What Outbig processes, what it deliberately does not, and the rights you have. The controller under the GDPR is the media owner named in the imprint.
There is no user account and no registration. You can read the entire leaderboard without providing anything.
We use no analytics, advertising, or tracking cookies and embed no third-party analytics service. That is why you see no cookie banner here: there is nothing for you to consent to.
Payment details never reach our servers. Card data, name, and billing address stay with our payment provider.
You provide a website address or an @handle, a category, and an amount. These are displayed publicly on the leaderboard together with the amount paid — that is the purpose of the service.
Payment is handled by Stripe. Of the payment we store only the identifiers Stripe issues (checkout session, payment intent, charge) plus amount, status, and time. We need those identifiers to book a payment exactly once and to match refunds and chargebacks.
The legal basis is Art. 6(1)(b) GDPR (performance of the placement contract) and Art. 6(1)(c) GDPR for tax and commercial record-keeping.
Some listings do not come from the providers named in them but from us: the name, a short description, the category, and the website address of well-known offerings. We took them from publicly available sources; those providers paid nothing and were not asked.
As a rule these are details about companies and therefore not personal data. Where a listing concerns a sole trader or an individual, we rely on Art. 6(1)(f) GDPR; the legitimate interest is a leaderboard whose categories are not empty. Only details the person concerned has published themselves are processed.
You may object to this processing at any time, without giving a reason. A message to office@ostheimer.at is enough; we remove the listing without undue delay and at the latest within 72 hours. See the imprint for details.
Clicking a listing tells our server which listing was clicked. That produces the public click counter, which shows bidders what they get for their money.
Your IP address is not stored. It enters only as a salted hash into an in-memory counter that prevents click figures from being inflated or suppressed. That counter expires within minutes. No full IP address exists in any database or in any persistent storage.
No profile is created, no recognition persists beyond that window, and nothing is linked to a person. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is a click figure that resists manipulation.
outbig_locale: stores your language choice so the site does not redirect you again on every visit. One year, strictly necessary, no consent required.
outbig_theme: stores your choice between light and dark appearance. It lives in your browser's local storage and is never sent to our server.
We set no other cookies. Stripe may set its own cookies during checkout; that is outside our control.
The fonts Inter and JetBrains Mono are downloaded when the site is built and served from our own server. Loading a page therefore opens no connection to Google and transmits no IP address there.
Vercel Inc. — hosting and delivery of the website. Server logs briefly contain IP addresses as a technical necessity.
Neon Inc. — the database holding listings, bid balances, and payment identifiers.
Stripe Inc. and Stripe Payments Europe Ltd. — payment processing, including the payment data that never reaches us.
Where this involves a transfer to the United States, it relies on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework.
A listing and its bid balance stay visible for as long as the listing is on the leaderboard. That permanence is the point of a verifiable ranking.
Accounting records relating to payments are kept for seven years, as Austrian tax law requires.
Click and rate-limiting state expires within minutes and is never persisted.
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Write informally to the email address given in the imprint.
Please note: because we store neither a name nor an email address with a bid, we can often identify a request only via the Stripe identifier or the listing itself. Please name the listing concerned or your payment confirmation.
If you believe the processing of your data infringes the GDPR, you may lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).
Last updated: 23 August 2026