Privacy Policy — HugeTen

Section 1 — Controller and Contact

HugeTen is operated by:

Evaldas Salikas
Individual activity certificate No. 1343714
VAT ID: LT100020818611
V. Krėvės pr. 18-54
LT-50415 Kaunas
Lithuania

Evaldas Salikas is the controller of personal data processed by HugeTen where HugeTen determines the purposes and means of processing.

Privacy contact: hello@hugeten.com

Section 2 — Personal Data We Process

This section describes the categories of personal data that HugeTen processes. Not every category applies to every user — the data processed depends on how you use HugeTen.

2.1 Account and Authentication

Email address.
Authentication and account information.
Session and security information.
18+ eligibility confirmation collected during signup.

2.2 Business Profile

Business/profile information you provide.
Contact information.
Website, description, logo, banner, and photos.
Public address/location information.
Opening hours and other profile information you provide.

2.3 Creator Profile

Display name, bio, avatar, and website.
Social profile information, including social-account IDs/usernames and follower/subscriber counts.
Verification status.

2.4 Sports Club Profile

Club/profile information, website, logo, and cover image.
Social URLs, city, sport, and description.
Relevant verification and claim information.

2.5 Crown and Marketplace

Crown ownership, claims, and orders.
Bids and auction history/events.
Renewals and scheduled takeovers.
Related transaction and status records.

2.6 Billing, Payment, and Tax

Billing name, email, and address.
Country and postal information.
VAT/tax information.
Stripe Customer, PaymentMethod, and payment references.
Payment and order status.
Stripe Tax calculation and transaction references.

HugeTen does not store full payment-card details. Card details are handled directly by Stripe.

2.7 Legal and Consent Records

Records showing acceptance of applicable Terms, Crown Rules, Sports Rules, and related document versions and timestamps.

Accepting the Terms, Crown Rules, or Sports Rules is a contractual requirement, not GDPR consent.

2.8 City Board

Author, user, and participant attribution.
Crown attribution.
Post title, body, type, and uploaded images where provided.

2.9 Communications

Transactional email information and delivery status.
Communications sent to hello@hugeten.com or otherwise submitted to HugeTen.

2.10 Security

Rate-limit information.
Security and abuse-prevention information.
Cloudflare Turnstile verification and security information.

2.11 Analytics

Google Analytics (GA4) information, loaded only after you grant analytics consent as described in Section 3.4.

2.12 Google Maps

Google Maps external content is loaded only after you click “Load map” on a public Business profile. See Section 3.5 for details.

2.13 Social-Account Verification

Creator social-account verification data for YouTube, Instagram, and TikTok. See Section 4 for details on each provider.

Section 3 — Legal Bases for Processing Personal Data

HugeTen relies on different legal bases under GDPR Article 6 depending on the purpose of processing. Not all processing is based on the same legal ground. This section explains each basis and the types of processing that rely on it.

3.1 Contract and Pre-contractual Steps — Article 6(1)(b)

HugeTen processes your personal data when it is objectively necessary to provide the service you requested, to perform a contract with you, or to take steps you asked for before entering into a contract.

This basis covers:

Creating an account and managing your login session.
Creating and publicly displaying your Business profile, Creator profile, or Sports club profile.
Creator social-account verification that you initiate (for example, connecting a YouTube, Instagram, or TikTok account), including the temporary technical state needed to complete that verification.
Claiming a Crown position and completing a direct Crown purchase.
Collecting billing information needed to complete a purchase.
Placing an auction bid.
Storing a reference to your saved payment method so HugeTen can carry out your bid commitment, including off-session settlement of a winning eligible bid.
Processing Crown takeovers and Crown renewals.
Sending service-required transactional communications (such as auction outcome notices, renewal reminders, and payment confirmations).
Providing City Board functionality to eligible Crown holders.

This basis does not cover every type of processing HugeTen carries out. Processing that is not necessary to provide the service or perform a contract relies on a different legal basis described below.

3.2 Legal Obligation — Article 6(1)(c)

HugeTen processes personal data where necessary to comply with applicable legal obligations.

This basis covers:

Generating and retaining invoices.
Maintaining accounting records.
VAT and tax records, including tax-relevant billing information.
Stripe Tax calculation and transaction records where required for tax or accounting purposes.
Receiving, verifying, and documenting applicable data-protection rights requests, where processing that information is itself required to comply with a legal obligation.

HugeTen only relies on this basis where a legal obligation genuinely applies. Not all record-keeping is legally required; where retention serves a different purpose (such as fraud prevention or dispute defense), the relevant basis is legitimate interests (Section 3.3).

