Privacy Policy

1. Scope and privacy roles

This Privacy Policy applies to the wintop website, leaderboard, checkout initiation, traffic statistics, redirects, support, and related services (collectively, the “Service”). “wintop,” “we,” “us,” and “our” refer to the operator of the Service.

For information wintop collects directly to operate the Service, wintop acts as the responsible controller or business under applicable privacy law. Waffo acts as merchant of record and an independent controller for payment, billing, tax, fraud, compliance, refund, and chargeback information it collects during checkout. Third-party destinations control their own information practices.

2. Information we collect

Information you submit

• Product and listing information: a product URL or X handle, canonical destination, display name, title, description, and optional icon URL.
• Bid and checkout selections: target bid, weekly cycle, predicted position, checkout intent, and confirmation status.
• Support communications: your email address and the contents and attachments of messages you send us.

Information collected automatically

• Anonymous visitor identifier: a randomly generated UUID stored in the wintop_visitor HttpOnly cookie. We hash this value with a private salt before using it for presence and click deduplication.
• Usage and traffic data: heartbeat and click timestamps, the weekly entry followed, deduplication keys, aggregate online and last-hour counts, and outbound click totals.
• Technical and security data: Cloudflare may process IP address, request and routing data, browser or device information, security signals, and server logs when delivering and protecting the Service.

Information from other sources

• Public product pages: when you submit a URL, wintop makes a bounded server-side request to that public page and its icon to suggest editable listing metadata.
• Waffo: signed payment events provide order, payment, session and product identifiers; currency; contribution, tax and total amounts; timestamps; status; and refund information. wintop does not receive or store your complete card number or card security code.

3. How and why we use information

We use information to provide the leaderboard and checkout you request; publish and rank paid listings; verify, fulfill and refund transactions; count audience and clicks without repeatedly counting the same visitor; maintain weekly archives; prevent fraud, abuse and duplicate fulfillment; secure, debug and improve the Service; answer support requests; enforce our agreements; and comply with law.

Where applicable law requires a legal basis, we rely on performance of a contract for requested paid services, legitimate interests in operating and securing a reliable public leaderboard, compliance with legal obligations for transaction and dispute records, and consent where the law requires it. You may object to processing based on legitimate interests, but we may continue where overriding lawful grounds apply.

Ranking is determined by objective bid, time and identifier rules. wintop does not make decisions producing legal or similarly significant effects based solely on automated processing.

4. Cookies and traffic measurement

wintop uses one first-party cookie named wintop_visitor. It contains a random identifier, is HttpOnly, uses SameSite=Lax, is marked Secure over HTTPS, and expires after one year. It supports audience measurement and prevents repeated outbound clicks from inflating public totals. The cookie does not contain your name, email address, payment information, or product submission.

You can delete or block the cookie in your browser. Doing so may cause the Service to assign a new identifier and may reduce the accuracy of deduplication. The Service does not use third-party advertising cookies. Because we do not sell personal information or use it for cross-context behavioral advertising, we do not currently provide a sale or targeted-advertising opt-out. We will honor legally recognized preference signals where applicable to any future processing that requires an opt-out.

5. How we disclose information

We disclose only what is reasonably necessary for the following purposes:

• Cloudflare: hosting, content delivery, databases, object storage, queues, security, network operations, and request logs.
• Waffo and its payment partners: checkout, payment processing, merchant-of-record services, taxes, receipts, fraud prevention, refunds, disputes, and legal compliance.
• Public viewers: submitted and derived listing information, weekly bid totals, rank, listing dates, click totals, and archived results.
• Professional advisers and authorities: when reasonably necessary to protect rights and safety, investigate abuse, establish or defend legal claims, or comply with a valid legal obligation.
• Business transfers: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required.

We do not sell personal information for money and do not share it for cross-context behavioral advertising. We have not done so during the preceding twelve months.

6. Public content and third-party links

The product URL, display name, title, description, icon, weekly amount, rank, date, click total, and archive entry are public by design and may be indexed, copied, or retained by others. Do not submit confidential information or personal information you are not authorized to publish.

Outbound links include campaign parameters identifying wintop and the relevant weekly cycle. We do not add your visitor identifier to the destination URL. Your browser may send ordinary referral and technical data to the destination, which is governed by that destination's privacy policy.

7. Data retention

• The visitor cookie remains on your device for up to one year unless you delete it.
• Presence records in the live counter are removed after approximately one hour. Per-entry click deduplication records are removed after approximately thirty minutes.
• Aggregate traffic points, deduplicated click events, listings, weekly archives, checkout intents, payment events, refund records, fraud-prevention records, and necessary logs may be retained for as long as needed to operate the Service, preserve accurate public and financial records, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, or security obligations.
• Support messages are retained for as long as needed to respond and maintain appropriate business records.

When information is no longer required, we will delete, anonymize, or isolate it as appropriate. Backup and provider copies may remain for a limited period under applicable retention cycles.

8. Security and international transfers

We use reasonable administrative and technical safeguards, including HTTPS, HttpOnly cookies, salted hashing, bounded server-side fetching, private-network blocking, signed payment webhooks, idempotent fulfillment, access controls, and managed infrastructure. No online service can guarantee absolute security.

wintop and its providers may process information in countries other than your own. Where required, we rely on legally recognized transfer mechanisms and provider safeguards. By using third-party checkout or visiting a linked service, your information may also be transferred under that provider's policy.

9. Your privacy rights

Depending on where you live, you may have rights to know or access information, correct inaccurate information, delete information, restrict or object to processing, receive portable information, withdraw consent, and appeal or complain to a privacy regulator. California residents may also have rights to know categories and specific pieces of information, correct, delete, opt out of sale or sharing, limit certain uses of sensitive information, and receive equal service when exercising a right.

To submit a request, email bonatokenl@gmail.com with “Privacy Request” in the subject and describe the request and the listing, transaction, cookie identifier, or email address involved. Because wintop has no accounts, we may request information reasonably necessary to verify that you are authorized to act on the data. We may retain information or deny a request where an exception applies, including transaction records, security evidence, legal claims, or public-interest records.

You may lodge a complaint with the data-protection or consumer-privacy authority where you live. Contacting us first gives us an opportunity to address the issue.

10. Children

The Service is a general-audience business and product-promotion service, is not directed to children under 13, and is not intended for anyone who cannot lawfully enter the applicable agreements. Paid bids may be placed only by adults who have reached the age of legal majority where they live. We do not knowingly collect personal information from children under 13. A parent or guardian who believes a child submitted personal information should contact us so we can investigate and take appropriate action.

11. Changes and contact

We may update this policy to reflect changes in the Service, providers, or law. We will post the revised policy with a new effective date and provide additional notice when required. Material changes will not retroactively reduce your rights without a valid legal basis.