Privacy policy

This policy explains what personal data BidBash handles, why, and your choices. BidBash is run by BidBash. We follow India's Digital Personal Data Protection Act, 2023.

What we collect

• Organisers and helpers: name and email from Google sign-in, the organisation and auctions you create, and a record of the changes you make (the activity log).
• Players who register: the answers to the organiser's form, such as name, mobile, email, date of birth, playing role, photo and payment reference. The organiser decides which questions to ask.
• Team owners and auctioneers: the name and contact details the organiser enters, and your bids.
• Visitors: basic technical information needed to run and protect the site (such as IP address for rate limits), and error reports with personal details removed.

Why we use it

To run auctions: registration, the player roster, bidding, results and the viewer page; to sign people in; to send messages you expect (invites, reminders, results and receipts); to keep the service secure; and to meet legal duties. We do not sell personal data and we do not use it for advertising.

Who decides

For players, team owners and auctioneers, the organiser of the auction decides what is collected and why; we process it on their behalf. Contact the organiser first about your data in their auction; we will help them.

What is public

The viewer page and overlay show players' names, photos, playing roles and auction results. Mobile numbers, email addresses and dates of birth are never shown publicly: only the auction's organisers (and, for contact details, its auctioneers) can see them.

Where it is stored

On Google Firebase (database and sign-in) and Amazon Web Services (files, backups and email), with WhatsApp messages sent through Meta. These providers may store data outside India under their own safeguards. Access keys and PINs are stored encrypted or hashed.

How long

Players' mobile numbers, email addresses, dates of birth, ratings and registration forms are deleted automatically 30 days after the auction ends, together with the auction's backups. Names, photos, playing roles and results stay, so the results remain viewable. Organisers can download their auction's data, delete these details sooner, or delete the whole auction; deleted items go to a Trash first so mistakes can be undone, and deleting from the Trash removes everything. Players agree to this when they register.

Your rights

You can ask to see, correct or delete your personal data, or withdraw consent. Ask the organiser of the auction, or contact us through the contact section of our home page. We reply within 30 days.

Changes

We may update this policy; the date above shows the latest version.