Privacy Policy

Who controls your data

SASU OPTINOC is the data controller for Leaderboard.

• Registered office: 10 allée Louis Breguet, 94310 Orly, France
• SIREN: 850 573 932
• VAT number: FR38 850573932
• Privacy and DPO contact: info@optinoc.com

Overview

This Policy explains how Leaderboard handles information when you browse the board, publish a product, open a destination, reserve a Boost, or use Stripe Checkout.

Leaderboard is designed without mandatory user accounts. This reduces the personal information required to publish and promote a product, but the service still processes limited technical, listing, and payment-related data.

Information we collect

Information you provide

• A product URL, confirmed description, category, and optional X profile.
• Product and order identifiers associated with a Boost.
• Information provided directly to Stripe during Checkout. Leaderboard does not receive or store full card numbers.

Information collected automatically

• Public website metadata such as product name, description, canonical URL, logo, favicon, and platform.
• A random browser-session identifier that is hashed before being stored for the aggregate site-visit count.
• For outbound product clicks: an hourly hash derived from the requesting IP address, the referring page, a shortened user-agent value, the product, and any relevant placement.
• Operational timestamps, hold status, queue position, payment status, and webhook identifiers.

How we use information

We use this information to publish and categorise products, prevent duplicates, count discovery activity, operate holds and queues, process Boosts, confirm payments, prevent abuse, troubleshoot failures, secure the service, and comply with legal obligations.

Where applicable, processing is based on providing the service you request, legitimate interests in operating and securing Leaderboard, compliance with law, or consent when a particular optional technology requires it.

Browser storage and analytics

Leaderboard uses session storage to keep a random visit-session identifier for the current browser session and measure aggregate visits. While the site is visible, the server also converts the client IP address supplied by Railway into a keyed cryptographic pseudonym used only to count active visitors. The raw IP address is not stored by Leaderboard, and inactive presence records are deleted after ten minutes. Local storage remembers the latest product and whether you permanently dismissed the “Welcome back” suggestion.

Leaderboard does not currently implement its own advertising cookies. Stripe may use necessary technologies on its hosted Checkout. VulpaSoft analytics is loaded only when a valid project identifier is configured; if enabled, its processing will be reflected in this Policy and any consent controls required by applicable law.

Service providers and sharing

Information is shared only as needed to operate the service:

• Supabase provides the PostgreSQL database used for products, visits, holds, orders, and placements.
• Railway currently hosts the Leaderboard application.
• Stripe will process Checkout and payment information when paid Boosts are activated.
• VulpaSoft may provide product analytics only when its integration is enabled.
• Public product websites receive requests when metadata or image assets are retrieved, and receive a visitor when someone opens their listing.

We do not sell personal information or product-submission data. Providers may process information in other countries under their own safeguards and applicable transfer mechanisms.

Public listing information

Product names, descriptions, logos, categories, platform badges, destination URLs, X profile links, ranking positions, and aggregate click counts are public by design.

Do not submit private information in a product description or URL. Removing a listing from Leaderboard does not remove information already published by the destination website or cached independently by search engines and third parties.

Retention

Product listings remain published until they are removed or moderated. Active visitor-presence records expire after ten minutes. Pseudonymous site-visit and product-click records are retained for 13 months. Rate-limit buckets expire after two days.

Abandoned unpaid orders and their expired holds are removed after 90 days. Successfully processed payment, invoice and webhook records may be retained for up to ten years where needed for accounting, fraud prevention, disputes or legal obligations. Backups follow the provider’s secured backup lifecycle and are not used for analytics.

Security

Leaderboard uses bounded remote requests, private-network blocking, signed Stripe webhooks, database transactions, idempotency controls, access restrictions, and pseudonymous visit identifiers. No internet service can guarantee absolute security.

An IP-derived hash remains pseudonymous technical data rather than guaranteed anonymous data, and is treated accordingly.

Your choices and rights

Under the GDPR, you may request access, correction, deletion, restriction, portability, or object to certain processing. We may need enough information to verify that you are authorised to act for the product or person concerned.

Send a request to info@optinoc.com. You also have the right to lodge a complaint with the CNIL, the French data-protection authority. You can clear Leaderboard’s local and session storage through your browser settings.

Policy changes

We may update this Policy when the service, providers, or legal requirements change. The latest version will remain available at this URL with its updated date.

Material changes affecting how personal information is used will be communicated through an appropriate in-product notice where required.