Privacy Policy

01 What we collect

When you use the Service, we collect:

• Email address — provided at checkout and used for receipts, ad management, and sign-in to the owner dashboard.
• Payment information — card number, expiration, CVC. This is handled exclusively by Stripe, Inc. and is never transmitted to or stored by our servers.
• Your uploaded image — the file you upload to display as your ad.
• Destination URL — the web address you want your ad to link to.
• Ad placement data — the cells you selected, their coordinates, and visual adjustments (zoom, offset, rotation).
• Technical logs — IP address, browser user agent, and timestamps of your interactions, kept for security and fraud prevention.

02 How we use it

We use the information collected to:

• display your ad on the globe;
• process your payment via Stripe;
• send you transactional emails (purchase receipts, sign-in links, ad change confirmations);
• moderate content for compliance with our Terms of Service;
• respond to support requests and legal process;
• detect and prevent fraud or abuse.

We do not send marketing emails without your explicit opt-in. We do not sell, rent, or trade your personal information to third parties.

03 Who processes your data

We rely on the following service providers ("sub-processors") to operate the Service. Each is bound by its own privacy practices, which we recommend you review:

• Stripe, Inc. — payment processing. stripe.com/privacy
• Google Firebase (Google LLC) — database, image storage, authentication. firebase.google.com/support/privacy
• Vercel, Inc. — web hosting. vercel.com/legal/privacy-policy
• OpenAI, L.L.C. — automated content moderation of uploaded images. openai.com/privacy

04 Cookies and local storage

The Service uses only functional cookies and browser local storage, specifically:

• Firebase Authentication session tokens (to keep you signed in on the owner dashboard);
• Stripe's fraud-prevention signals (set by Stripe's embedded card widget);
• A temporary key in localStorage during magic-link sign-in to remember your email across browser sessions.

We do not use Google Analytics, Meta Pixel, or any advertising / behavioral tracking cookies. We do not build user profiles or track you across other sites.

05 How long we keep your data

We retain data for the following periods:

• Active ad data (image, link, placement) — for the duration of the five-year Guaranteed Period and until you request removal or we remove the ad.
• Transaction records — at least 7 years, as required for tax and accounting.
• Technical logs — 90 days, then automatically deleted.
• Removed or rejected ads — image files are deleted within 90 days of removal; the transaction record itself is retained per above.

06 Your rights

You have the right to:

• access a copy of the personal information we hold about you;
• correct inaccurate information;
• delete your information, subject to legal and tax retention requirements;
• object to or restrict certain processing;
• receive your data in a portable format.

To exercise any of these rights, email milliondollarworldad@gmail.com from the email address associated with your account. We respond within 30 days.

California residents (CCPA/CPRA): we do not "sell" or "share" your personal information as those terms are defined under California law.

EU/UK residents (GDPR): the legal basis for processing your data is (a) performance of a contract — to deliver the Service you purchased, and (b) legitimate interests — to operate, secure, and improve the Service. You may lodge a complaint with your local data protection authority.

07 Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, please contact us and we will delete it promptly.

08 Data security

We implement commercially reasonable safeguards to protect your information, including encryption in transit (TLS/HTTPS), authentication controls, and server-side validation. However, no system is perfectly secure. You use the Service at your own risk. If we become aware of a data breach affecting your information, we will notify you as required by law.

09 International users

The Service is operated from the United States. Your data will be processed in the United States and may be transferred to other countries where our service providers operate. By using the Service, you consent to such transfers.

10 Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email to active ad owners and by updating the "Effective" date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

11 Contact

Privacy questions, data requests, or complaints: milliondollarworldad@gmail.com.