Data kept purposeful
Privacy statement
Last updated 31 August 2026.
This statement explains what BrandBid handles, why it is used, and the choices available to you.
What we handle
- Listings: website address, category, display name, description, favicon, and metadata obtained from the submitted website. Published listings, totals, ranks, and visit counts are public.
- Payments: checkout and payment identifiers, amount, currency, status, refunds, and disputes. BrandBid stores a keyed hash of the billing email supplied through Stripe, not the email itself. Stripe handles card details.
- Security and visits: keyed hashes derived from IP address and browser information for rate limiting, abuse prevention, checkout controls, nominations, and daily outbound-visit records.
- Optional analytics: pages viewed, time, referrer or campaign, browser and device details, approximate location, session data, and first-party visitor identifiers collected by DataFast after consent.
- Operations: support communications, system logs, moderation records, and administrator audit events.
How we use it
We use this information to operate listings and payments, maintain the financial ledger, publish rankings and aggregate traffic figures, provide support, moderate content, prevent abuse, improve reliability, resolve disputes, and meet legal obligations.
Analytics and cookies
BrandBid stores your analytics choice in browser local storage. If you accept analytics, DataFast uses first-party cookies and session storage to recognise visits and measure site use. You can reject or change this choice through Cookie settings in the footer. Core BrandBid features work without analytics.
A public listing visit is counted each time its BrandBid outbound link is followed. It counts redirects, not unique people. Site-wide “online” and “visitors” figures come from DataFast and may be approximate, delayed, or affected by privacy tools.
Providers and overseas processing
Cloudflare provides hosting, security, and database services; Stripe processes payments; and DataFast provides optional analytics. They may process information outside New Zealand. BrandBid may also disclose information when required by law or reasonably necessary to protect the service, its users, or others.
Retention and security
Information is kept only as long as reasonably needed for the purposes above. Short-lived rate-limit events are cleaned up after 24 hours. Financial, checkout, fraud-prevention, moderation, audit, and daily pseudonymous visit records may be retained longer for accounting, disputes, service integrity, and legal obligations. DataFast retention follows BrandBid’s account settings. We use reasonable technical and organisational safeguards, but no system is completely secure.
Your rights
You may request access to or correction of personal information associated with you, or raise a privacy concern, by emailing privacy@brandbid.nz. Identity may need to be verified.
Privacy incidents
BrandBid assesses privacy incidents under the New Zealand Privacy Act 2020 and notifies affected people and the Privacy Commissioner when required.
Changes
Material changes will be dated and published on this page before or when they take effect.