3.3 Legitimate Interests — Article 6(1)(f)

HugeTen may process personal data where necessary for its legitimate interests, provided those interests are not overridden by your rights and freedoms as a data subject.

This basis covers:

Rate limiting and abuse prevention.
Cloudflare Turnstile used for bot and security protection on account creation, login, and password reset forms.
Fraud prevention and payment security.
Maintaining auction integrity.
Platform and administrative access security.
Retaining evidence that you accepted the Terms, Crown Rules, or Sports Rules, where this is reasonably necessary to establish, exercise, or defend legal claims.
Retaining relevant auction and bid history where reasonably necessary for dispute resolution, fraud prevention, platform integrity, or legal claims.

Accepting the Terms, Crown Rules, or Sports Rules is not GDPR consent. Those acceptances are recorded as contractual or legitimate-interests processing, not as a freely given, specific, informed, and unambiguous opt-in to optional processing.

Cloudflare Turnstile is a security technology. It is not used for analytics, advertising, profiling, or marketing.

Google Maps is not processed automatically under legitimate interests. See Section 3.5 for how Google Maps content is handled.

3.4 Consent — Article 6(1)(a)

HugeTen relies on your consent only for optional processing that genuinely depends on your choice.

This basis covers:

Google Analytics (GA4) non-essential analytics. GA4 is loaded only after you grant analytics consent via the cookie consent banner. If you reject or do not grant analytics consent, GA4 does not load.

The following actions are not GDPR consent merely because you click or confirm something:

Accepting the Terms of Service.
Accepting the Crown Rules.
Accepting the Sports Crown Rules.
Completing Creator OAuth social-account verification.
Confirming the 18+ eligibility requirement.

These are contractual or legitimate-interests processing, not consent under Article 6(1)(a).

3.5 Google Maps External Content

The HugeTen public business profile page can display a Google Maps embed showing the business location. The current implementation works as follows:

The Google Maps iframe does not load automatically when you open a business profile.
The Google Maps Embed API key is not requested during initial profile loading.
You must explicitly click the “Load map” button before any map content is loaded.
Clicking “Load map” connects you to Google and may transmit technical information such as your IP address to Google.
This interaction is separate from GA4 analytics consent. Rejecting analytics does not prevent you from clicking “Load map.”
Your choice to load the map is page-local. It is not stored by HugeTen in cookies, local storage, or the database. Refreshing the page or opening another business profile returns the map to its unloaded state.

The separate “Google Maps” external link on the business profile opens Google Maps in a new browser tab. That link works independently of the embedded map and does not load any Google content on the HugeTen page itself.

3.6 Auction History and Retention

Legal basis and retention are separate concepts.

Contractual auction processing — such as placing bids, determining winners, and completing purchases — relies on Article 6(1)(b) (Contract).
Retaining auction and bid history for fraud prevention, dispute handling, platform integrity, or legal claims relies on Article 6(1)(f) (Legitimate Interests).
Financial, accounting, and tax records related to completed transactions rely on Article 6(1)(c) (Legal Obligation) where legally required.

Not all auction history is legally required. HugeTen does not claim that every bid record must be kept under a legal obligation.

Retention rules:

Non-completed bids: normally retained for 2 years after the auction ends, with longer retention only where justified by payment, refund, dispute, fraud, security, or legal-claim needs.
Completed financial records: retained according to applicable financial, accounting, and tax retention rules, including a 10-year retention period where required.

3.7 Data-Protection Rights Requests

Personal data needed to receive, verify, handle, and document applicable GDPR or other data-protection rights requests may be processed under Article 6(1)(c) where required to comply with a legal obligation. This includes confirming your identity, locating your data, and recording the actions taken in response to your request.

Section 4 — Third-Party Providers and Services

HugeTen uses a number of third-party services to operate the platform. This section explains which services are used, what personal data is involved, and the role each provider plays.

Some providers process personal data on HugeTen's behalf (for example, hosting data or delivering email). Others determine their own purposes for processing under their own terms and legal obligations — for example, a payment provider that must carry out fraud prevention or regulatory compliance independently. Where a provider has both types of activity, that is explained below.

4.1 Supabase

Supabase provides authentication, database, file/storage, and backend infrastructure for HugeTen.

Data involved: HugeTen Customer Data necessary to provide those services, including account credentials, profile information, business and creator data, transaction references, and uploaded files.
Role: Supabase processes Customer Data on behalf of HugeTen. Supabase may separately process its own account, billing, or service-usage information for its own purposes under its own terms.
Privacy policy: https://supabase.com/privacy

4.2 Stripe

Stripe is used for payments, payment-method setup, billing, Stripe Tax, and related payment services.

