Introduction
This policy covers sponsorfinder.io, the emails we send and our MCP server at mcp.sponsorfinder.io. We follow the UK GDPR, the Data Protection Act 2018 and PECR, and for people in the EU, including the Netherlands, the EU GDPR.
We never sell your data, show no adverts and never use your data to train AI.
Who we are
- Name
- Sponsor Finder
- hi@sponsorfinder.io
What we collect
- Your account. Email, hashed password and name, or what Google shares if you sign in with Google. Legal basis: contract.
- What you save. Saved employers, tracked applications, notes, watches and alert settings. Legal basis: contract.
- Details about other people. Recruiter details you choose to record in your tracker. Record only what you need. Legal basis: legitimate interests.
- Assistant chats. Messages, answers, safety labels and ratings. We replace contact details and ID numbers with [removed] first. Legal basis: contract.
- Offer checks. The text you paste. We read it once to build your report and never store it. Legal basis: contract.
- Searches. Your search words, sent to Google Gemini without your name, email or account id. Legal basis: contract.
- Your plan. Your plan, when it renews and what you paid. Stripe handles your card and keeps its own payment records. Legal basis: contract.
- Reports of a mistake. Your message, and your email if you want a reply. Legal basis: legitimate interests.
- Usage and security data. IP address, browser, pages, errors, usage counters, AI usage (no text) and days signed in, to keep the service secure and fair and to fix problems. Legal basis: legitimate interests.
- Analytics. Google Analytics events, and the page and source you first arrived from, only if you say yes. Legal basis: consent.
- Weekly summary, tips and news emails. We email account holders news, tips and a weekly summary about SponsorFinder on the basis of our legitimate interests (the soft opt-in for our own similar service). You can say no when you sign up, and unsubscribe from any email or in Email preferences. Legal basis: legitimate interests.
- Public register data. Registers and job adverts can name a person, such as a sole trader or a recruiter. Legal basis: legitimate interests.
AI features and the offer checker
- AI features are labelled. What you write for the assistant, a watch or the offer checker goes to Anthropic (Claude) in the US, with contact details and ID numbers removed.
- Search words, and the first 200 characters of a question about your own visa case, go to Google Gemini to find matching jobs and GOV.UK guidance. Keep personal details out of search.
- AI providers never get your name, email or account id, and do not train on what we send. We use no AI hosted in China.
- Safety checks can pause the assistant for the day. No automated decision has a legal or similar effect on you, and a person will review any result if you ask.
- The offer checker may look up a company or web domain from your text in public records. We keep only a scrambled form of the domain, for 7 days.
Who we share it with
- Supabase: Database and sign-in (UK)
- Hetzner: Servers and backups (Germany)
- Cloudflare: Hosting and security (global)
- Upstash: Cache (EU)
- Anthropic: AI (US)
- Google: Gemini, Analytics with consent, Google sign-in, fonts (US, Ireland)
- Stripe: Payments, as merchant of record (Ireland, US)
- Amazon SES: Email (Ireland)
- Sentry: Error reports (Germany)
- Telegram: Team alerts, without names (UAE)
- Sanity: Page text
- Companies House, domain registries: Offer checker lookups, never your details
Where your data goes
Most data stays in the UK and EEA. Where a provider outside them can reach it, our contracts protect it with the Data Privacy Framework or standard contractual clauses. Ask us which applies.
How long we keep it
- Your account and what you save, including old tracker files: Until you delete them or your account
- Assistant chats: 90 days after the last message; deleted chats go 30 days later
- Pasted offer text: Never stored
- Search cache: 1 day
- Days signed in: 13 months
- Server logs, error reports: 30 days, 90 days
- Backups: 180 days
- Google Analytics: 14 months
- Reports of a mistake: Until dealt with
- AI usage and proof of deletion: Kept without your account id or email
Your rights
You can see, correct, delete or copy your data, limit or object to its use, and withdraw consent.
- Download my data and Delete my account are under Account, Privacy and work straight away. Backups expire within 180 days. Deleting ends a running plan without a refund, so ask for any refund first.
- Change cookie choices under Cookie settings in the footer.
- For anything else, email hi@sponsorfinder.io. It is free and we reply within one month.
Unhappy? Tell us first. You can also complain to your data protection authority, such as:
- Information Commissioner's Office (ICO), United Kingdom
- Autoriteit Persoonsgegevens, Netherlands
Children
You must be 18 or over to create an account or buy a pass. If we learn an account belongs to someone under 18, we delete it.
Changes to this policy
When this policy changes, the version and date at the top change too. We tell members about important changes at least 14 days ahead where we can.