Privacy Policy

Auction X (“we”) runs a marketplace for .si domain names at auctionx.si. This policy explains what personal data we handle, why, and the choices you have. Payments are handled by Stripe: your full card number goes straight to Stripe and never reaches us.

Who is responsible

The controller of your data is Auction X. Auction X is operated by ECLIBZ LTD, a company registered in England and Wales, 124 City Road, London EC1V 2NX, United Kingdom. For any privacy question or request, email support@auctionx.si.

What we collect

• Sign-in details from Google. When you choose “Continue with Google”, Google shares your name and email address with us. We do not receive your Google password or access to anything else in your Google account.
• Marketplace activity. Bids, watched lots, domains you claim and list, deals, disputes, and the payment records that go with them.
• Payments and payouts. If you add a card, Stripe stores it and shares only its brand, last four digits and expiry with us. If you sell, Stripe collects the identity and bank details it needs to pay you; we only see whether your payout account is ready and its country.
• Domain verification data. To confirm who controls a domain we look up public records at the .si registry (Register.si RDAP and WHOIS) and public DNS, one domain at a time, at the moment you verify or transfer.
• Newsletter. If you ask for the weekly email of new names, we keep your email address, when you signed up and confirmed, and a scrambled (one-way hashed) version of your network address used only to stop sign-up abuse. You don't need an account for this.
• Technical data. Our hosting provider keeps short-lived server logs (such as IP address and request time) to run and secure the service.
• Fraud signals. When you sign in, bid, buy or list, we store a scrambled (one-way hashed) version of your network address and a random device identifier kept in a cookie. We use them only to spot shill bidding, for example a seller bidding on their own domain from a second account, and delete them after 90 days.

Why we use it

• To create and secure your account and keep you signed in (performance of our contract with you).
• To run auctions and sales, verify ownership and transfers, and resolve disputes (performance of contract).
• To prevent fraud and abuse, for example rate limits and account suspension (our legitimate interest in a safe marketplace).
• To send the weekly email of new names, only after you confirm your address (your consent, which you can withdraw from any of those emails).
• To meet legal obligations, such as keeping payment and transaction records.

We do not sell your data and we do not use it for advertising.

Who processes it for us

• Supabase stores the marketplace database in the EU (Frankfurt) and handles the Google sign-in exchange.
• Vercel hosts the website and its server code.
• Google provides sign-in.
• Hostinger delivers our emails from support@auctionx.si.
• Stripe processes card payments and seller payouts. Card details and payout identity checks go directly to Stripe and never to us.

Where a provider transfers data outside the EU, it does so under the European Commission's standard contractual clauses or an adequacy decision.

Cookies

We use only cookies needed for the site to work: one that keeps you signed in, one for the admin desk, one that remembers a demo account you picked, a short-lived one used during Google sign-in, and a random device identifier used to prevent fraud. There are no analytics or advertising cookies, so we don't ask for consent to them.

How long we keep it

We keep your account while you use Auction X. If you ask us to delete it, we delete your account data within 30 days, except records we must keep by law (for example payment records). Newsletter addresses are kept until you unsubscribe; an address that is never confirmed is deleted after 30 days.

Your rights

You can ask to access, correct, delete or export your data, or object to or restrict how we use it. Email support@auctionx.si. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EU, to your local data protection authority.

Changes

If we change this policy we will update the date above, and for significant changes we will tell signed-in users before they take effect.