Data involved: name, email, billing address, payment information and payment-method references, tax/VAT information, and transaction information.
Role: HugeTen uses Stripe for payment-processing and tax-related services performed in connection with HugeTen transactions. Stripe may also process information for its own purposes and legal obligations, including fraud and security, regulatory compliance, KYC/AML where applicable, and Stripe account/service administration. Stripe's role therefore depends on the specific processing activity.
Privacy policy: https://stripe.com/privacy

4.3 Resend

Resend is used for transactional and service email delivery.

Data involved: recipient email address, message content, and information necessary to send service notifications.
Current implementation: HugeTen uses Resend for transactional email only. No marketing campaigns, open tracking, or click tracking are used.
Role: Resend processes transactional email data on behalf of HugeTen for delivery. Resend may separately process its own service or account information under its own terms.
Privacy policy: https://resend.com/legal/privacy-policy

4.4 Cloudflare Turnstile

Cloudflare Turnstile is used for bot detection, abuse prevention, and security on signup, login, and password-reset flows.

Data involved: browser, device, and network interaction information; IP-related technical information; and the Turnstile verification token.
Role: Turnstile is used for security. It is not used for advertising, marketing, profiling, or analytics. HugeTen does not use Turnstile as an analytics tool.
Privacy policy: https://www.cloudflare.com/privacypolicy/

4.5 Google Analytics (GA4)

Google Analytics is used for optional, non-essential website analytics.

Consent-gated loading: GA4 loads only after you grant analytics consent via the cookie consent banner. Analytics consent defaults to denied. If you reject or do not grant analytics consent, GA4 does not load.
Configuration: The current HugeTen configuration uses IP anonymization. Advertising storage is denied. Google Signals and advertising features are not used.
Role: Google may process analytics data under its own applicable terms and privacy policy. HugeTen does not control Google's processing of analytics data.
Privacy policy: https://policies.google.com/privacy

4.6 Google Maps Platform

Google Maps content may be displayed on public Business profiles.

Current implementation: The Maps iframe does not load automatically. The Maps Embed API key is not requested during initial profile loading. You must click “Load map” before any map content loads.
Data involved: Loading the map connects you to Google. Google may receive technical information such as your IP address and the map query (business address). This interaction is separate from GA4 analytics consent.
Page-local choice: Your choice to load the map is not stored by HugeTen in cookies, local storage, or the database.
Role: Google Maps Platform is not a HugeTen processor. Google determines its own processing purposes under its own terms.
Privacy policy: https://policies.google.com/privacy

4.7 YouTube / Google (Creator Social-Account Verification)

HugeTen uses YouTube API Services for Creator social-account verification.

How it works: When a Creator initiates YouTube verification, HugeTen requests the youtube.readonly scope via Google OAuth. HugeTen calls the YouTube Data API to obtain channel information.
Data accessed: channel ID, channel title, custom URL where available, subscriber count, and related channel/profile information.
Data stored by HugeTen: the relevant channel/profile information and subscriber count needed for Creator verification.
OAuth tokens: The OAuth access token is used transiently during verification and is not stored in HugeTen's database. No YouTube refresh token is stored under the current implementation.
Purpose: to verify that the Creator controls the connected YouTube channel and to evaluate Creator eligibility using relevant channel and audience information.
Role: Google controls the OAuth flow and YouTube API processing under its own terms. HugeTen receives the returned channel data but does not control Google's processing.
Google Privacy Policy: https://policies.google.com/privacy
Revocation: You can revoke HugeTen's access to your YouTube account through your Google Account permissions at https://myaccount.google.com/permissions. Revoking access stops future YouTube API requests on your behalf but does not automatically delete information that HugeTen must retain under another applicable legal basis or legal obligation.

4.8 Instagram / Meta (Creator Social-Account Verification)

Instagram is used for Creator social-account verification.

How it works: When a Creator initiates Instagram verification, HugeTen requests the instagram_business_basic scope via Meta OAuth. HugeTen calls the Instagram Graph API to obtain profile information.
Data obtained: Instagram user ID, username, follower count, and related profile information.
OAuth tokens: The OAuth access token is used transiently during verification and is not stored in HugeTen's database.
Purpose: to verify that the Creator controls the connected Instagram account and to evaluate Creator eligibility.
Role: Meta/Instagram controls the OAuth flow and API processing under its own applicable terms and privacy practices. HugeTen receives the returned profile data but does not control Meta's processing.
Privacy policy: https://www.facebook.com/privacy/policy/

4.9 TikTok (Creator Social-Account Verification)

TikTok is used for Creator social-account verification.

