Privacy Policy

Who's responsible for your data

SponsorMe is run by a sole trader in the UK, who is the data controller for the personal data described here. Address: 163 Middlesex House, High Street, Edgware, HA8 7FY. Email: nnrodcar@gmail.com.

What we collect

Your account: your email address and your password. We store the password only as a scrambled hash (scrypt), so nobody, including us, can read it.

Your subscription: your Stripe customer and subscription IDs, whether your subscription is active, and the dates your paid weeks start and end. Stripe collects your card and billing details. We never see your full card number.

Your statuses: the status you set on each role, such as Applied or Interview.

Security records: when you sign in, create an account or ask for a password reset, we briefly record the address your device connects from (its IP address) and the email address used, to limit repeated attempts. We don't keep any other record of IP addresses, and our error logs don't include your IP address or email.

Messages: what you write to us if you email us.

What we don't collect

We don't use analytics, tracking or advertising cookies, and we don't build a profile of you. Browsing the free list doesn't need an account, and we don't record who looks at it.

Why we use it, and our legal basis

To run your account and the subscription you paid for: to sign you in, give you full access, save your statuses and send you password reset emails. The legal basis is our contract with you.

To keep SponsorMe secure, by limiting repeated sign-in attempts and preventing misuse. The legal basis is our legitimate interest in protecting the service and your account.

To keep payment records for tax. The legal basis is our legal obligation to keep accounts.

To answer your emails. The legal basis is our legitimate interest in helping you.

Who we share it with

Amazon Web Services hosts the site and stores your account and statuses in its London data centres. It also sends our password reset emails, from its data centres in the US.

Stripe processes your payments and runs the checkout and billing pages. Stripe is also responsible for the data it collects to process payments and prevent fraud, under its own privacy policy at stripe.com/privacy.

Google provides our email inbox, so emails you send us are stored with Google.

These companies act on our instructions and must keep your data secure. We don't sell your data, and we don't share it with employers or advertisers.

Data outside the UK

Your account and statuses are stored in the UK. When we send you a password reset email, your email address and the link pass through Amazon Web Services in the US. Stripe and Google may also process data in other countries, including the US. These providers use safeguards approved under UK law, such as the UK International Data Transfer Addendum or the UK–US data bridge.

Cookies

We set one cookie, called "sid", when you sign in. It keeps you signed in for up to 30 days and can't be read by scripts on the page. It's strictly necessary for the service to work, so we don't ask for consent. Signing out removes it.

Stripe's checkout and billing pages are on Stripe's own site and set their own cookies, which Stripe needs to take payments securely.

How long we keep it

Your account, subscription details and statuses: until you delete your account.

Sign-in sessions: 30 days. Password reset links: 1 hour. Records used to limit repeated attempts: 15 minutes. Error logs: 14 days. Expired records are deleted automatically, usually within a day or two.

Payment records: Stripe keeps these, and we keep what we need for tax for at least 5 years after the 31 January tax return deadline for the year they relate to, as HMRC requires.

When you delete your account from "Manage subscription", we delete your email address, password and statuses straight away, and cancel your subscription. We keep only the payment records the law requires.

How we protect it

The site only works over an encrypted connection (HTTPS). Passwords are hashed, sign-in sessions are stored only as hashes, and access to our systems is limited to us.

Your rights

You can ask for a copy of your data, ask us to correct it or delete it, ask us to limit how we use it, or object to how we use it. You can download your statuses at any time from "Manage subscription". Email nnrodcar@gmail.com to use any of these rights. We'll reply within one month.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

SponsorMe is for people aged 18 and over. We don't knowingly collect data about children.

Changes to this policy

If we change how we use your data in a way that affects you, we'll email you before the change applies. The date at the top shows when this page last changed.