Privacy Policy

BrandMyLaptop is run by Vynse, a sole trader established in France, SIREN 992 128 017 (full details on the legal notice). Contact: vincent@brandmylaptop.com. We are the data controller for the site and the listings on it.

For the sale itself, the seller is the one you are dealing with — they take the payment into their own account and decide what goes on their laptop. They are a controller of what they receive about their buyers, and their own obligations there are theirs.

• Email address — for your receipt, the seller’s decision, your invoice and your brand page link, and so the seller can reach you about the artwork they are printing. It is passed to the seller, for that reason and because they are the merchant for the sale. Basis: the contract you are entering.
• Brand name, logo file and website — they are what gets published on the lid, on that listing’s page and on your own brand page once the seller approves them. Basis: the contract. A logo the seller refuses, or that loses to another brand, or whose hold lapses, is deleted at that moment.
• What you offered, and when — the price is shown publicly beside the spot once approved. Basis: the contract.
• An X handle, if you give one — optional, and published beside your logo.
• A payment reference — the identifiers Stripe returns, so the hold can be found, captured, released or refunded. Card numbers never reach this site: they are entered on Stripe’s own page, or in Stripe’s own field on the budget page, and the payment goes to the seller’s Stripe account rather than to ours. When you hold several laptops at once from the budget page, Stripe keeps the card on our account for that one run, so each creator can be held without typing it again; it is deleted when the run ends, and a day later at the latest.
• Billing details, for the invoice — the name or company, billing address and VAT number you enter at Stripe’s checkout or in the budget page’s form. The creator is the merchant and invoices you, and these are what the invoice is addressed to; we keep a copy beside the purchase so it can be shown to you and to that creator. The address is required at checkout, the VAT number is optional. Basis: the contract, and the creator’s legal duty to invoice.
• That you ticked the box under the checkout button, and which version of the terms it stood for. Basis: our legitimate interest in being able to show what was agreed.
• What you typed, if you stop before paying — the brand name, email, website and handle from a buy form left at the card step are kept and shown to that seller, so they can get back to you; the logo is shown to nobody. Basis: our legitimate interest, and the seller’s, in a sale that was nearly made. Deleted with the lid.
• Your email again, if you leave it on a lid’s page — to be told when the lid opens for buying, or as somebody interested but not buying today. Basis: your request. The seller of that lid sees it and may write to you; we use it for one message when the lid opens. Deleted with the lid.

We do not ask a buyer for a phone number, and there is no account to create. If you send a campaign brief through the site, its contents and your email are kept in our database, so a request is never lost, and sent to our inbox and to a private alert channel we read, and nowhere else.

• Your X or LinkedIn account — the account id and your display name and picture, and from X your handle and follower count, read with your own sign-in. The handle, name, picture and follower count are shown publicly on your lid, because they are what a buyer can check before paying a stranger. We are never able to post on your behalf. Basis: the contract.
• An email address — to reach you about your own listing, your buyers, and changes to the platform that affect you. The same address receives the site’s weekly digest of what sold, from which every message carries a one-click unsubscribe; unsubscribing from it never stops a message about your own sale. Basis: the contract for the former; for the digest, our legitimate interest in writing to people who sell here, which you can object to at any time.
• Links to your other profiles, if you add them, and a follower count for each, if you type one. Both are shown publicly on your lid and on your card on the board; a typed count is marked as self-reported, because we never fetch or check it. Which of these your card shows is your choice, from your dashboard, and you can remove any of it at any time.
• What you set up — the machine, the layout, the prices, the closing date, your pitch, and the proof photo you post. All of it is public, which is the point of a listing.
• Which link brought you here, if you arrived on one — a newsletter’s or a partner’s — and any invitation code you used. Kept on your account, never shown, so we know which door works. Basis: our legitimate interest in knowing where sellers come from.
• Your own Stripe account — connected, not created by us. You keep your account, your dashboard and your relationship with Stripe. We receive an account reference and a yes-or-no about whether you can take payments, and never your bank details or identity documents. You can disconnect us from your Stripe dashboard whenever you like, or unlink the account from ours here, which stops new sales on your lid.
• Who you are, for the tax authority — never for the page. EU rules for platforms (DAC7) require us to know who earns through this site. So we ask every seller whether they sell as a person or a company, and their country, when they list. A seller resident in the EU who sells is then asked, from their dashboard, for their legal name and tax number and, for a person, their date of birth, or, for a company, its registered name and number; the law may also require their address, which we will ask for when it does. What the law requires is sent to the French tax authority once a year, the seller receives a copy of it, and it is kept as long as the law requires. It is never shown on your listing, never given to a brand, never used for anything else. Basis: a legal obligation. What you owe the tax authorities remains between you and them.
• The date and version of the terms you accepted when you published. Basis: our legitimate interest in being able to show what was agreed.
• What you answer, if you answer the short survey on your dashboard — how you found the site, a rating, a note. It goes to a private alert channel we read. Optional.