How it works: When a Creator initiates TikTok verification, HugeTen requests the user.info.basic and user.info.stats scopes via TikTok OAuth. HugeTen calls the TikTok user info API to obtain profile information.
Data obtained: TikTok open ID, display name, and follower count.
OAuth tokens: The OAuth access token is used transiently during verification and is not stored in HugeTen's database.
Purpose: to verify that the Creator controls the connected TikTok account and to evaluate Creator eligibility.
Role: TikTok controls the OAuth flow and API processing under its own applicable terms and privacy practices. HugeTen receives the returned profile data but does not control TikTok's processing.
Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea

4.10 Revoking Social-Account Authorization

Where a social provider supports revocation, you can revoke HugeTen's authorization through that provider's account or security settings:

YouTube / Google: https://myaccount.google.com/permissions
Instagram / Meta: You can manage authorized apps through your Meta account settings.
TikTok: You can manage authorized apps through your TikTok account settings.

Revoking access stops future API requests on your behalf. It does not automatically erase information that HugeTen must retain under another applicable legal basis or legal obligation.

Section 5 — International Data Transfers

HugeTen is established in Lithuania, within the European Economic Area (EEA). Some of the third-party service providers described in Section 4 may process personal data in countries outside Lithuania or outside the EEA. This section explains the safeguards that apply when that happens.

5.1 General Rule

Where personal data is transferred outside the EEA, HugeTen relies on applicable safeguards required by GDPR Chapter V, depending on the provider and the destination of the transfer.

These safeguards may include:

an adequacy decision adopted by the European Commission for the relevant country or territory;
the EU-U.S. Data Privacy Framework, where the relevant U.S.-based recipient is validly certified and the framework applies to the transfer;
European Commission Standard Contractual Clauses (SCCs);
other lawful transfer mechanisms or supplementary safeguards where required by applicable data-protection law.

Not every transfer uses the same mechanism. The applicable safeguard depends on the provider, the destination country, and the type of data involved. A provider's processing locations and transfer mechanisms may change over time; HugeTen will use applicable lawful safeguards and update this Privacy Policy where a material change requires it.

5.2 Supabase

Supabase and its sub-processors may process HugeTen Customer Data in applicable locations under its service and data-processing terms. Where a restricted international transfer requires safeguards, Supabase's applicable data-processing terms provide transfer mechanisms including European Commission Standard Contractual Clauses where applicable.

5.3 Stripe

Stripe may process payment, billing, tax, fraud/security, and related information internationally. Stripe's current data-transfer terms provide mechanisms including the EU-U.S. Data Privacy Framework where applicable, and European Commission Standard Contractual Clauses where the Data Privacy Framework or another appropriate mechanism does not apply.

5.4 Resend

Transactional-email information may be processed internationally by Resend and its applicable service providers. Resend's current data-processing terms provide safeguards including the EU-U.S. Data Privacy Framework where applicable, and Standard Contractual Clauses where required.

5.5 Cloudflare Turnstile

Technical and security information processed through Turnstile may be processed internationally. Cloudflare's current data-processing terms provide international-transfer safeguards including the Data Privacy Framework where applicable, and European Commission Standard Contractual Clauses for restricted transfers where required. Turnstile is a security and bot-protection service — not analytics or marketing.

5.6 Google Services

Google operates infrastructure internationally. Personal data processed through Google services may be processed outside the user's country. Google states that it uses applicable transfer mechanisms including European Commission adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, and Standard Contractual Clauses where required.

This covers the following Google services used by HugeTen:

Google Analytics (GA4): loads only after you grant analytics consent (see Section 3.4).
Google Maps Platform: does not load automatically; you must click “Load map” before external Google Maps content loads (see Section 3.5).
YouTube / Google OAuth and API Services: OAuth and API access occurs only when a Creator chooses to connect and verify their YouTube account (see Section 4.7).

5.7 Meta / Instagram

Creator verification through Meta/Instagram may involve international processing. Where required, the provider applies the transfer safeguards described in its applicable privacy and data-protection terms.

5.8 TikTok

Creator verification through TikTok may involve international processing. Where required, the provider applies the transfer safeguards described in its applicable privacy and data-protection terms.

5.9 Questions About International Transfers

If you would like more information about the safeguards applicable to international transfers of your personal data, you can contact HugeTen at hello@hugeten.com. HugeTen may not be able to share confidential commercial agreements, but will provide the applicable information it can disclose.

Section 6 — Data Retention

HugeTen retains personal data only for as long as necessary for the purposes described in this Privacy Policy, subject to applicable legal, accounting, and tax obligations.

