Privacy notice
GDPR information · last updated 19 September 2026
Who is responsible
The data controller is Sparks SAS, operating BIDMAP from France. Privacy contact: michael@sitebatch.com.
What we collect, why, and on what legal basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Purchase record: amount, country, season, payment reference | Delivering the points you bought, refunds, accounting | Contract; legal obligation (accounting) | 10 years (French accounting law) |
| Supporter name and rally message (if you provide them) | Showing your contribution publicly and moderating content | Contract; legitimate interest in moderation | Season archive, indefinitely unless you ask for removal |
| One-way hash of the email used at checkout | Counting each supporter once per country per season and preventing abuse | Legitimate interest in fair play | Life of the season archive |
| One-way hash of your IP address | Rate limiting and fraud prevention only | Legitimate interest in security | Up to 12 months |
| Account data: email, display name, preferences, collectibles | Running your account and your history | Contract | Until you delete your account |
| Sponsor contact email and business details | Approving, invoicing and supporting sponsor placements | Contract | 10 years (accounting) |
We never store your card number, and we do not profile you or sell your data. We do not use advertising or analytics cookies — see the cookie page.
Who processes data for us
Stripe (payments, tax and receipts), Supabase (database and authentication), Lovable/Cloudflare (hosting and delivery), Mapbox (map tiles), Google Fonts (typeface delivery). Each acts under a data-processing agreement or its own controller terms. Where a provider processes data outside the EU, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
What is public and what never is
Public pages show only display names (or “Anonymous supporter” if you choose), points, ranks, seasons and statistics. Emails, hashes, payment identifiers, IP data, contact details and internal fraud information are never shown publicly and are not shared with sponsors. Sponsor and business reports contain aggregated figures only, with minimum aggregation thresholds.
You can hide your public name at any time while keeping your contribution and your collectibles.
Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time. Write to michael@sitebatch.com and we respond within one month.
Note that we must keep purchase and accounting records even after an erasure request; in that case we remove or anonymise the public parts and retain the financial record only.
You may also lodge a complaint with the CNIL — Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, 75007 Paris, or with the supervisory authority where you live.
Children
The service is for adults aged 18 and over. We do not knowingly collect data from children.
Security
Data is protected with row-level database permissions, server-side validation of every payment outcome, hashed identifiers, and strict separation between public and private fields. Payment card data never reaches our systems.