to operate and secure the Service. IP addresses are hashed for rate limiting and abuse prevention. DataFast's cookieless script may also process technical data for visit and live-visitor counts.
  • Messages you send us. If you email us, we keep that correspondence as needed to respond and to keep a legal record.

Cookies

The PHP session cookie is a strictly necessary, HTTP-only cookie. It lets checkout, CSRF protection, and rate limiting work. We do not use it for advertising. Analytics on topdeals.lol is loaded with the DataFast cookieless script, which does not use cookies to identify visitors. We do not store a theme preference cookie.

Why we use this data

  • Contract. To take payment, create or raise a listing, show rank, and provide the Service you asked for.
  • Legitimate interests. To keep the board fair (rate limits, bot filtering), display public listing metadata, measure visits, debug outages, and defend legal claims. You may object to processing based on legitimate interests as described below.
  • Legal obligation. To keep tax, accounting, and complaint records where the law requires it.

Public listings

Rank, spend, names, images, descriptions, and destination links on the board are public. Anyone can see them, including search engines. Do not list a destination if you do not want that information shown. We fetch public metadata from the site you submit so visitors can recognize the listing. That fetch may disclose to the destination that topdeals.lol requested the page.

Who we share data with

  • Stripe — checkout and payment confirmation.
  • DataFast — cookieless visit and live-visitor counts. We also show a public stats page and may use an affiliate link to DataFast.
  • Hosting, database, and edge infrastructure (currently including Vercel and Postgres) so the site can run.
  • Identity lookup helpers (for example, metadata and favicon services) so we can show a name and picture before and after checkout.
  • Professional advisers, authorities, or a buyer of the Service if we must share data to comply with law, enforce the Terms, or transfer the project.

We do not sell your personal data. When you use the Service, your data may be processed by the third parties listed above under their own terms and privacy notices.

How long we keep it

  • PHP session cookies last for the browser session, or until you clear cookies.
  • Public ranking entries stay while the listing is on the board and may remain in backups or activity history after a takedown for a limited time.
  • Payment identifiers and amounts are kept as long as needed for accounting, tax, fraud, and dispute handling.
  • Rate-limit data is kept only for the length of the rate-limiting window, typically minutes.

Your rights

If the GDPR or similar law applies to you, you may ask us to access, correct, delete, or export personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing was based on consent. You may also lodge a complaint with a supervisory authority, including in your state or country of residence.

Email contact@topdeals.lol. We may need enough information to find your data. Public listing content that is also on your own website is not made private just by appearing on the board; you can ask us to remove the listing.

Children

The Service is for adults. We do not knowingly collect personal data from children. If you believe a child has used the Service, contact us and we will delete the data we can identify.

Changes

We may update this policy when the Service or the law changes. The date at the top of this page is the current version. If a change is material, we will post the updated policy here.