Once a seller approves a purchase, the brand name, logo, website and price appear on the listing and on the brand’s own page — that is what buying a spot is for. The sticker on the lid links to the website you gave, or to your X profile if you gave no website, so a visitor can reach you. An offer waiting for approval is shown to nobody but the seller.

A seller reviewing their queue sees the brand name, logo, website, X handle, price and email address of each offer on their own lid, and nothing from any other seller’s. Beside it they see the unfinished offers on their lid and the addresses left on its page, without the logo. A buyer’s email is never published on the site.

Of a seller, a buyer sees what is on the listing: display name, handle, picture, follower count, the lid, the prices, the pitch and the proof photo. The same public profile is drawn into the picture a listing makes when it is shared, which anyone who opens the listing can download and post; a picture read from X or LinkedIn is copied into the platform’s own storage so it keeps showing after the network’s link expires.

This site sets no cookies. Visitor numbers come from DataFast in its cookieless mode: it records your IP address, your browser’s user-agent and the page you landed on, and turns them into a pseudonymous identifier that rotates roughly every 24 hours, which it keeps in your browser’s session storage for the length of your visit. There is no advertising network and no cross-site tracking. When the platform itself is paid — a listing fee, a sponsor slot — that identifier is attached to the payment so that we can see which pages led to it; a buyer’s payment to a seller never carries it.

If you sign in as a seller, your X handle is attached to your own visits to this site, so a listing can be followed from the first visit to the day it goes up. That is the only case where visits are tied to anything, it covers sellers alone — never buyers, never anyone who has not signed in — and the handle is all that is sent: no name, no email address, and nothing about you from anywhere else. Ask and it is removed.

Views are counted, not visitors. A listing counts its views per day, with one word for where they came from — “linkedin”, “google”, “direct” and a short fixed list like them, read from the link or the site you came from, and “other” for anything else. A brand page counts its opens and the clicks to the brand’s own site the same way. No address, IP, time of day or anything else about you is stored with these counts, and the seller or brand sees only the totals.

When a visitor submits a form, their IP address is kept for 24 hours in a counter that stops the same address submitting it hundreds of times. Basis: our legitimate interest in keeping the forms usable.

A seller may show up to three of their own posts on their lid page. The card you see is drawn from a preview the site fetched from the platform when the seller saved the link; the post itself — YouTube, X, LinkedIn or TikTok’s own frame, with whatever cookies that platform sets — loads only when you tap it.

The site also keeps a few things in your own browser, which never reach a server:

• your buying details — brand, email, website, handle and the logo you chose — so you do not have to retype them;
• a lid you are part-way through setting up as a seller, so signing in does not cost you the form;
• your seller sign-in, if you have one, and your currency choice.

• Supabase — hosts the database, the logo files and the proof photos, and handles seller sign-in. Its servers for this site are in Paris, France.
• X and LinkedIn — when a seller signs in with one of them, it tells this site their account id, name and picture, and X also their handle and follower count.
• Stripe — holds, takes, releases and refunds payments, issues invoices, and keeps the card and identity details this site never sees. Each seller has their own Stripe account, and buyers pay into it directly. Stripe also receives the seller’s email when they connect.
• Resend — sends every email the site sends, and keeps the list the weekly digest goes to, with its unsubscribes.
• Vercel — hosts the site and keeps standard server logs.
• Crisp (Crisp IM SAS, France) — runs the support chat in the corner of every page and the inbox behind it. It sees what you type into the chat and, for a signed-in seller, their handle, never their email; its own cookie only starts once you open the chat.
• DataFast — counts visits, without cookies, as described above.
• Discord — receives a private alert we read when something needs a person: a new offer (brand, website, handle and logo, not the buyer’s email), a sponsor purchase, a campaign brief (with the sender’s email), a seller’s survey answer.

Some of these providers are established in the United States. Where data leaves the European Union, the transfer relies on the EU–US Data Privacy Framework for a provider certified under it, and otherwise on the European Commission’s standard contractual clauses in that provider’s terms.

We do not sell your data, and we do not use it for anything other than running this marketplace.

A purchase record stays for as long as the sticker is on the lid, since it is the record of who bought what, and the platform’s own accounting copy of it — the commission earned, and the sale it came from — is kept for the ten years French accounting law requires, whatever you ask, because that obligation is not ours to waive. A logo that was refused, outbid or left to lapse is deleted at that moment; the record of the offer stays, without the logo.

A seller’s account and their closed listings stay while they have a lid on the site, and go on request afterwards, except the tax and accounting records above.

An address on the digest list stays until it unsubscribes. An address left to be told when a lid opens goes with that lid. A campaign brief stays in our database, inbox and alert channel until we clear it, and a survey answer in the inbox and alert channel.

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, have its use restricted, object to a use based on our legitimate interest, and receive the data you gave us in a form you can take elsewhere. Email vincent@brandmylaptop.com and we will answer within a month. For what a seller holds about you as their buyer, ask them — we will pass the request on. You may also complain to the CNIL, the French supervisory authority, at cnil.fr.

If this policy changes in a way that affects you, we email every seller with a live lid. Buyers have no account to write to, so the date at the top is the record of the current version, and a change never applies backwards to a sale already made.