Privacy Policy

Last updated: August 22, 2026 · version 2026-08-22

This policy explains what personal data THE BEST processes when you use THE BEST, why, and what you can do about it. Short version: there are no accounts, no cookies, no analytics and no advertising, and we never see your card number.

1. Who is responsible

The controller of your personal data is THE BEST, España. For any privacy question or request, write to info@thebestcountry.lol.

2. What we process

Purchase data. The country you chose, how many Points, the amount, the timestamp, a payment reference from our payment provider, the version of the Terms you accepted, the language you accepted them in, and — only if you type them — a nickname and a public message.

Network data. Your IP address reaches our server, as it does with any website. We do not store it in the clear. We store a truncated SHA-256 hash of your IP combined with a secret salt, and we use it for exactly three things: rate limiting; making sure the same visitor cannot report the same message twice; and, attached to a purchase, as part of the record that you accepted the Terms. We treat that hash as personal data: it is pseudonymous, not anonymous. Anyone holding the salt could link a hash back to an IP address, so we protect it as if it were one.

Payment data. Card details go directly to our payment provider and never touch our servers. We receive only a transaction reference and its status.

Server logs. Errors are logged without request bodies. We do not keep an access log tied to identifiable visitors.

3. What we do not do

• No cookies are set by this site.
• No analytics, no pixels, no fingerprinting, no advertising, no third-party trackers, no social plugins.
• No user accounts, no passwords, no email lists, no newsletters.
• We do not sell, rent or share personal data, and we do not profile you or take automated decisions with legal effects about you.

Your browser’s local storage holds two things: the interface language you picked, and whether you dismissed the introductory box. Both are set only because you interacted with the site, both stay on your device, and neither is ever sent to us. Under the ePrivacy rules these are user-preference storage, so no consent banner is required.

4. Why we process it, and on what legal basis

• To deliver the Points you bought and keep the ranking correct — necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• To publish your nickname and message, if you chose to submit them — performance of the contract, at your request (Art. 6(1)(b)).
• To prevent abuse, spam, fraud and payment reversals, and to keep the service running — our legitimate interest in a service that is not overrun (Art. 6(1)(f)).
• To keep proof of the Terms you accepted and of your consent to immediate delivery — our legitimate interest in defending a chargeback, and a legal obligation where consumer law requires it (Art. 6(1)(f) and 6(1)(c)).
• To keep accounting and tax records — legal obligation (Art. 6(1)(c)).

5. What is public

The ranking, the number of supporters, the amounts raised per country, and any nickname and message you submit are public. They are visible to anyone, can be indexed by search engines, and can be copied by third parties beyond our control. Do not write anything in those fields that you would not want public forever.

6. How long we keep it

• Ranking and season results: for as long as the service exists. The historical table is the product — deleting it would delete the service.
• Nicknames and messages: until the message is removed, hidden by reports, or you ask us to delete it.
• IP hashes used for rate limiting: no more than 30 days.
• IP hashes used to deduplicate reports: for the season in which the report was made.
• Purchase and consent records, including the IP hash attached to them: as long as required by tax, accounting and consumer law in España, and to defend a payment dispute — normally between five and ten years.

7. Who else sees it

Our hosting provider, which stores the data on our behalf, and our payment provider, which processes the payment as an independent controller under its own privacy policy. Both are bound by contract or by law. We also disclose data where we are legally required to — a court order, a lawful request from an authority — and we push back on requests that are not.

8. International transfers

Our providers may process data outside your country. Where data leaves the European Economic Area or the United Kingdom, transfers rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures. Write to info@thebestcountry.lol for details of the safeguards in place.

9. Your rights

Depending on where you live you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw consent, and complain to a supervisory authority. To exercise any of them, write to info@thebestcountry.lol quoting your order reference — the code beginning with TB- shown on screen when your purchase completes, and repeated on the receipt from our payment provider.

One honest limitation: we deliberately hold almost nothing that identifies you. Without that reference we usually cannot tell which purchase is yours, and we will not ask you for extra identity documents just to run a search. That is a consequence of collecting as little as possible, not an excuse to avoid the request.

On erasure specifically: we can delete a nickname and a message on request, and we do. We cannot delete the Points themselves from the ranking — the season standing and the all-time table are the service, and removing an anonymous number from a public aggregate would not make you any less identifiable, because it never identified you in the first place.

If you are in the European Economic Area or the United Kingdom you may complain to your national data protection authority. If you are in Brazil, the LGPD gives you equivalent rights and you may contact the ANPD. If you are in California, we confirm that we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information.

10. Children

The service is not intended for anyone under 18 and we do not knowingly process children’s data. If you believe a child has submitted data, write to info@thebestcountry.lol and we will delete it.

11. Security

Traffic is served over HTTPS with strict transport security. The site runs a Content Security Policy that blocks third-party scripts. Administrative endpoints require a secret token compared in constant time, and destructive operations are disabled in production. IP addresses are hashed with a secret salt before storage. No system is perfectly secure, but we collect little enough that a breach would expose little.

12. Changes

If we change this policy we will update the date at the top and, for material changes, announce it on the site. Last updated: August 22, 2026.