- No analytics, no ad trackers, no marketing emails.
- Servers are in Vienna, Austria (EU).
- Payments go through Stripe or PayPal; we never see your card.
- Server logs with IP addresses are deleted after 14 days.
- You can get a copy of your data, or have it corrected or deleted: email [email protected].
The short version helps you read the document; it doesn't replace it.
01Who is responsible
The controller of your personal data is the private individual who runs raids.bid, based in Romania. Contact for anything privacy-related: [email protected].
For the data inside a clan portal (member names, points, messages), the clan's owner decides what their clan records; we process it on their behalf to run the portal.
02What we collect
We only collect what running raids.bid needs. We don't use analytics, advertising trackers or marketing emails.
| Who | What | Where it comes from |
|---|---|---|
| Anyone visiting | IP address, browser type, requested page and time, in server logs. Security checks by Cloudflare. | Your browser, automatically |
| Clan owners | Email address, a hashed password, clan name, portal address, chosen chronicle and server name, plan and billing history (amounts, dates, PayPal or Stripe reference IDs). | You, at signup and when you pay |
| Clan admins and members | Character name, a hashed password, role, points, bids, attendance, RSVPs, gear, wishlists, messages, images you upload, and push-notification details if you switch notifications on. | You and your clan's admins |
| Donors | Display name (optional), amount, currency, date and the PayPal or Stripe reference. Card and bank details stay with Stripe or PayPal. | You, when you donate |
| Support | The message you send us, and your email so we can answer. | You |
03Why we use it, and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running your clan portal and your account; taking payments | Contract (Art. 6(1)(b)) |
| Keeping the service secure, preventing abuse, fixing problems (server logs, Cloudflare) | Legitimate interests in a safe, working service (Art. 6(1)(f)) |
| Keeping payment records | Legal obligation under tax and accounting law (Art. 6(1)(c)) |
| Showing your name on a supporters board; push notifications | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Answering support requests | Contract or legitimate interests, depending on the request |
05International transfers
Our servers are in the EU. Some providers above may process data outside the EU or EEA, for example in the USA. Where that happens, it relies on an adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or on the European Commission's standard contractual clauses.
06How long we keep it
| Data | Kept for |
|---|---|
| Server access logs (IP addresses) | 14 days, then deleted automatically |
| Clan portal data | While the clan uses raids.bid. If a portal stays locked for more than 90 days, or the owner asks us to delete it, it's deleted, and backup copies expire within 7 days after that |
| Owner account | Until the clan is deleted or the owner asks us to delete the account |
| Payment and donation records | As long as tax and accounting law requires |
| Support messages | Until the matter is closed or you ask us to remove them, and at most 2 years |
07Cookies and browser storage
raids.bid doesn't set advertising or analytics cookies. It stores a few things in your browser because the site needs them or because you chose a setting:
| Name | What it does | How long |
|---|---|---|
ne_token, ne_refresh_token | Keep you signed in to a clan portal | Until you sign out |
ne_theme | Your light or dark choice in a clan portal | Until you clear it |
rb-boss, rb-site | The color palette and site theme on raids.bid | Until you clear it |
rb-ach | Achievements you unlocked while browsing | This browser tab session |
mk, gm-boss, gm-site | Admin console sign-in (session only) and its display settings | Session / until you clear it |
Cloudflare cookies (such as __cf_bm) | Tell real visitors from bots | Up to 30 minutes |
Because these are all needed for the site to work or remember your own choices, there's no cookie banner. You can clear them in your browser at any time.
08Security
Passwords are stored only as salted hashes. Connections use HTTPS. Admin access is limited to the platform operator. Each clan's data sits in its own database, and backups rotate daily and expire after 7 days.
No system is perfectly secure. If a breach affects your personal data and puts you at risk, we'll tell you and the authorities as the law requires.
09Your rights
You can ask us to:
- give you a copy of your personal data (access and portability);
- correct it, or delete it;
- limit how we use it, or object to uses based on legitimate interests;
- withdraw a consent you gave, such as your name on a supporters board or push notifications.
Email [email protected]. We answer within one month. For data inside a clan portal, we may pass your request to that clan's owner, who controls those records.
You can also complain to a data protection authority, for example the one where you live or the Austrian Datenschutzbehörde (dsb.gv.at), where our servers are.
10Children
raids.bid isn't meant for anyone under 16. If you believe a child under 16 has given us personal data, tell us and we'll delete it.
11Changes to this policy
When we change how we handle personal data, we update this page and its date. For important changes we'll also tell clan owners by email or in the owner portal.
Questions about this document: [email protected]. Last updated 13 October 2026.