Privacy Policy

Draft. Not legal advice. Review with a lawyer before launch.

Last updated: 24.08.2026

This page explains what outrankm.ee collects, why, and what you can ask us to do about it.

The site is small, and so is this policy. There is no login, no advertising tracker, no data broker, and no analytics company. We measure our own traffic on our own server, without cookies and without personal data. What we hold is listed below in full.

Who is responsible

The data controller is:

• Suprasanna Ojha
• [email protected]

Write to [email protected] about anything on this page.

What we collect and why

Listing content, which is public by design

Your listing name, tagline, destination URL, paid total, position, and click count are published. That is the product. Anyone can read them, and search engines can index them.

Do not put personal information in a listing name or tagline unless you intend the world to see it.

• Why: to perform the contract you bought.
• Legal basis: performance of a contract.

Your email address, if you give one

The email field is optional. We use it for two things only:

• to send you the claim token for your listing;
• to tell you when another listing has outranked you.

We do not sell it. We do not rent it. We do not add it to a marketing list, and we do not send you offers unless you have asked us to. It is never published.

• Why: to deliver the notification you asked for.
• Legal basis: performance of a contract, and your consent for the notification.

Payment data

Payments are processed by Stripe. Your card number never reaches our servers, and we could not store it if we wanted to.

From each payment we keep a payment reference, the amount, the currency, the time, the status, and the listing it belongs to. Stripe may also give us limited information for fraud and tax purposes, such as a country or the last four digits of a card.

• Why: to take payment, to keep accounts, and to defend disputes and chargebacks.
• Legal basis: performance of a contract, a legal obligation (accounting and tax), and our legitimate interest in preventing fraud.

Stripe handles your card details as its own controller. Read Stripe's privacy policy for what it does with them.

Click deduplication

We publish a click count for each listing. To stop the same visitor inflating a count, we derive a hashed value from the visitor's IP address and user agent, and we keep it for one hour. Within that hour, repeat clicks from the same visitor on the same listing count once.

The hash is a one-way value. We do not use it to build a profile, to identify anyone, to follow a person across the site, or to target advertising. It expires and is discarded.

• Why: to make the published click counts honest.
• Legal basis: our legitimate interest in accurate advertising metrics.

Audience measurement

We run Umami, an open-source analytics tool, on our own server at stats.ojha.tech(https://stats.ojha.tech/share/uDuDfl1tQWuyXRwe/outrankm.ee). No third party receives the data and no analytics company is involved.

Umami sets no cookies and stores nothing on your device. For each page view it records the page, the referrer, the country, and the device, browser and operating system type. To count a repeat visit without identifying you, it derives a one-way hash from your IP address, your user agent and a daily salt. The salt is discarded every day, which means the hash cannot be linked back to you or followed from one day to the next. Your IP address is not stored.

We also record a few named events with no personal data attached: opening the payment dialog, starting a checkout, clicking through to a listing's site, and switching a filter. They tell us which parts of the board people use.

Our own visitor and page-view totals are public — the counter in the site footer links to the same dashboard we read.

• Why: to know how many people see the board and how they use it.
• Legal basis: our legitimate interest in measuring our own audience. The measurement is cookieless and stores no personal data, so it does not require consent under Estonian law.

Server logs

Our servers keep ordinary technical logs: request time, path, status code, IP address, and user agent. They exist for security, abuse investigation, and debugging. They are short-lived and are not used for marketing.

• Legal basis: our legitimate interest in operating the site securely.

What we do not do

• We do not send analytics data to anyone else. Our measurement runs on our own server and is named on this page.
• We do not run advertising trackers, pixels, or retargeting.
• We do not sell, rent, or trade personal data.
• We do not build visitor profiles.

Who else touches the data

• Stripe — payment processing.
• An email provider — used only if you gave an email address for notifications.
• Our hosting and infrastructure provider — stores the site and its logs.

These providers act on our instructions, except Stripe, which is also a controller for its own payment data. Some of them may process data outside Estonia; where they do, transfers rely on the safeguards those providers publish.

How long we keep things

• Payment records: kept for as long as accounting, tax, and audit law requires in Estonia, and for the period in which a dispute can still be brought.
• Removed listings: we remove the public display. We keep the payment record, and a note of why we removed it, for audit and fraud prevention.
• Click deduplication hashes: one hour.
• Server logs: a short technical retention period, then deletion.
• Notification emails: kept while the listing is live and for a short period after, then deleted.
• Archive pages: permanent.

The archive is permanent, on purpose

When a card closes at midnight UTC, we freeze the standings into an archive page. That page is the record of what happened that night. It names the listings, their positions, and what they paid.

We do not delete archive pages, and we do not remove listings from them. The permanence is the point of the product. A result you can erase is not a result.

So please understand the trade before you buy: a listing name is public, and once it is in the archive it stays public. If that is not acceptable to you, do not buy a listing.

Your rights

Subject to the law that applies to you, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is wrong;
• delete data, where we have no lawful reason to keep it;
• restrict or object to processing that relies on our legitimate interest;
• withdraw consent for outranked notifications, at any time;
• receive the data you gave us in a portable form.

Email [email protected] to exercise any of these. We reply within one month. We may ask you for enough information to be sure the request is really yours; we will not ask you for your claim token.

Two honest limits:

1. Archived results are not deleted. They are a permanent public record and are the product itself. We will not remove a listing from a closed card's archive on a deletion request.
2. Payment records are not deleted while accounting, tax, or fraud-prevention law requires us to hold them.

We can remove your email address, stop notifications, and take a live listing off the current board. Ask us and we will.

If you think we have handled your data badly, tell us first. You may also complain to the data protection supervisory authority in Estonia, or in the country where you live.

Cookies

The site does not use cookies for advertising or analytics. Our audience measurement is cookieless by design. If we set a cookie, it is strictly necessary to make the site work, and we will say so here.

Children

The site is for businesses and for adults. It is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe we hold a child's data, write to [email protected] and we will delete it.

Changes

We may update this policy. We will change the date at the top. Material changes will be announced on the site.

Contact

[email protected]