Privacy Policy

PixelHive LLC is the data controller (GDPR) and Data Fiduciary (DPDP Act) for personal data processed through the Service.

Registered address: Available on request — contact hi@pollbaba.com
Contact: hi@pollbaba.com

We collect only what the Service needs to function:

• Account data — email address, password (stored only as a salted hash by our authentication provider; we never see it), display name, optional avatar image, and your account role.
• Content you submit — affiliate programme listings (including any contact details you choose to include), reviews and ratings, ownership claims, bookmarks, and blog comments (which include your display name and email address).
• Payment records — when you purchase a paid listing boost we store the payment identifier, plan, amount, currency and timestamps. We never receive or store your card details; these are handled entirely by our payment processor.
• Usage and click data — when a listing link is clicked we record the IP address, browser user-agent, referring page and timestamp. IP addresses are personal data; we use them only for click-fraud prevention and aggregate statistics, and we delete them on the schedule in section 6.
• Newsletter — when you create an account, the sign-up form offers to subscribe you to our newsletter, PollBaba's Scroll. That box is ticked by default and you can untick it before creating the account. If it is left ticked we add your email address to our subscriber list and to Substack, who send the newsletter on our behalf. You can opt out at any time in Profile → Settings, or from the unsubscribe link in any issue. Subscribing through a form on the site (rather than at sign-up) takes you to Substack, where they hold the address.
• Product analytics — if you consent, we record pageviews and feature-usage events keyed to a pseudonymous identifier. We do not send your email address or name to our analytics provider.
• Referral data — if you consent and arrived via an affiliate link, we store the referral identifier so the referrer can be credited.
• Administrative logs — records of moderation and administrative actions, for security and accountability.

• To provide the Service (accounts, listings, reviews, payments) — performance of a contract (GDPR Art. 6(1)(b)); necessary for the specified purpose under the DPDP Act.
• Security, moderation and fraud prevention (rate limiting, click fraud, abuse) — legitimate interests (Art. 6(1)(f)).
• Analytics and referral tracking — your consent(Art. 6(1)(a)). You may withdraw it at any time and the Service continues to work.
• Newsletter — your consent, given by leaving the subscribe box ticked at sign-up or by subscribing through a form. Withdraw it at any time in Profile → Settings or via the unsubscribe link in any issue; withdrawing does not affect your account.
• Tax, accounting and dispute records for payments — legal obligation (Art. 6(1)(c)).

Strictly necessary cookies keep you signed in and protect against request forgery. These are required for the Service and are set without consent.

Analytics and referral cookies/identifiers are set only after you accept them in the consent banner. If you decline, we do not load our analytics or referral scripts at all. You can change your choice at any time from the banner or by clearing site data.

We do not sell personal data. We share it only with service providers ("processors" / "Data Processors") who process it on our instructions under contract:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Dodo Payments — payment processing (card data goes directly to them).
• Resend — sending transactional email.
• PostHog — product analytics (consent-based only).
• Endorsely — affiliate/referral attribution (consent-based only).
• Cloudflare — bot protection on sign-up and sign-in forms, where enabled.
• Substack — sends our newsletter, “PollBaba's Scroll”. If you are subscribed, we transfer your email address to Substack so they can deliver it, and their privacy terms apply to the copy they hold. Every issue carries an unsubscribe link, and opting out on Pollbaba removes you from the list we send them.

We may also disclose data where legally required, or to establish, exercise or defend legal claims.

Our database is hosted in secure cloud data centres operated by our infrastructure providers. Some providers listed above process data outside your country, including in the United States. Where personal data is transferred out of the EEA/UK we rely on the European Commission's Standard Contractual Clauses or an adequacy decision; for transfers from India we comply with the DPDP Act's restrictions on transfers to restricted territories.

We keep personal data no longer than necessary:

• Account and content — until you delete your account (see section 7).
• Newsletter subscription — until you unsubscribe. We keep a record that you unsubscribed so we don't re-add you.
• Click logs including IP addresses — automatically deleted after 90 days.
• Payment and invoicing records — retained as long as tax and accounting law requires.
• Backups — residual copies may persist in encrypted backups for up to 30 days after deletion.

Under the GDPR you have the right to access your data; to have inaccurate data corrected; to erasure; to restrict or object to processing; to data portability; to withdraw consent at any time; and to lodge a complaint with your local supervisory authority.

Under the DPDP Act you have the right to access a summary of your personal data and processing; to correction, completion, updating and erasure; to grievance redressal; and to nominate another person to exercise your rights in the event of death or incapacity.

How to exercise them. You can update your profile and delete your account and associated personal data directly in the app under Profile → Settings. For any other request — including access, portability or nomination — email hi@pollbaba.com and we will respond within one month (GDPR) or the period prescribed by the DPDP Act. Exercising these rights is free.

If you are in India and are unhappy with how we handle your personal data, you may contact our Grievance Officer:

Our privacy team (contact hi@pollbaba.com)
hi@pollbaba.com
Available on request — contact hi@pollbaba.com

If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India.

The Service is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

Access to data is restricted by row-level security policies so users can only reach their own records; administrative functions are gated server-side; passwords are hashed by our authentication provider; payment card data never touches our servers; and uploads are validated and type-checked. No system is perfectly secure, but we review and harden these controls regularly.

We will update this page when our practices change and revise the "last updated" date. If changes are significant we will notify you in the app or by email.

Questions about this policy or your data: hi@pollbaba.com — or use our contact page.