1. Controller
The controller is Andrés Miguel Quintero González, tax ID 15479556G, at Valencia, 46025, España. Privacy contact: andresquinterospain@gmail.com.
2. Data we process
We may process your handle, selected artist, bid amount and status, technical Stripe session identifiers, operation timestamps, support communications and basic technical data needed for security and operation. To limit automated or abusive attempts and produce aggregate usage statistics, we generate pseudonymous identifiers from technical connection data; the IP address is not stored in plain text in those records. We also record page-view, checkout-started and payment-confirmed events. FanRank does not receive or store your full card number.
Your handle, artist, amount and position are public. The handle is displayed as a link to the corresponding public X profile. FanRank does not verify that the person submitting a handle owns that account. Do not submit a real name or information you do not want displayed.
3. Purposes and legal bases
We process data to take payment, deliver and maintain the requested service, publish and order the ranking, handle refunds and support, measure aggregate usage and conversion, prevent fraud, protect the platform and comply with accounting, tax and legal duties.
- Performance of the contract requested by you.
- Compliance with legal obligations.
- Legitimate interests in security, fraud prevention, legal defence and operational improvement.
- Consent where specifically required.
4. Recipients
Stripe processes payments. OpenAI/Sites and Cloudflare provide publishing, security and hosting infrastructure. These providers process data under their applicable terms and policies. Data may be disclosed to authorities where legally required.
5. International transfers
Some providers may process data outside the EEA. Where required, recognised GDPR safeguards are used, such as adequacy decisions or standard contractual clauses.
6. Retention
Transaction and invoicing records are retained for legally required periods. Public ranking records remain while needed to operate the service and preserve its integrity, unless deletion is appropriate. Support information remains for as long as needed to resolve the request and address potential liability. Identifiers used to limit abuse have a short technical expiry. Pseudonymous analytics events are periodically deleted once they are older than 90 days.
7. Your rights
You may request access, rectification, erasure, objection, restriction or portability by emailing andresquinterospain@gmail.com. You may also complain to the Spanish Data Protection Agency at aepd.es. Erasure may be restricted where retention is legally required or necessary for legal claims.
8. Minors and security
Paid bids are intended for people aged 18 or over or otherwise legally capable of contracting. We use reasonable safeguards, although no Internet-connected system can guarantee absolute security.