Privacy Policy
This policy explains what data TopGoblin processes when you browse the leaderboard, submit a website, or purchase Loot.
Last updated: 23 August 20261. Data we process
- Submitted website data: normalized URL, hostname, public title, public description, category, and same-domain favicon.
- Leaderboard activity: confirmed contribution amount, Stripe Checkout Session identifier, ranking timestamps, daily score, and outbound click count.
- Payment and billing data: Stripe processes payment details and may collect billing or contact information. TopGoblin does not receive or store full card numbers.
- Technical data: hosting and security systems may process IP address, user agent, request time, referring page, and error or fraud-prevention signals.
- Consent choices: your analytics and advertising preferences are stored locally in your browser.
2. Why we use the data
| Purpose | Legal basis |
|---|---|
| Provide checkout, credit Loot, and display rankings | Performance of the requested service or contract |
| Prevent fraud, secure the service, and enforce rules | Legitimate interests and legal obligations |
| Keep transaction and accounting records | Compliance with tax, accounting, and legal obligations |
| Optional analytics or advertising measurement | Your consent, which you can withdraw at any time |
3. Public data and visibility
Listing information, category, rank, Loot total, and daily Crown status are public by design. TopGoblin extracts metadata from the submitted public website and displays it on the leaderboard. Do not submit confidential information or a destination you are not authorized to promote.
4. Service providers and transfers
We use Stripe for checkout and payment processing, Neon for the application database, and Vercel for hosting and optional web analytics. These providers process data under their own contractual and security terms. Where data is transferred outside the EEA, the relevant provider is expected to use an applicable legal transfer mechanism, such as an adequacy decision or standard contractual clauses.
5. Retention
Public listing and lifetime Loot records remain while the listing is active or while needed to preserve the integrity of the historical ranking. Payment and accounting records are retained for applicable statutory periods. Security logs are retained only for the period reasonably needed to investigate abuse, operational incidents, or legal claims. Consent choices remain in your browser until you clear them or change your settings.
6. Your rights
Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. We may need to verify your identity before responding. You may also complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.
Send privacy requests to donidhernandez@gmail.com. Valid requests are normally answered within one month where the GDPR applies.
7. Cookies and similar technologies
See the Cookie Policy for the current categories, Google Consent Mode settings, and how to change your choice.