Privacy Policy

Who we are

Sponaro is operated by Origin Collective Limited (company no. 16566341), 124-128 City Road, London, England, EC1V 2NX (ICO registration number: ZC240259), a private limited company registered in England and Wales.

For the purposes of this Privacy Policy, references to "Sponaro", "we", "us" and "our" refer to Origin Collective Limited where legally appropriate.

Information we process

The deal, brand, deliverable and payment records are content you choose to enter. Please avoid entering sensitive personal data about third parties beyond what you need for business contact purposes.

• Account information: your email address, name if provided, and profile settings such as your preferred currency, language and timezone.
• Authentication data: sign-in credentials handled by our authentication provider, session tokens, and identifiers returned by Google sign-in if you use it.
• Deal and brand data you enter: brand names, contact names and emails, websites, deal values, statuses, notes and follow-ups.
• Deliverables: the content items, descriptions and due dates you record for each deal.
• Payment tracking information: invoice dates, payment terms, amounts, due dates and paid dates that you enter to keep track of what you are owed.
• Subscription information: your plan, subscription status, renewal dates and billing identifiers returned by our payment processor.
• Notification preferences: your reminder settings and timezone, plus a log of reminders already sent so we do not repeat them.
• Marketing consent: whether you have switched on product and offer emails, and when you last changed that preference.
• Contact-form messages: your name, email address, category, the content of your message and any files you attach.
• Affiliate applications: your name, email address, platform links, approximate audience size, niche, promotion plan, application status and consent record.

How we use this information

We do not sell your data, and we do not use the deal information you enter to advertise to you.

• To provide the dashboard, pipeline, analytics and export features of the service.
• To authenticate you and keep your account secure.
• To send reminders and notifications you have enabled about follow-ups, deliverables and payments.
• To manage subscriptions, billing and plan entitlements.
• To respond to support requests.
• To review, contact you about and administer affiliate-program applications.
• To detect, prevent and troubleshoot technical problems and abuse.

Legal basis for processing

Under the UK GDPR and the EU GDPR, every use of your data rests on one of these legal bases:

• Contract (Article 6(1)(b)): account details, authentication, the deal, brand, deliverable and payment-tracking records you enter, the reminders and notifications you switch on, and managing your subscription and plan entitlements — all of this is necessary to provide the service to you.
• Legitimate interests (Article 6(1)(f)): security, abuse and fraud prevention, troubleshooting, operational logs, and anonymous usage measurement so we can run and improve the service. You can object to this processing (see "Your rights").
• Consent (Article 6(1)(a)): product and offer emails. These are off by default and are only sent if you switch them on; you can withdraw consent at any time in Settings.
• Legal obligation (Article 6(1)(c)): billing, invoice and tax records we are required to keep under UK law.
• Support: contact-form messages and attachments are handled to perform our contract with you where the enquiry concerns your account, and otherwise on our legitimate interest in answering enquiries we receive.
• Affiliate applications: we process the information you submit with your consent to assess and administer your application. You may withdraw that consent by contacting us, without affecting earlier processing.

International data transfers

Sponaro is operated from the United Kingdom. Our providers — Supabase (database, storage and authentication), Stripe (payments), our hosting and platform provider running on Cloudflare infrastructure, and our transactional email provider — may process data outside the UK and the European Economic Area, in particular in the United States.

For UK users, those transfers are covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. For users in Spain, Germany and the rest of the EEA, we rely on the EU Standard Contractual Clauses (SCCs), together with an adequacy decision where one applies to the provider, and additional technical measures such as encryption in transit and at rest.

If you ask us at privacy@origincollective.group, we will tell you which safeguard applies to a specific provider.

Service providers

We rely on a small number of processors to run the service:

• Supabase — database, file storage and authentication infrastructure where your account and deal data is stored.
• Stripe — subscription billing and payment processing.
• Transactional email delivery — used to send reminder and account emails you have enabled.
• Hosting and platform infrastructure — used to serve the application and store operational logs.

