Privacy Policy
A plain-English account of what Leaderboard and its Marketplace collect, why, and where it goes.
01Who controls your data
SASU OPTINOC is the data controller for Leaderboard and its Marketplace.
- Registered office: 10 allée Louis Breguet, 94310 Orly, France
- SIREN: 850 573 932
- VAT number: FR38 850573932
- Privacy and DPO contact: hello@theleaderboard.co
This Policy goes with our Terms of Service.
02Information we collect
Information you give us
- Account: your email address and an optional display name. The email is stored encrypted, and a one-way hash of it is used to recognise your account.
- Listings: product URL, name, description, category, logo, optional X profile, asking price, and whether the listing is anonymous.
- Messages: messages, offers and names you send to other users or through a listing’s contact form (with the email you enter there).
- Saves: the listings you save.
- Sponsoring and Boosts: campaign content and order identifiers. Card details go straight to Stripe; we never receive or store full card numbers.
Information from connected services
- Revenue verification: when you connect Stripe, Dodo Payments, Paddle, Lemon Squeezy or Polar with read-only access, we read your subscription payments for about the last 12 months and store only monthly recurring revenue totals and their currency. We do not store customer names, emails or card data from those providers.
- Access credentials: the access token or API key you provide is stored encrypted and used only to read revenue.
- Domain verification: the DNS TXT record we ask you to add, checked against your domain.
Information collected automatically
- A random session identifier, hashed before storage, to count aggregate visits and the page where the visit started.
- A keyed pseudonym of your IP address to count people currently on the site.
- For outbound clicks to a listing: an hourly hash derived from your IP address, the referring page, a shortened user-agent, the product and any placement. Sponsor cards also have impression and click counters.
- Technical and security data such as timestamps, payment and webhook status, and rate-limit counters.
03How we use information
We use information to run your account and sign you in, publish and rank listings, verify revenue and domains, deliver messages and the notification emails described below, process Boosts and Sponsoring, count visits, impressions and clicks, prevent fraud and abuse, fix problems, secure the service and meet legal obligations.
Our legal bases are providing the service you ask for, our legitimate interests in operating and securing the service, compliance with the law, and consent where a specific optional technology needs it.
04Emails we send
We send transactional emails only: your sign-in link, a notice when you receive a message, and an alert when a listing you saved lowers its price. We do not send marketing emails.
05What is public
Leaderboard listings (name, description, logo, category, link, ranking and click count) and public Marketplace listings (including verified monthly revenue, asking price and domain) are visible to everyone. An anonymous listing hides your identity until you reveal it in a conversation. Your email address is never shown publicly.
Do not put private information in descriptions or URLs. Taking a listing down does not remove copies kept by search engines or third parties.
08International transfers
Our providers may process data outside your country, including outside the European Economic Area. Where that happens, we rely on the safeguards the provider offers, such as Standard Contractual Clauses or an adequacy decision.
09Retention
Account and listing data are kept while your account is active and until you ask us to delete them. Pseudonymous site-visit and product-click records are kept for 13 months. Active-visitor presence records expire after ten minutes and rate-limit counters after two days. Sign-in codes expire after 10 minutes.
Abandoned unpaid orders and expired holds are removed after 90 days. Payment, invoice and webhook records may be kept for up to ten years for accounting, fraud prevention, disputes and legal obligations. Backups follow the provider’s secured lifecycle and are not used for analytics.
10Security
We encrypt emails and revenue-provider credentials, hash sign-in link tokens, limit sign-in attempts, verify Stripe notifications by signature, restrict network access for outbound requests, and use database transactions and access controls. No internet service can guarantee absolute security. An IP-derived hash is pseudonymous, not anonymous, and is treated accordingly.
11Your rights
Under the GDPR you may ask for access to your data, correction, deletion, restriction, portability, or object to certain processing, and withdraw consent where we rely on it. You can disconnect a revenue provider from your account at any time. We may need to verify your identity first.
To exercise a right or to delete your account, write to hello@theleaderboard.co. You may also complain to the CNIL, the French data-protection authority, or to the authority where you live.
12Children
The service is for business users and is not directed to anyone under 18. Accounts and purchases require you to be at least 18. If we learn that a minor created an account, we delete the account and its data. If you believe this has happened, contact us.
13Changes to this Policy
We may update this Policy when the service, our providers or the law change. The latest version stays at this address with its updated date, and we will give a clearer notice for material changes where required.
14Contact
Privacy questions and requests: hello@theleaderboard.co.