Privacy Policy

1. Introduction & Overview

StayTop.live is a paid promotional visibility and leaderboard placement platform operated by [LEGAL ENTITY NAME / OPERATOR] ("StayTop", "Company", "we", "us", or "our"). StayTop enables individuals, creators, organizations, and brands to create public promotional visibility listings and contribute promotional amounts to determine real-time ranking positions on a public leaderboard.

We operate under a Data Minimization Architecture. StayTop does not require mandatory account registration, login credentials, or passwords for basic browsing, promotion creation, or public promotional support. We collect only the data strictly necessary to display public promotional rankings, verify payment authenticity via authorized gateways, and preserve platform integrity.

2. Scope of this Policy

This Privacy Policy applies to all users, visitors, sponsors, and participants who access or interact with:

• The StayTop website located at https://staytop.live and its related subdomains.
• Our public ranking APIs, discovery feeds, and real-time leaderboard webhooks.
• Payment checkout flows initiated on StayTop via authorized payment gateway partners.

This policy does not apply to third-party platforms, social networks, or external websites linked to or promoted on StayTop. We encourage you to review the privacy notices of any third-party websites you visit.

3. Information We Collect

We collect information strictly through voluntary user submission, automated transaction verification, and essential security logging:

4. Information We Do Not Collect or Store

5. How We Use Information

We use collected data solely for legitimate operational, security, and verification purposes:

• Rankings & Public Leaderboard: Calculating and publishing live cumulative ranking totals and spot positions.
• Cryptographic Payment Verification: Validating Razorpay cryptographic signatures server-side before activating a spot or incrementing rank.
• Traffic Metrics: Accurately incrementing public click/visit counts for listed spots.
• Security & Abuse Mitigation: Enforcing API rate limits, mitigating automated bot attacks, and preventing fraudulent ranking manipulation.
• Content Moderation: Reviewing and actioning user reports regarding prohibited, defamatory, or abusive listings.
• Statutory Compliance: Complying with applicable legal obligations under the Information Technology Act, 2000, and Indian tax/accounting guidelines.

6. Publicly Displayed Information

7. Payment & Razorpay Processing

StayTop integrates with Razorpay (Razorpay Software Private Limited), an RBI-authorized Payment Aggregator in India. When you make a contribution:

• Your payment request is communicated directly to Razorpay over TLS 1.3 encrypted channels.
• Razorpay collects transaction data according to its own privacy policy available at razorpay.com/privacy .
• Upon successful transaction, Razorpay returns a cryptographic signature payload (razorpay_order_id, razorpay_payment_id, razorpay_signature).
• Our servers verify the signature using HMAC SHA-256 before updating the database.

8. Third-Party Services & Infrastructure

StayTop utilizes trusted enterprise cloud and infrastructure providers to operate the service:

9. Data Sharing & Non-Sale Policy

We do NOT sell personal data: StayTop has never sold, rented, leased, or traded user data, transaction records, or visitor metrics to third-party advertisers, data brokers, or marketing syndicates, and will never do so.

We may disclose information only in the following strictly limited circumstances:

• With Essential Service Providers: Technical vendors assisting with cloud database hosting and payment gateway operations under strict confidentiality obligations.
• Legal & Regulatory Authorities: When required by Indian law, valid court orders, subpoenas, or statutory authorities (e.g., CERT-In or law enforcement investigations).
• Fraud & Security Protection: To protect the rights, property, and safety of StayTop, our users, or the public against financial fraud or cyberattacks.

10. Data Retention

We retain information only as long as reasonably necessary to fulfill the purposes described in this policy:

• Public Spots & Rankings: Retained in active database records to maintain continuous ranking history until removed or modified through moderation or verified user request.
• Payment & Transaction Records: Retained in accordance with Indian tax, accounting, and financial reporting statutory requirements (typically up to 8 financial years).
• Security & Access Logs: Ephemeral server logs and rate-limiting IP counters are routinely rotated and purged on automated cycles.

11. Technical & Data Security

We implement industry-standard organizational and technical security measures:

• Encryption in Transit: 100% of website traffic is enforced over HTTPS with TLS 1.3 encryption.
• Cryptographic Verification: All ranking modifications require verified HMAC SHA-256 signature matching before database execution.
• Access Control: Database administrative access is strictly isolated using Supabase Service Role credentials and environment variable isolation.
• Rate Limiting: In-memory and edge token bucket rate limiting to prevent brute-force attacks and abuse.

Please note: While we implement robust safeguards, no internet transmission or electronic storage method can guarantee 100% absolute invulnerability.

12. Your Rights & Choices

In accordance with applicable Indian data protection principles (including the Digital Personal Data Protection Act, 2023), you have the right to:

• Review & Access: Inquire about public listing data associated with your identity.
• Correction & Update: Request correction of inaccurate, outdated, or misleading spot descriptions or destination URLs.
• Takedown / Deletion: Request removal of a spot that infringes upon your copyright, trademark, privacy, or personal rights via our report or grievance mechanism.
• Anonymity: Choose "Anonymous" when sponsoring a spot to prevent your name from appearing on the public activity feed.

13. Age Restrictions & Minors

StayTop.live is intended for individuals who have reached the age of majority (18 years of age in India) or who possess legal parental/guardian consent to enter into binding financial transactions. We do not knowingly collect personal information from children under 18 years of age. If we discover that an unauthorized minor has submitted personal information, we will promptly delete such records.

14. Hosting & Cloud Infrastructure

Our primary database and serverless functions operate within secure enterprise cloud facilities. By using StayTop.live, you acknowledge that your information may be processed on cloud infrastructure hosted across compliant data centers subject to standard data protection agreements.

15. Updates to this Policy

We may periodically revise this Privacy Policy to reflect technical updates, legal developments, or adjustments in our services. Any changes will be posted directly to this page with an updated "Last updated" date. Continued use of StayTop following notice of revisions constitutes your acceptance of the updated policy.