BeastBid

Privacy Policy

Last updated: 10 September 2026

This explains what BeastBid collects, why, and what you can do about it.

The data controller is Granadilla Studio Ltd, company number 17196115, registered in England and Wales.

What we collect

If you create a beast:

  • Your email address, or your Google account email if you sign in that way
  • The prompt you wrote, your beast's name, its ability line, its stat labels and values
  • Your country and, if you give one, your agency or company
  • Any art you upload
  • The time you created and claimed it

If you dictate your prompt. The recording is sent to OpenAI to be turned into text. We do not store it. It is held only for the length of that one request and is gone once the words come back. It is not attached to your beast and it is not sent anywhere else.

If you pay:

  • Stripe processes the payment. We never see or store your card details.
  • We record the amount, the currency, your country, your email as given to Stripe, and a Stripe session ID
  • If you choose to appear on a backer wall, the name and message you supply

If you vote:

  • No account needed. We store a one-way hash of your IP address combined with a browser cookie and a secret salt. We cannot reverse it to your IP.

If you click a sponsored link:

  • The time, the beast, a one-way hash of the referring page, your country, and a device class. Not your IP, not your identity.

If you visit a card page:

  • We count the view. Owners can see how many views their own beast has had. Nobody else can.

If you arrive through somebody's share link. We record which beast's link it was, both against the page you land on and, if you go on to make a beast of your own, against that beast. It is used to measure one thing, which is whether people who see a beast go on to make one. It is never shown on any card, it is never shown to another person, and it is not used to build a profile of you.

Automatically, on any visit:

  • Standard server logs kept by our hosting provider

Why we collect it

  • To run the site. Your email identifies you as the owner of your beast so you can come back and edit it.
  • To take payments and defend disputes. We keep a record of each payment — amount, time, the rank before and after, and the disclosure text shown at checkout — because a chargeback months later has to be answerable.
  • To stop abuse, and to see whether the site is working. Hashed vote and click data lets us spot bots without identifying anybody. The same hash is used once more, when somebody makes a beast, to record whether that browser had already voted. What is stored is a yes or a no. The hash itself is never stored against your beast, so it cannot be used to work out which beasts you voted for.
  • To email you. Rank changes, unlocks, receipts. You can opt out of everything except transactional messages about payments you have made.
  • To meet our tax and accounting obligations.

Legal bases

Contract — running the site and taking payment. Legitimate interests — preventing abuse, defending disputes, and understanding how the site is used. Legal obligation — tax and accounting records.

Where we rely on legitimate interests you can object; see below.

Who we share it with

We use these processors, and no others:

  • Supabase — database, authentication and file storage. Hosted in Ireland.
  • Vercel — application hosting. Functions run in Dublin.
  • Stripe — payment processing. Stripe is a controller in its own right for payment data; see stripe.com/privacy.
  • Resend — sending email.
  • OpenAI. Generates the creature art and the ability line from the prompt you write. If you use the microphone, it also turns your recording into text. Your prompt is sent to OpenAI either way. Do not put personal information in it.
  • Cloudflare — DNS, and the bot check on the creation form.
  • Google Safe Browsing — checking submitted links. The URL is sent to Google; nothing about you is.

We do not sell your data. We do not run advertising networks or third-party trackers on the site.

Cookies

Five, and this is all of them. None of them advertise and none of them follow you to other sites.

The session cookie is set by Supabase and is what keeps you signed in. It holds your sign in token and lasts until you sign out.

The other four are ours. Each one holds either a random identifier or the name of a beast. None of them holds your email address and none of them holds your IP address, and none of them can be read by anything but our own server.

  • bb_voter counts one vote per beast per browser per day. It lasts 400 days.
  • bb_viewer lets an owner see how many different people looked at their beast rather than how many times it was refreshed. It lasts 400 days.
  • bb_ref remembers which share link brought you here, if one did. It lasts 90 days.
  • bb_reporter stops one browser filing the same report over and over. It lasts 400 days.

How long we keep it

  • Unclaimed beasts are deleted after 24 hours.
  • Claimed beasts and their art are kept while they are on the board. Previous versions of your art are kept so you can restore them.
  • Payment records and dispute evidence are kept for six years, as UK tax and accounting rules require.
  • Hashed vote and click data is kept indefinitely in aggregate; it does not identify you.

Your rights

If you're in the UK or EU you have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable format.

To exercise any of these, email us. We'll respond within a month.

One limitation, stated plainly: if you delete your account, your beast and the payments other people made toward it may stay on the boards. Other people paid toward that beast, and removing their contribution would misrepresent the board's history. We will disassociate it from you.

You can complain to the Information Commissioner's Office at ico.org.uk.

International transfers

Some of our processors are outside the UK and EEA, principally in the United States. Where that happens, transfers are covered by the UK International Data Transfer Addendum or Standard Contractual Clauses.

Children

BeastBid is not for anyone under 18. We don't knowingly collect data from children. If you think a child has used the site, tell us and we'll delete it.

Changes

We'll update the date at the top when this changes.

Contact

Granadilla Studio Ltd, company number 17196115, England and Wales.

Contact: tavis@granadilla.studio