Cookies and analytics

To understand how many people visit the site and which pages and buttons they use, we record anonymous usage events: the page path, the referring website's domain, and whether a call-to-action was clicked. Each event is stored with a one-way fingerprint derived from your IP address and browser type together with a secret key and the current date. That fingerprint changes every day, cannot be reversed, and is never linked to your account, name or email. We do not store your IP address itself.

Because this measurement is anonymous, strictly limited to running and improving our own site, and does not store or read any information on your device, it does not require cookie consent under the ePrivacy rules or the GDPR.

When you are signed in, the service stores a small number of strictly necessary items in your browser (sign-in session and preferences such as language and currency). These are required for the app to work and are not used for advertising or profiling.

Payments and card details

Subscription payments are handled by Stripe. Card numbers and other payment credentials are entered directly into Stripe's checkout and are not stored by Sponaro. We receive only limited billing metadata such as your subscription status, plan, renewal date and customer identifier.

Data retention

• Account and profile data: kept while your account is active; deleted when you delete your account.
• Deal, brand and deliverable records: kept while your account is active; deleted when you delete your account, including deals locked by a lapsed Pro plan.
• Payment-tracking fields you enter (invoice and paid dates): kept while your account is active; deleted with your account.
• Contact-form messages and attachments: kept for up to 24 months after the enquiry is closed; if you delete your account, messages sent from your email address are deleted with it immediately.
• Affiliate applications: kept for up to 24 months after the application is decided or the affiliate relationship ends, then deleted unless a legal obligation requires longer retention.
• Reminder logs and in-app notifications: kept for up to 12 months, then cleared; deleted immediately if you delete your account.
• Anonymous usage events (measurement): kept for up to 24 months in aggregate; they contain no account identifier.
• Billing and invoice records: kept for 6 years from the end of the relevant financial year, as required by UK tax law (HMRC). These records are retained even after you delete your account.

Security

Data is stored with row-level access rules so that each account can only read and write its own records, transmitted over encrypted connections, and access to production systems is limited. No online service can be guaranteed completely secure, so we do not claim that — we do commit to addressing security issues promptly when they are reported.

Deleting your account

You can delete individual deals and brands at any time from within the app, including plan-locked deals. You can also delete your entire account and its data from Settings.

Your rights

Under the UK GDPR and the EU GDPR you have the following rights:

• Access: obtain a copy of the personal data we process about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted (you can do this yourself at any time from Settings).
• Portability: receive your data in a structured, machine-readable format — the "Download my data" option in Settings is free for every account.
• Restriction of processing: ask us to limit how we process your data in certain circumstances.
• Objection: object to processing based on our legitimate interests, including our usage measurement.
• Withdrawal of consent: withdraw consent you have given (for example for product and offer emails) at any time, without affecting processing carried out before the withdrawal.

Making a request and complaints

Requests can be sent to privacy@origincollective.group. We respond within one month of receiving a request; in exceptional cases we may extend this by a further two months and will tell you within the first month. Exercising these rights is free and is not conditional on holding a paid subscription.

You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ICO, ico.org.uk); in Spain, the Agencia Española de Protección de Datos (AEPD, aepd.es); in Germany, the data protection authority of your federal state or the Federal Commissioner for Data Protection and Freedom of Information (BfDI); in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD, gov.br/anpd).

If you are in Brazil, the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) applies to you. The rights described above — confirmation and access, correction, deletion, portability, information about the parties we share data with, and withdrawal of consent — are available to you in the same way and through the same contact address, and the same self-service export and account deletion options in Settings apply.

Minimum age (16)

Sponaro is built for adults and older teenagers working with brands professionally. The service is not intended for anyone under 16, and we do not knowingly collect their data. You must confirm that you are 16 or older when you create an account.

If we identify an account held by someone under 16, we will close it and delete its data. To report such an account, email privacy@origincollective.group; we will review the report and delete the data once it is confirmed.

Contact

Privacy questions and data subject requests can be sent to privacy@origincollective.group.

Legal operator and data controller: Origin Collective Limited (company no. 16566341), 124-128 City Road, London, England, EC1V 2NX (ICO registration number: ZC240259).

Changes to this policy

We may update this policy as the product changes. When we make material changes we will update the date at the top of this page and, where appropriate, notify you in the app.