6.1 Financial, Accounting, and Tax Records

Personal data necessary for invoices, accounting, VAT/tax, and financial records may be retained for up to 10 years from the relevant transaction where required by applicable Lithuanian law. Only information necessary for those purposes receives that retention treatment. After the applicable period, personal data is deleted or anonymized where no other lawful reason requires retention.

6.2 Account and Profile

Account and profile data is generally retained while the account/service relationship remains active and as necessary to provide HugeTen services or satisfy legal and contractual obligations.

6.3 Account Deletion

HugeTen currently handles account and data deletion requests manually through hello@hugeten.com. There is no automated Delete Account feature.

Before deletion or anonymization, HugeTen may need to resolve outstanding:

Crown ownership and placement.
Auctions and bids.
Payments and refunds.
Renewals and scheduled takeovers.
Disputes.
Contractual obligations.
Legal obligations.

After applicable obligations are resolved, profile and personal data that is no longer necessary is deleted or anonymized where appropriate.

6.4 Legal Acceptance Records

Records necessary to demonstrate acceptance of applicable Terms and Rules may be retained for up to 10 years after the end of the relevant contractual relationship or Crown transaction where reasonably necessary to establish, exercise, or defend legal claims. A different period may apply where required by a specific legal obligation, dispute, or claim.

6.5 Non-Completed Bids

Non-completed bids are normally retained for 2 years after the relevant auction ends. Longer retention may apply where necessary for payment or refund matters, disputes, fraud or security investigations, legal claims, or legal obligations.

6.6 Completed Financial Bids and Orders

Completed financial bid and order records follow applicable financial, accounting, and tax retention requirements, including the 10-year treatment where required.

6.7 Technical and Operational Records

HugeTen retains technical and operational records — including OAuth states, transactional email job records, expired City Board posts, rate-limit records, and storage objects — only for as long as reasonably necessary for their operational, security, contractual, or legal purpose, subject to applicable requirements.

Section 7 — Your GDPR Rights

Subject to applicable conditions and exceptions, you may have the following rights regarding your personal data:

Access: You may request information about the personal data HugeTen processes about you.
Rectification: You may request correction of inaccurate or incomplete personal data.
Erasure: You may request deletion of your personal data where applicable.
Restriction of processing: You may request that HugeTen restrict processing of your personal data in certain circumstances.
Objection to processing: You may object to processing based on legitimate interests or carried out for direct marketing.
Data portability: Where applicable, you may receive your personal data in a structured, commonly used, and machine-readable format or request its transmission to another controller.
Withdrawal of consent: Where processing is based on your consent (such as GA4 analytics), you may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Requests may be sent to hello@hugeten.com. HugeTen may need to verify your identity before acting on a request.

7.1 Complaint to a Supervisory Authority

If you believe that HugeTen has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the relevant supervisory authority.

The relevant Lithuanian supervisory authority is:

Valstybinė duomenų apsaugos inspekcija (VDAI)
State Data Protection Inspectorate of Lithuania

Section 8 — Security

HugeTen uses reasonable technical and organizational measures designed to protect personal data. These measures include authentication and access controls, security checks, bot and abuse protection, payment processing through specialized providers, and appropriate technical safeguards.

No system can guarantee absolute security. HugeTen does not guarantee that personal data will never be subject to unauthorized access, loss, or alteration.

Section 9 — Age and Children

HugeTen is intended for persons aged 18 or older for account creation and paid or transactional participation. Users must confirm during signup that they are at least 18 years old.

HugeTen does not currently perform identity-based age verification. The 18+ confirmation is an eligibility requirement and is not GDPR consent.

HugeTen does not intentionally offer accounts or paid Crown participation to children.

Section 10 — Automated Decision-Making and Profiling

HugeTen has not identified processing that constitutes solely automated decision-making producing legal or similarly significant effects within the meaning of GDPR Article 22.

Auction mechanics — such as bid validation, winner determination, and payment settlement — are part of the contractual service you request. They are not solely automated decisions producing legal effects on individuals under Article 22.

Section 11 — Cookies and Similar Technologies

HugeTen uses essential and optional technologies, including cookies and similar technologies. Additional information is provided in the HugeTen Cookie Policy.

The following points are consistent with this Privacy Policy:

GA4 is non-essential and loads only after you grant analytics consent.
Google Maps external content loads only after you click “Load map.”
Cloudflare Turnstile is used for security and bot protection.

Section 12 — Changes to This Privacy Policy

HugeTen may update this Privacy Policy when its services, processing activities, or legal requirements change. Material updates are reflected by updating the last-updated date shown above and, where appropriate, providing additional notice.

Continued use of HugeTen after a Privacy Policy update does not by itself constitute GDPR consent to any new or changed processing that requires consent.