Privacy policy
Last updated: 22 August 2026
Who is responsible
The data controller is [FULL LEGAL NAME], [NIF/DNI], [REGISTERED ADDRESS]. Contact: hello@buyasecond.com.
What we collect, and why
- The name and message you submit — to display them publicly against your second, which is the service itself. Legal basis: performance of our contract with you. Kept while the site operates.
- A one-way hash of your payment email — we never store the email itself. Stripe gives us the email you used at checkout; we immediately convert it with HMAC-SHA256 and a secret key into an irreversible identifier, and store only that. It lets us group your purchases on the “Top Owners” board so that someone else cannot claim your statistics by typing your name. Legal basis: our legitimate interest in an accurate, non-impersonable leaderboard.
- Payment data — handled entirely by Stripe. We never see or store card numbers.
- Server logs — technical records including IP address, kept briefly for security and abuse prevention (rate limiting). Legal basis: our legitimate interest in keeping the service available.
What we do not do
No accounts, no advertising or tracking cookies, no analytics profiling, no marketing emails, no selling or sharing of data with third parties for their own purposes. The visitor counter shown on the site is a display figure, not a measurement of you.
Who processes data for us
- Stripe — payment processing (its own privacy policy applies to the payment relationship).
- Amazon Web Services — hosting and encrypted backups, in the EU (Ireland).
Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing, by writing to hello@buyasecond.com. Note two limits we want to be upfront about: the email hash is irreversible, so we can only act on it if you tell us which purchase is yours; and erasing a purchased name and message removes the display you paid for, without refund, since the purchase itself remains valid.
You can also complain to your national supervisory authority — in Spain, the Agencia Española de Protección de Datos.
Changes
We may update this policy; the date above shows the current version.