Privacy Policy
The short version. We collect only what we need to put your logo on the moon and get paid. Your placement (logo, name, description, link, amount paid) is public. Card details go to our payment partner, never to us. We don't sell your data and we don't use advertising trackers.
- Who's responsible
- What we collect
- What's public
- How we use it
- Who we share it with
- Cookies and analytics
- How long we keep it
- Your rights
- International transfers
- Security
- Children
- Changes
- Contact
1. Who's responsible
buythemoon.lol is operated by Krish S Garlapati, who is responsible for your personal data (the "controller", or equivalent term, under the data protection laws that apply to you).
2. What we collect
When you buy a placement
- Placement details: the link you give us, the logo or image you upload or that we fetch from that link, and the name and description we read from your site (or that you provide).
- Your email address, which you type at checkout, for your receipt and to contact you about your placement.
- Purchase details: your bid, the amount and currency actually charged, rank, time of purchase, and payment and checkout references from Dodo Payments.
- From our payment partner (Dodo Payments): payment status and the amount charged. Card details and billing identity are collected by Dodo Payments, not by us; we do not receive your full card number or bank details.
- Your IP address, stored with each checkout attempt to limit abuse (for example, too many checkouts from one network).
When you ask to be notified
- Before bidding opens, you can leave your email to hear when it does. We store that address and your IP address (to limit abuse), and use the address only for that notice.
When you visit
- Technical data: IP address, browser and device type, pages requested and referring site, processed by our host in server logs to run and secure the Site.
- Things you send us: emails, reports of a placement, or support requests.
When you paste a website link at checkout, our server fetches that site's public pages to find its logo, name and description. That site may see a request coming from buythemoon.lol. If the site has no usable logo, we may ask Google's public favicon service for its icon, which sends Google the site's domain name (nothing about you).
We don't collect sensitive information and we ask that you don't include any in your placement.
3. What's public
The point of the Site is to show your placement, so these are visible to anyone and may be captured in screenshots, archives or search engines: your logo, name, description, link, rank, share of the moon, and amount paid. If you use a personal profile link or photo, it will be public too. Your email address and billing details are never shown.
4. How we use it, and why
- To provide your placement: display it, rank and size it, and keep it online (performance of our contract with you).
- To take payment and keep records: including tax and accounting records (contract and legal obligation).
- To review content and prevent abuse, fraud and spam (our legitimate interests and legal obligations).
- To contact you about your placement: receipts, review results, changes to the Site or these policies (contract and legitimate interests). We'll only send marketing emails if you opt in, and you can unsubscribe at any time.
- To tell you when bidding opens, if you asked us to (consent; you can withdraw it at any time by emailing us).
- To understand and improve the Site using aggregate information (legitimate interests).
5. Who we share it with
We don't sell or rent personal data. We share it only with service providers who help us run the Site, under contracts that protect it:
- Dodo Payments: payment processing and tax, as merchant of record;
- Hosting, database and content-delivery providers: Cloudflare (hosting, database and content delivery);
- Receipts: payment receipts are sent by Dodo Payments;
- Google: only the domain name of a site whose icon we look up, as described in section 2.
We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a sale or restructuring of the Site, in which case this policy will continue to apply.
6. Cookies and analytics
The Site doesn't set any cookies of its own. Dodo Payments may use cookies on its checkout pages under its own policy. We don't use advertising or cross-site tracking cookies. We use Cloudflare Web Analytics to count visits in aggregate (pages viewed, referring site, country, device type). It sets no cookies and doesn't build profiles of individuals.
7. How long we keep it
- Placement details: for as long as your placement is on the Site, plus a reasonable period in archives.
- Purchase records: as long as tax and accounting law requires (commonly 5 to 10 years).
- Unfinished checkouts (and the IP address stored with them): up to 90 days, then deleted.
- "Notify me" emails: until we've sent the notice, or sooner if you ask us to delete yours.
- Server logs: up to 90 days, unless needed to investigate abuse.
- Support emails: up to 2 years.
8. Your rights
Depending on where you live (for example under the EU and UK GDPR, US state privacy laws such as California's, Brazil's LGPD, India's DPDP Act, and similar laws elsewhere), you may have the right to access, correct, update or delete your personal data, to withdraw consent, to object to or restrict certain processing, to data portability, and to nominate someone to exercise your rights. To use these rights, contact us at the address below. We'll respond within the time the law requires.
Note that deleting your personal data doesn't automatically remove a paid placement. To remove your placement, ask us; refunds follow our Refund and Cancellation Policy. You can also complain to the data protection authority where you live.
9. International transfers
We and our providers may process data in several countries, including the United States and the EU, and the country where we are based. Where required, we use appropriate safeguards such as standard contractual clauses.
10. Security
We use encryption in transit, access controls and reputable providers to protect your data. No system is perfectly secure; if a breach affects you, we'll notify you and the authorities as the law requires.
11. Children
The Site isn't directed at children, and you must be 18 or older to buy. We don't knowingly collect data from children; if you think a child has given us data, contact us and we'll delete it.
12. Changes
We may update this policy. We'll post the new version here with a new date, and tell you about significant changes on the Site or by email.
13. Contact
Privacy questions, requests and complaints: krishna.sumanth.garlapati@gmail.com. All privacy requests are handled by the operator through that address; we'll provide a postal address on request where the law requires it. If the law where you live requires us to appoint a local representative, we'll list them here.