Privacy Policy

1. Information We Collect

We collect information that you provide directly to us, as well as information generated through your use of our services:

• Account information: email address and language preference, collected during passwordless authentication via Supabase Auth.
• Event data: event names, descriptions, target audiences, and other details you provide when creating events for sponsor matching.
• Usage data: search queries, sponsor interactions (saves, dismissals, status changes), and credit consumption.
• Technical data: browser type, IP address, device information, and access times collected automatically through server logs.

2. How We Use Your Information

We use the information we collect for the following purposes, each with its corresponding legal basis:

• Provide, maintain, and improve our AI-powered sponsor matching services. Legal basis: contractual performance (Art. 6(1)(b) GDPR).
• Personalize search results based on your event profiles and interaction history. Legal basis: contractual performance (Art. 6(1)(b) GDPR).
• Process your requests, including generating embeddings for semantic search. Legal basis: contractual performance (Art. 6(1)(b) GDPR).
• Communicate with you about your account, usage, and service updates. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Analyze usage patterns to improve our matching algorithms and user experience. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Detect, prevent, and address technical issues and security threats. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

3. Data Processors and Third-Party Services

We share personal data only with the following providers, all of which have a Data Processing Agreement (DPA) and international transfer safeguards in place:

• Supabase (database and authentication): stores your email as an account identifier and application data. Location: USA. DPA and Standard Contractual Clauses (SCCs) in place.
• Stripe (payments): processes your email and payment data to manage credit purchases. Payment data is managed entirely by Stripe (PCI DSS). Location: USA. DPA and SCCs in place.
• Apollo.io (professional contacts): provides contact data of decision-makers at sponsor companies (names, job titles, corporate emails). This data is sourced from Apollo.io's publicly compiled business database. Location: USA. DPA and SCCs in place.
• OpenAI (artificial intelligence): receives event descriptions and professional contact data to generate semantic embeddings, match explanations, and personalized outreach emails. Data is not stored by OpenAI (zero data retention for API usage). Location: USA. DPA and SCCs in place.
• Google Gemini (artificial intelligence): receives names and professional contact data for sponsor enrichment and web-based discovery. Data is not stored by Google (zero data retention for API usage). Location: USA. DPA and SCCs in place.
• We do not share personal data with any other provider. Sentry (error monitoring) does not receive personal data after the sanitization implemented.

If your professional contact data appears on our platform through Apollo.io or other public sources, you can learn how we process it and exercise your rights on our B2B contact data information page.

4. Cookies and Local Storage

We use only essential cookies and local storage for the platform to function. We do not use third-party cookies, marketing cookies, tracking pixels, or third-party analytics:

• Authentication cookie (Supabase): securely maintains your active session.
• Language preference: stored in local storage to remember your chosen language (English or Spanish).
• Currency preference: stored in local storage to remember your billing currency.
• Consent record: stored in local storage to remember your acceptance of terms.
• We do not use third-party analytics, advertising, or tracking cookies. Our analytics are entirely internal and do not track your activity outside the platform.

5. Data Retention

We retain your personal information according to the following specific periods:

• Account data (email, profile): while the account is active + 30 days after account deletion.
• Event and search data: while the account is active. Deleted with the account.
• Technical server logs: 90 days.
• Metering and credit usage logs: 1 year.
• Webhook logs: 180 days.
• Account deletion records: 3 years (legal documentation obligation).

You may request deletion of your account and associated data at any time from your account settings or by contacting us at help@sinapser.com.

6. Your Rights

Under applicable data protection laws, including the GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate personal data.
• Right to erasure: request deletion of your personal data.
• Right to restriction: request limitation of processing of your personal data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to the processing of your personal data for certain purposes.
• Right to withdraw consent: you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at help@sinapser.com.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit (HTTPS), secure authentication via Supabase, and access controls on our database. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our third-party service providers operate. Transfers are carried out under the following safeguards: European Commission Standard Contractual Clauses (SCCs) for OpenAI, Apollo.io, and Google; and the EU-U.S. Data Privacy Framework (DPF) where the provider is certified. You may request a copy of the applicable safeguards by contacting us.

9. Automated Decisions

Our system uses artificial intelligence to generate sponsor recommendations, relevance scores, enriched descriptions, and contact suggestions. These recommendations are decision-support tools and do not produce legal effects or significantly affect the user in a solely automated manner. The final decision to contact a sponsor always rests with the user.

10. Supervisory Authority

If you believe that the processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the supervisory authority of your country of residence.

11. Children's Privacy

Our services are not directed to individuals under the age of 14 (minimum age of digital consent established by LOPDGDD Art. 7 in Spain). Sponsors Search is a professional B2B tool intended for event organizers. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Material changes require active re-acceptance through the platform. Minor changes take effect after notification.

13. Data Controller and Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at help@sinapser.com.

Sinapser S.L. (operating as Sponsors Search)

VAT: 150411755

Address: 71-75 Shelton Street, London WC2H 9JQ, United Kingdom

Data protection email: help@sinapser.com