1. Information we collect

Information you give us

• Account details: name, email address, password (stored only in encrypted, hashed form), account type, and profile details you choose to add, such as photo, banner, bio, tagline, website, phone number and address.
• Financial records you enter or import: platform income, brand deals, invoice numbers and dates, payment dates, commission rates and your tax reserve rate.
• Roster and team details: invitations you send or accept, commission rates, and the emails of people you invite to your team.
• Discovery details: if you choose to be discoverable, your niche and, if you allow it, your location and audience figures.
• Communications: messages you send us.

Payment information
Stripe processes all payments and stores your card. We receive confirmation of payments and limited details such as card brand, the last four digits and billing country. We never see or store full card numbers.

Information from accounts you connect
SponsoFlow only reads the information below, only after you connect an account, and refreshes it daily while the account stays connected. It never posts or makes changes on any platform.

The access keys platforms give us are stored encrypted and used only to read this information.

Google sign-in
If you sign in with Google, we receive your name, email address and basic profile information to create and manage your account.

Information collected automatically

• Usage and log data: pages viewed, features used, IP address, browser and device type, and timestamps, used to run and secure the Service.
• Last-active date: when you last used the dashboard, used to measure engagement.
• Cookies and analytics: see section 6.

2. Google and YouTube data

SponsoFlow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google and YouTube data only to show it in your dashboard and, if you allow, to the managers or agencies you approve. We do not use it for advertising, do not sell it, and do not let people read it except where needed for security, to comply with the law, or with your consent. SponsoFlow uses YouTube API Services, and Google’s Privacy Policy (https://policies.google.com/privacy) applies. You can remove SponsoFlow’s access at any time at https://myaccount.google.com/permissions.

3. How we use information, and our legal bases

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal information or use your financial data for advertising.

4. Who we share information with

• Managers and agencies you accept: they, and the Team Members on their account, can view your revenue, brand deals, invoices, tax estimates and connected platforms, and export reports about them. They cannot change your data. You can end their access at any time on your Profile page.
• Creators you invite: if you are a Manager or Agency, the creators you invite see your business profile (name, logo, tagline, website, description and roster totals).
• Discovery: if you are a Creator and turn on discovery, managers and agencies can find your name, niche and the details you choose to show. Your financial data is never shown through discovery.
• Service providers who process data for us under contract and only on our instructions: our hosting provider, our email delivery provider, Stripe (payments), Google (sign-in, YouTube and, with your consent, Google Analytics 4 through Google Tag Manager) and Microsoft (Clarity analytics, with your consent).
• Platforms you connect: when you connect an account, that platform knows SponsoFlow has been authorized and handles your sign-in under its own privacy policy.
• Authorities, where the law requires it, and professional advisers under a duty of confidentiality.
• A buyer or successor of our business, if SponsoFlow is sold or reorganized, who must protect your data under this policy.

5. International transfers

Some of our providers process data outside the European Economic Area, for example in the United States. Where we transfer personal data outside the EEA, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses.

6. Cookies and analytics

We use essential cookies to keep you signed in and protect your account. With your consent, given through our cookie banner, we use Google Analytics 4 and Microsoft Clarity, loaded through Google Tag Manager, on our website and in the dashboard, to understand how they are used. Clarity hides all page text in its recordings, and these tools never collect your financial figures. You can change your choice at any time. See our Cookie Policy for details.

7. How long we keep information

8. Security

We protect your data with password hashing, encrypted connections (HTTPS), encrypted storage of platform access keys, private storage of exported reports that only you can download, limits on sign-in attempts and access controls for our team. No online service can be completely secure. If a breach affecting your personal data occurs, we will notify you and the authorities as the law requires.

9. Your rights

Depending on where you live, including under GDPR and California law, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data, which you can also do yourself in Settings, under Security;
• receive a portable copy of your data, which you can also export yourself from Reports;
• object to or restrict certain processing;
• withdraw consent at any time, without affecting processing done before; and
• lodge a complaint with a data protection authority, such as the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy), or the authority where you live.

To exercise these rights, email [email protected]. We will respond within one month, or as the law otherwise requires, and may need to verify your identity first.

10. Removing SponsoFlow’s access to your accounts

You can disconnect any account on SponsoFlow’s Connected Platforms page. You can also remove access in the platform’s own settings:

• Google and YouTube: https://myaccount.google.com/permissions
• TikTok: Settings and privacy, then Security, then Apps and services permissions
• Instagram: Settings, then Apps and websites
• Facebook: Settings, then Business integrations or Apps and websites
• Twitch: Settings, then Connections
• X: Settings, then Security and account access, then Apps and sessions, then Connected apps

To have data from a connected platform deleted from SponsoFlow, disconnect it, or email [email protected].

11. Children

SponsoFlow is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a minor has given us personal information, contact [email protected] and we will delete it.

12. Changes to this policy

We may update this Privacy Policy. For material changes, we will update the “Last updated” date and notify you by email or in the Service before they take effect.

13. Contact us

SPONSOFLOW LIMITED
Company No: HE 497776
Registered office: 59 Nikou Pattichi, Ground Floor, 3070, Limassol, Cyprus.
Phone no: +357 23010338
Email: [email protected]
General support: [email protected]