Privacy Policy

Introduction

This Privacy Policy describes how GetSponsored ("we," "us," or "our") collects, uses, stores, and shares your personal information when you use getsponsored.io and all related services (the "Services").

GetSponsored is a web-based platform that helps YouTube creators find and connect with sponsorship opportunities. The Services analyze YouTube channel data, match creators with relevant brands, provide sponsorship rate benchmarks, and offer tools for outreach and media kit generation.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Services.

Questions or concerns? Contact us at help@getsponsored.io.

Summary of key points

What personal information do we collect? We collect information you provide (name, email, authentication data) and information collected automatically (IP address, device data, usage data).
Do we process sensitive personal information? No.
Do we collect information from third parties? We may receive information from Google OAuth and YouTube's API when you connect your account.
How do we process your information? To provide and improve the Services, communicate with you, prevent fraud, and comply with legal obligations.
Who do we share information with? Service providers that help us operate the platform (cloud hosting, payment processing, analytics, AI services).
How do we keep your information safe? Through organizational and technical security measures, though no system is 100% secure.
What are your rights? Depending on your location, you may have rights to access, correct, delete, or port your personal information.
How do you exercise your rights? Visit getsponsored.io/settings or email us at help@getsponsored.io.

1. What information do we collect?

Information you provide to us

We collect personal information that you voluntarily provide when you register, use the Services, or contact us. This may include:

Names
Email addresses
Contact or authentication data

We do not process sensitive personal information.

Payment data. If you make purchases, payment data is collected and processed by Stripe. We do not store your payment card details. You can review Stripe's privacy policy at stripe.com/privacy.

Social media login data. If you register using Google OAuth, we receive certain profile information from Google, such as your name, email address, and profile picture. See Section 6 for more details.

Information collected automatically

When you use the Services, we automatically collect certain technical information, including:

Log and usage data: IP address, browser type, device information, pages viewed, features used, date/time stamps, and other activity data.
Device data: Hardware model, operating system, device identifiers, and system configuration.
Location data: Approximate location based on your IP address. We do not collect precise GPS-based location data.

This information is used to maintain security, operate the Services, and for internal analytics.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information from other sources

We may receive limited information from third-party sources such as social media platforms (when you use Google OAuth to sign in) and YouTube's public API (channel data, video metadata) to provide the core functionality of the Services.

2. How do we process your information?

We process your personal information for the following purposes:

Account management: To create and maintain your account, authenticate your identity, and keep your account in working order.
Service delivery: To provide you with sponsor matching, rate benchmarks, media kit generation, and other features.
Communication: To respond to your inquiries, send service-related messages, and notify you of changes to our terms or policies.
Feedback: To request feedback and understand how you use the Services so we can improve them.
Security: To monitor for and prevent fraud, unauthorized access, and other harmful activity.
Analytics: To identify usage trends and improve the Services.
Legal compliance: To comply with applicable laws and regulations.

3. Legal bases for processing (EU/UK users)

If you are located in the EU or UK, we rely on the following legal bases under the GDPR:

Consent: When you have given us permission to process your information for a specific purpose. You can withdraw consent at any time by contacting us.
Performance of a contract: When processing is necessary to fulfill our obligations to you, including providing the Services.
Legitimate interests: When processing is reasonably necessary to achieve our business interests (such as improving the Services, preventing fraud, and understanding usage patterns) and those interests do not outweigh your rights and freedoms.
Legal obligations: When processing is necessary for compliance with the law.
Vital interests: When processing is necessary to protect someone's safety.

Canadian users: We may process your information based on express or implied consent. You can withdraw consent at any time. In some cases, applicable law permits processing without consent, such as for fraud prevention or legal compliance.

We may share your personal information with the following categories of third-party service providers who perform services on our behalf:

Cloud computing services (hosting and infrastructure)
Payment processors (Stripe)
Analytics services (see the two paragraphs below)
Authentication services (Google OAuth via Supabase)
AI platforms (Google Cloud AI — for sponsor matching and content analysis)
Error monitoring (Sentry — for technical error tracking)

These third parties are contractually obligated to protect your data and may only process it as instructed by us.

We may also share your information in connection with a business transfer (merger, sale, acquisition, or similar transaction).

We do not sell your personal information. We do not share your personal information with third parties for their direct marketing purposes.

Plausible Analytics. We use Plausible for aggregate traffic analytics. Plausible is cookieless, EU-hosted, does not use browser storage, does not collect personal data or cross-site identifiers, and does not require your consent to run. It only tells us things like which pages are popular.

PostHog (product analytics). We use PostHog to understand how features are used so we can improve the product. PostHog is EU-hosted and traffic is routed through our own proxy. By default it runs in a cookieless, storage-free mode — no cookies, no localStorage, no session recordings. If you click Allow on the small banner at the bottom of the page, we switch PostHog to use a first-party cookie and start a session replay so we can see how the interface actually behaves for you; all input fields (including email and password fields) are masked in those recordings. You can withdraw consent at any time via the Cookie settings link in the footer — that stops the session replay and clears every PostHog cookie and localStorage key from your browser.

