Privacy Policy

The short version

No advertising cookies and no cross-site tracking. Visits are counted using cookieless analytics. When live bidding is enabled, I keep the details needed to run the auction: your email, brand details, logo, website, bid, and a payment reference. Card details are entered with Stripe and never reach this site.

While the site displays the Demo data banner, bids are simulations: nothing is submitted, stored, or charged.

Who controls your data

Brand My M3 is run by Aleksandar Hristov, an individual based in Bulgaria(“I”, “me”). I am the data controller for the processing described here. Contact: aleksandar.hristoffv@gmail.com.

What I collect when you bid

• Email address — to confirm your bid, notify you if you are outbid, and contact you if you win.
• Brand name, logo, and website — to review the sponsor and publish the approved placement on the car and site.
• Bid amount and time — to operate and display the auction.
• A bid identifier — a random value used to recognise later bids from the same bidder. It is not a general-purpose account.
• Payment references — identifiers returned by Stripe so deposits can be reconciled, refunded, or applied to an invoice. I do not receive or store your full card number.

The main legal basis is taking steps at your request and performing the sponsorship agreement. I also process limited data for legitimate interests in preventing abuse, securing the auction, and resolving disputes, and where necessary to comply with legal obligations such as accounting and tax rules.

What is public

Once a bid is approved, the brand name, logo, website, panel, and bid amount may appear publicly. Your email address, payment reference, and bid identifier are never published or shared with other bidders. Pending or rejected bids are visible only to me and the service providers needed to process them.

Cookies, local storage, and analytics

This site is intended to use DataFast in its cookieless mode. It does not use cookies for visitor identification. DataFast receives limited technical information such as the page visited, IP address, and browser user-agent to produce a pseudonymous visitor identifier that rotates roughly every 24 hours. There is no advertising network or cross-site profile.

The site may keep bidding details and a session-counting flag in your own browser so you do not need to re-enter them. Browser storage stays on your device unless you choose to submit a bid.

Service providers

• Supabase — database, authentication, and logo storage.
• Resend — transactional bid and outbid emails.
• Stripe — deposit collection, refunds, and payment records.
• Vercel — site hosting and standard infrastructure logs.
• DataFast — cookieless audience measurement.

These providers may process data outside the European Economic Area. Where required, transfers are covered by an applicable adequacy decision or contractual safeguards. I do not sell personal data or use it for unrelated advertising.

How long I keep it

Approved bid and sponsorship records are kept for the sponsorship term and for as long as reasonably needed to handle payment, warranty, tax, accounting, or legal claims. Rejected or withdrawn bid data and unused logo files are deleted within 30 days unless a legal obligation or active dispute requires longer retention. Financial records are retained for the period required by applicable Bulgarian law.

Your rights

Under the GDPR, you may ask to access, correct, delete, restrict, or receive a portable copy of your personal data, and you may object to certain processing. These rights can be limited where the law requires data to be kept. Email aleksandar.hristoffv@gmail.com; I will respond without undue delay and normally within one month.

You may also complain to Bulgaria's Commission for Personal Data Protection.

Changes

If this policy changes materially, the date above will be updated and active sponsors will be notified where the change affects how their data is used.