Privacy

Last updated 29 August 2026

The short version

No advertising, no profiling, no data sold to anyone. Visits are counted without identifying you, by two analytics products, one of which sets a cookie to know you have been here before. If you bid, I keep your email, your brand and your bid, nothing else, and your card number never touches this site.

Who I am

This site is run by Jordan Garcia, acting as SAH GOOD GROUP, a company established in Florida, United States. SAH GOOD GROUP is the party responsible for the information described here. Write to contact@sahgoodgroup.com about anything on this page.

What is collected when you bid

• Your email address: so I can reach you about your bid, the artwork and the outcome.
• Your brand name and an optional link: published on this page if your bid is approved.
• The logo file you send: used to cut the sticker and to render it on the site.
• Your bid amount and the time it was placed.
• A payment reference from Stripe: an identifier for the hold on your card, nothing more.
• A random identifier in your browser: so a reload is not counted as a second visitor.

Card numbers are entered into Stripe's own fields and are never sent to, seen by or stored on this site. There is no account to create and no password to keep.

What is public and what is not

Public: your brand name, your link, your logo, your bid amount and when it was placed, but only once the bid has been approved. Nothing unapproved appears anywhere on the site.

Never public: your email address, your payment reference, and any bid that was refused or withdrawn.

Cookies and analytics

Page views are counted twice over, by two products doing the same small job: Umami and DataFast. Between them they record the page you are on, where you came from and a coarse country. Neither is told your name, your email or anything you type into the bid form, and neither follows you to another site.

DataFast sets a cookie to recognise a returning visitor, so two visits a week apart are counted as one person rather than two. It is used for nothing else. Umami sets none at all. If you would rather neither ran, any content blocker stops both and the site works exactly the same without them.

One thing is counted without any script at all: when a crawler that reads pages for an AI model asks for something here, the request is noted at the edge, with the address it asked for and the name the crawler gave itself. That is a robot, not a person, and nothing about an ordinary visit is recorded this way.

The visitor count shown above the headline is a separate, plain server-side tally: your browser keeps a random identifier in local storage so a reload is not counted twice, and that identifier is all that is stored against it. No address, no fingerprint, nothing that identifies you.

Who processes your data

• Vercel: hosts the site and runs the API. Sees requests, including IP addresses, as any host does.
• Neon: the Postgres database behind the auction, where bids and sponsors are stored.
• Vercel Blob: stores the logo files. Uploaded artwork is public by design.
• Stripe: takes the card details and holds the deposit. Their privacy policy governs that data.
• Resend: sends the emails about your bid.
• Umami: the cookieless page-view count described above.
• DataFast: the second page-view count, the one that sets a cookie, and the record of which AI crawlers read the site.

Nothing is sold, rented or shared with anyone else, for any purpose.

How long it is kept

• Losing and refused bids: deleted once the auction closes.
• Winning sponsors: kept while the sticker is on the machine, so I can reach you about it.
• Logo files: kept for the same period, then deleted.
• Payment records: kept as long as tax and accounting rules require, which is longer than the rest.
• The visit tally: a random identifier and a timestamp, with nothing attached to it.

Your rights

Email contact@sahgoodgroup.com to see what is held about you, to have it corrected, or to have it deleted. I answer within 30 days. Withdraw a bid before the auction closes and the hold is released and the record removed.

Bidding from the EU or the UK: the lawful basis is the contract you are entering into by bidding, and you keep your rights of access, correction, deletion, portability and objection under the GDPR. Bidding from California or another US state with a privacy statute: the same requests are honoured, and nothing here is ever sold or shared for cross-context advertising.

Changes

If this policy changes in a way that affects a bid you have placed, you will get an email about it. Otherwise the date at the top is the record of when it last changed.