Data retention. Product-analytics events are retained for up to 12 months, session replays for up to 30 days, then deleted or aggregated. Account and billing data are retained for the life of your account plus the period required by tax and accounting law.

Deletion on request. To request deletion of any product-analytics data associated with your account, email help@getsponsored.io.

5. Artificial intelligence

We use AI-powered features as part of the Services, including sponsor matching, content analysis, and pitch draft generation. These features are provided through third-party AI service providers, including Google Cloud AI.

When you use AI-powered features, your input and relevant channel data are processed by these providers to generate results. All AI processing is governed by this Privacy Policy and our agreements with third-party providers.

To opt out of AI processing, contact us at help@getsponsored.io.

If you register or log in using Google OAuth, we receive certain profile information from Google, which may include your name, email address, and profile picture.

We use this information only for the purposes described in this Privacy Policy. We do not control how Google uses your information — please review Google's privacy policy for details.

7. International data transfers

Our servers are located in the United States. If you access the Services from outside the US (including the EU, UK, or Switzerland), your information will be transferred to and processed in the United States.

We protect international transfers of personal information using the European Commission's Standard Contractual Clauses (SCCs). Copies of these clauses can be provided upon request.

8. How long do we keep your information?

We retain your personal information for as long as you maintain an account with us, or as long as necessary to fulfill the purposes described in this Privacy Policy.

When we no longer have a legitimate business need to process your information, we will either delete or anonymize it. If deletion is not immediately possible (for example, because data is stored in backup archives), we will securely isolate your information from further processing until deletion is possible.

9. How do we keep your information safe?

We implement appropriate technical and organizational security measures to protect your personal information. However, no electronic transmission or storage system is 100% secure. We cannot guarantee that hackers or other unauthorized third parties will not be able to access your information.

You should only access the Services within a secure environment.

10. Children's privacy

The Services are not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18.

If we learn that we have collected personal information from a user under 18, we will deactivate the account and delete the data. If you believe we may have collected data from a child under 18, please contact us at help@getsponsored.io.

11. Your privacy rights

Depending on your location, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request that we correct inaccurate or incomplete personal information.
Deletion: Request that we delete your personal information.
Restriction: Request that we restrict the processing of your personal information.
Portability: Request a copy of your data in a structured, machine-readable format.
Objection: Object to our processing of your personal information.
Withdraw consent: If processing is based on consent, you may withdraw it at any time.

To exercise your rights: Visit getsponsored.io/settings or email us at help@getsponsored.io. We will respond to your request in accordance with applicable data protection laws.

Withdrawing analytics consent: Use the Cookie settings link in the footer to change or withdraw your PostHog consent at any time. Withdrawal stops session replay and clears any PostHog cookies and localStorage keys.

EU/UK users: If you believe we are unlawfully processing your information, you have the right to complain to your local data protection authority.

Swiss users: You may contact the Federal Data Protection and Information Commissioner.

Opting out of marketing emails: You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email we send, or by contacting us. We may still send you service-related messages necessary for account administration.

Account deletion: You can request account deletion at any time through your account settings or by contacting us. Upon deletion, we will remove your information from our active databases. We may retain some information to prevent fraud, enforce our terms, or comply with legal requirements.

12. US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, or other US states with privacy laws, you may have additional rights including:

Right to know what personal information we collect and how we use it
Right to access your personal data
Right to correct inaccuracies
Right to request deletion
Right to obtain a copy of your data
Right to non-discrimination for exercising your rights
Right to opt out of targeted advertising, sale of personal data, or profiling

Categories of personal information we collect: Identifiers (name, email, IP address), internet activity data (usage logs, browsing activity), geolocation data (approximate location from IP), and inferences (such as sponsor match scores based on channel analysis).

We have not sold or shared any personal information to third parties for business or commercial purposes in the preceding twelve months.

To exercise your rights: Visit getsponsored.io/settings or email us at help@getsponsored.io. We may need to verify your identity before processing your request.

Appeals: If we decline your request, you may appeal by emailing help@getsponsored.io. If your appeal is denied, you may submit a complaint to your state attorney general.

13. Do-Not-Track signals

There is currently no uniform technology standard for recognizing Do-Not-Track (DNT) browser signals. We do not currently respond to DNT signals. If a standard is adopted in the future, we will update this Privacy Policy accordingly.

14. Updates to this policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last updated" date at the top of this page. If we make material changes, we may notify you by posting a prominent notice or sending you a notification.

We encourage you to review this Privacy Policy regularly.

15. Contact us

The data controller under GDPR is DM Moradkhani AB, Stockholm, Sweden. If you have questions or comments about this Privacy Policy, you may contact us at:

GetSponsored (operated by DM Moradkhani AB)
Org. nr: 559572-7933
VAT: SE559572793301
Stockholm, Sweden
Email: help@getsponsored.io

To review, update, or delete your personal information, visit getsponsored.io/settings.