Privacy & cookies

Updated 11 November 2026 · Version 2026-11-11-v4

Who is responsible

The OneUp operator identified above is responsible for the personal information used to run this service. Use the contact email above for privacy requests, listing corrections or complaints. Paid listings remain closed until the contracting operator’s details are confirmed.

What we collect and why

Listing information includes your submitted name, profile or startup name, introduction, category, links, bid amount and publication date. These details are intended to be public after payment, including to search engines and visitors worldwide. Do not include anything you do not want published. We process this information to provide the listing you request.

We also retain checkout and payment references, amount and status, refunds or disputes, and the terms version and submission time associated with your agreement. We receive your checkout email address from Stripe and store it with your order records to send and retry your OneUp purchase confirmation and handle order queries. The current form requires separate agreement to immediate publication. This supports performance of the contract, recordkeeping and legitimate interests in preventing fraud and resolving disputes. Stripe collects payment, billing and receipt information under its privacy policy. Full card numbers do not reach our application.

Support emails and any evidence you send are used to answer requests, resolve complaints and protect legal rights. Short-lived hashes derived from network addresses limit abuse; our application does not store raw IP addresses in its statistics database. Hosting providers may separately process IP addresses and technical logs for delivery and security.

Live board updates and count

When you open the homepage, leaderboard or how-it-works page, a connection supplies the current board and live updates. “Live now” counts the open connections delivering those updates. The server holds only temporary connection handles for this count and removes them when a connection closes or is detected as lost. We do not create a visitor cookie, persistent identifier, device fingerprint or browsing history for the live count, or use IP addresses to identify or deduplicate viewers.

Multiple open tabs and automated connections may count separately. A disconnected device can remain counted briefly until the server detects that the connection has ended. This is a count of connected pages, not unique people or guaranteed advertising reach. The adjacent listing count is the number of public paid listings on the board. Hosting providers may still process connection information and security logs as described above.

Optional click analytics

Click counting is off unless you allow it in “Analytics preferences” below any page. The oneup_analytics cookie remembers your choice for 90 days. This preference cookie is necessary to honour your choice. If allowed, following a listing link adds to its aggregate click total. We do not attach a visitor identifier, name or payment details to these click totals. The live board and live count work regardless of this choice.

Do Not Track and Global Privacy Control signals stop optional click collection. Choose “Analytics preferences” and “No thanks” to withdraw consent; future click counting stops. Withdrawal does not undo previous lawful processing. There are no advertising tracking pixels in our application.

The previous optional audience counter used a oneup_visitor cookie and stored a hash with first and last activity times. We no longer create or update that visitor history or show its total as a current audience count. Existing visitor cookies are expired when our application receives them. Previously collected records remain subject to the retention and request arrangements below.

Website icons

We use the website domain in a listing to look up its public favicon through Google. OneUp fetches and caches these images on the server; visitors load them from OneUp. We do not send your email address, payment details or visitor cookies with favicon requests. If an icon is unavailable, we display the listing’s initials.

Providers and international access

Our hosting and database providers process data to deliver and secure the service; Stripe processes payments. Hosting and database storage: Contabo (European Union). Listing, payment-reference, aggregate click totals and historical audience records are stored in a database on the hosting account. Live connection counts are held temporarily in server memory and are not saved as visitor records. Stripe processes payments and any payment receipts it sends. Authorised support staff may access records where necessary. We do not sell personal information. Public listing information is accessible internationally; private records may also be processed outside your country. Where required, we use applicable contractual or other lawful safeguards for transfers.

Retention and your choices

Public listing content remains for the purchased period and may continue afterwards until removed. Ask us to remove or correct it. Transaction and agreement records are kept for as long as necessary for accounting, legal obligations and disputes; where UK company accounting requirements apply, this is normally six years after the relevant accounting year. Records required for those purposes may be retained after public removal. Historical visitor hashes and timestamps collected under the previous optional audience counter remain in the dataset until removed on request or through a retention change; they are not attached to names or listings. No new visitor history is added. Live connection handles last only while the server retains the open connection. Temporary abuse-prevention records expire after their protection window and are cleared during routine requests. Hosting backups and security logs follow the provider’s retention arrangements.

Depending on your location and applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw optional analytics consent without affecting your ability to use or buy a listing. We may verify a request and explain any lawful reason we cannot fully comply. You may complain to your local data protection authority; in the UK this is the Information Commissioner’s Office.

Updates and children

OneUp is intended for adults aged 18 or over. Do not submit children’s information. If you believe a listing contains it, contact us for review. We will update this notice when our processing changes and seek fresh consent where necessary.

You can save or print this page using your browser. Keep the version applicable to your purchase.