Privacy

Slotmaxxing has no advertiser accounts or behavioural advertising. Optional DataFast audience analytics runs only after consent. Orders, notices and measurement operate under the disclosures below.

Data we process

• Public listing data: submitted destination, advertisement copy, stated advertiser, eligible payment total, placement dates and aggregate outbound clicks. Destination ownership is not verified.
• Order and payment-status data: purchasing business and advertiser identity, internal order ID, Stripe Session and PaymentIntent IDs, amount, currency, status, reversals, accepted terms version and timestamps. Slotmaxxing does not receive full card numbers.
• Optional legacy domain-management proof, if voluntarily supplied. It is not required to submit or fund an advertisement.
• Content reports: reporter email, notice, legal or rights basis, evidence, status and decision record. Operator audit identity is stored as a keyed pseudonym; audit notes are redacted for common email and phone patterns and must not repeat personal data.
• Short-lived security and aggregate measurement data. Slotmaxxing converts the Cloudflare-observed network address into a keyed pseudonymous value; it does not store the raw address in product tables. The public 24-hour visitor number is a directional estimate from a deterministic one-in-eight sample.
• Optional DataFast analytics after consent: first-party analytics identifiers and technical visit information such as pages, referrer, device/browser details and approximate network-derived location.

Analytics choice and browser storage

DataFast does not load until you select “Accept analytics”. If you decline, Slotmaxxing stores only that preference locally so it does not ask again; use “Analytics settings” to reopen the choice. When accepted, DataFast may set first-party analytics identifiers to measure visits and attribution. Slotmaxxing does not use those identifiers for behavioural advertising or sell visitor-level data. Cloudflare may independently set a strictly necessary security cookie such as __cf_bm at the hosting edge. A separate daily, domain-separated keyed pseudonym is used for Slotmaxxing’s own abuse-filtered counters; view and click deduplication rows are deleted after 48 hours. Immediately before redirecting to Stripe, local storage temporarily records the submitted target, amount and placement type so the success screen can explain and share the order; that record is deleted when the success screen opens. The success screen may keep the unguessable Session/status capability in tab-scoped session storage for up to 31 days so a reload can recover delayed payment status. You can stop future optional analytics through “Analytics settings” and clear browser-held identifiers at any time by deleting Slotmaxxing site data.

Purposes and legal bases

• Listing, optional management proof, order and payment data: steps requested before a B2B contract and performance of that contract (GDPR Article 6(1)(b)).
• Tax, accounting and mandatory records: compliance with legal obligations (Article 6(1)(c)).
• Security, fraud prevention, aggregate reliability and proportionate moderation: legitimate interests in operating a safe, trustworthy service (Article 6(1)(f)).
• Optional DataFast analytics: consent (Article 6(1)(a)); declining does not affect access, ranking or checkout.
• Report contact data: legal obligations and the legitimate interest in handling notices and defending rights.

Recipients and processors

Cloudflare infrastructure and ChatGPT Sites host the application and database. Stripe hosts Checkout and processes payment information under its own notices and applicable processor terms. DataFast processes optional audience analytics after consent. The operator maintains processor and international-transfer documentation appropriate to each provider role. Data may also be disclosed to professional advisers or authorities when legally required. No listing data is sold and no advertiser receives visitor-level data.

Required information

Business, advertiser, destination, authorisation and order fields are required to form and protect a commercial placement; without them checkout cannot proceed. Notice fields are required only as described on the report form so the operator can assess and answer the request. Slotmaxxing does not use solely automated decisions with legal or similarly significant effects: advertisements and reports receive human review.

Retention

View and click deduplication rows: 48 hours. Optional unused DNS challenges: 24 hours; a voluntarily completed legacy management proof: up to 180 days. Abandoned failed or expired order attempts without a payment, review receipt or open incident: up to 90 days. Public listings, commercial moderation audit and completed-payment ledgers: while the service operates, then restricted for the applicable accounting, dispute and legal limitation periods. Content reports and their linked operator decision audit: normally 24 months and deleted together, longer only where that report has a legal hold or another duty requires it. Hosting security logs follow the provider’s documented retention and are accessed only for security and diagnosis.

Your rights

You may request access, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. Use the secure contact form and state “privacy request” as the basis. Identity may need to be verified. You may also complain to the Spanish Data Protection Agency (AEPD).

The controller’s legal name, address, tax ID and monitored privacy contact appear on the Legal page whenever third-party submissions or payments are enabled.