Privacy

A bid includes your email, brand name, website, uploaded logo, panel, amount and payment status. The brand, website, logo and leading amount may be shown publicly. Your email is never shown on the board.

Providing bid details is voluntary, but the required fields are needed to place and verify a bid.

Your browser stores a random bidder token. It grants access to your bidder account, does not contain personal information and survives normal refreshes and browser restarts. Supabase keeps only a one-way hash of it with your email so you can return to your bidder account and pay only the increase when raising a lead you still hold. If you lose access, /recover sends a verification code through Supabase Auth to the email used for bidding. Supabase stores an authentication record for this verification. Successful recovery rotates your token and retains a hash of the revoked token to block old links. Only payments backing a lead you still hold count as credit; payments queued for an outbid refund cannot be spent again. Emails are not published. If multiple bidder accounts share the email, contact @downtobuild on X for manual recovery.

Stripe hosts checkout and processes payment. Card details stay with Stripe and never reach Brand My Prius. The site keeps payment and refund references, charged and refunded amounts, the refund reason and policy, and the recorded fee deduction needed to confirm bids, process automatic outbid refunds, prevent duplicates and reconcile failures. These payment records are not published.

Supabase powers an anonymous visitor count and a temporary live presence count. Your browser stores a random first-party visitor identifier and a separate presence identifier in local storage, solely to reduce duplicate counts. The server converts the visitor identifier, and when needed your IP address and browser user-agent, into a one-way identifier that changes daily. The raw values are not stored in the analytics table. No advertising profile, cross-site identifier or session replay is created.

• Vercel hosts the site and keeps standard security and service logs.
• Supabase stores auction records, logos and anonymous totals.
• Stripe processes payments and stores card details.
• These providers may process data in the United States and other countries where they operate.

Under the New Zealand Privacy Act 2020 you may ask what personal information is held about you, ask for it to be corrected, and complain to the Office of the Privacy Commissioner if you are not satisfied with the response. Requests are answered within 20 working days. If you are in the EU or UK, the lawful basis for handling bid details is performing the contract you entered by bidding, and for traffic counts it is a legitimate interest in knowing how many people visited.

A paid bid is published: brand name, the panel, the amount, the destination link and the artwork appear on this site and stay on the leaderboard permanently, including after an outbid refund, which is the placement you are paying for. Your email address, payment details and any traffic data are never published. Do not submit a brand name or artwork you are not willing to have shown publicly and photographed on a car.

Auction and payment records are kept as long as reasonably needed to run the campaign, resolve disputes and meet legal accounting duties. Rejected artwork is removed within 30 days where possible. Message @downtobuild on X to request access to or correction of your personal information, or to ask about deletion where the law allows it.