DATA PRIVACY POLICYINDIA DPDP ACT 2023/2026GDPR & CCPA COMPLIANT

Privacy Policy

Last Updated: October 3, 2026 • In Effect for all BumpOne.lol Services

01. Data Fiduciary Overview & Scope

BumpOne ("BumpOne.lol", "we", "our", or "us") operates as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and as a Data Controller under the General Data Protection Regulation (GDPR) of the European Union.

This Privacy Policy applies to personal data collected when you visit, authenticate, submit digital projects to, or execute micro-transactions on https://bumpone.lol and associated application programming interfaces (APIs).

02. Itemised Notice of Personal Data Collected

In accordance with Section 5 of the DPDP Act and Article 13 of the GDPR, we provide this clear, itemised notice of the categories of personal data processed:

A. Authentication & Profile Credentials (Google OAuth)

Data Items: Full name, primary email address, Google Profile UID, and avatar photo URL.

Purpose: Authenticating user sessions, linking slot ownership, and preventing unauthorized account takeover.

B. Digital Project Billboard Content

Data Items: Project title, project destination URL, promotional handle (e.g. @builder), project banner/icon uploaded to Cloudflare R2, and description.

Purpose: Displaying the competitive 100-slot attention grid and public leaderboard.

C. Financial Transaction Identifiers

Data Items: Dodo Payments transaction IDs, customer email, transaction timestamp, payment status, and order currency amounts (USD).

Purpose: Crediting active slot values, triggering real-time bump displacement events, and anti-fraud verification.

D. Security & Anti-Abuse Telemetry

Data Items: IP address, browser user-agent, request timestamps, and rate-limiting counters.

Purpose: Enforcing sliding-window rate limits, blocking spoofed live activity feed messages, and DDoS mitigation.

03. Google API Services User Data Policy (Limited Use)

BumpOne strictly complies with the Google API Services User Data Policy, including the Limited Use requirements.

We access only the basic profile data (name, email, profile picture) requested via the standard OAuth scopes (openid, profile, email).
We do not sell, rent, or transfer Google user data to external data brokers or advertising platforms.
We do not use Google user data to train generalized AI/ML models or large language models.
Your Google credentials are used exclusively to authenticate your identity on BumpOne.lol.

04. Protection of Children & Minors (DPDP Act Section 9)

BumpOne is a commercial digital promotional arena intended exclusively for individuals who are at least 18 years of age (or the age of majority in your jurisdiction).

Mandatory Minor Protection: In compliance with Section 9 of the DPDP Act, we do not knowingly process personal data of children, undertake behavioral monitoring or tracking of children, or serve targeted advertising to minors. If we discover that personal data of a minor has been collected without verifiable parental consent, we will purge that data immediately.

05. Authorized Data Processors & Cross-Border Transfers

Under Section 16 of the DPDP Act and Chapter V of the GDPR, personal data may be processed by trusted infrastructure partners operating in secure cloud regions:

Partner	Role	Location	Security Safeguard
Supabase Inc.	Database & Realtime	AWS Global Cloud	SOC2 Type II, RLS Enforcement
Cloudflare Inc.	CDN, Workers & R2	Global Edge Network	ISO 27001, TLS 1.3 Strict
Google LLC	OAuth Identity	Global Infrastructure	OpenID Connect, Token Verification
Dodo Payments Inc.	Merchant of Record & Billing	PCI-DSS Compliant Tier	PCI Level 1, Svix Webhook Signature Verification

06. Data Principal Rights (DPDP Act, 2023)

As a Data Principal under India's DPDP Act, you possess the following statutory rights:

1. Right to Access Information (Sec 11)You may request a summary of the personal data being processed by us, a description of the processing activities, and identities of all data fiduciaries with whom it is shared.

2. Right to Correction & Erasure (Sec 12)You may request the correction of inaccurate data, completion of incomplete data, or permanent erasure of personal data that is no longer necessary for the specified purpose.

3. Right to Withdraw Consent (Sec 6)You may withdraw consent at any time. Withdrawal does not affect lawful processing conducted prior to revocation, but will cease active profile synchronization.

4. Right to Nominate (Sec 14)You have the statutory right to nominate an individual who, in the event of your death or incapacity, shall exercise your rights as a Data Principal.

07. International Rights (GDPR & US CCPA/CPRA)

GDPR (EU/UK): You have the right to data portability, restriction of processing, objection to automated profiling, and lodging a complaint with your local supervisory authority.
California Consumer Privacy Act (CCPA/CPRA): We do not sell or share personal information for cross-context behavioral advertising. You have the right to request disclosure of categories of information collected, request deletion, and not receive discriminatory treatment for exercising these rights.

08. Grievance Redressal Mechanism & Officer (DPDP Section 13)

In compliance with Section 13 of the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have designated a dedicated Grievance Redressal Officer:

DESIGNATED GRIEVANCE OFFICER

Name: Grievance & Compliance Desk

Entity: BumpOne Platform Operations

Direct Email: grievance@bumpone.lol

General Privacy: privacy@bumpone.lol

Turnaround Commitment: All grievances, consent revocations, and data deletion requests are acknowledged within 24 hours and fully resolved within 30 calendar days.

Escalation Notice: If you are located in India and your grievance is not resolved satisfactorily by our Grievance Officer within the prescribed timeframe, you have the right to escalate your complaint directly to the Data Protection Board of India (DPBI) in accordance with Section 13(3) of the DPDP Act.