Privacy Policy

Sponsor Finder ("we", "our", "us") operates the website at sponsorfinder.io (the "Service"), a free, advertising-supported aggregator of public visa-sponsor registers in the United Kingdom and the Netherlands, together with an authenticated job-application tracker. This Privacy Policy explains what personal data we process, why, on what lawful basis, how long we keep it, and how you can exercise your rights.

We are committed to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK Privacy and Electronic Communications Regulations 2003 (PECR), the EU ePrivacy Directive (2002/58/EC), and the Dutch Telecommunicatiewet (article 11.7a). Where the law of the United Kingdom, the European Union or the Netherlands grants you greater protection, that law applies.

If you do not agree with this Privacy Policy, please do not use the Service. We will not be able to provide the authenticated features (account, bookmarks, job tracker) without processing the data described below.

Sponsor Finder is operated from the United Kingdom and the European Union. Some of our sub-processors are based in or transfer data to the United States. Where personal data is transferred outside the UK or the EEA, we rely on the following safeguards under Articles 44 to 49 of the UK GDPR / EU GDPR:

• The EU-US Data Privacy Framework (DPF) adequacy decision of 10 July 2023 and the UK Extension to the DPF (effective 12 October 2023) for transfers to participating US providers (including Google and Vercel where DPF-certified).
• The European Commission Standard Contractual Clauses (Decision (EU) 2021/914) for transfers from the EEA where the DPF is not relied upon.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs for restricted transfers from the United Kingdom.

We carry out transfer-impact assessments where required and apply supplementary measures (such as encryption in transit and at rest, and access controls) where appropriate. The sub-processor table above identifies the mechanism we rely on for each provider. You can request a copy of the relevant SCCs by writing to hi@sponsorfinder.io.

To exercise any of the rights listed above, email hi@sponsorfinder.io from the address registered to your account, including a clear description of the right you are exercising and any context we need to act on your request. We may ask for additional information to verify your identity where there is reasonable doubt.

Responding to your request is free of charge except where the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act (Article 12(5) GDPR). We respond within one month and may extend by up to two further months for complex or numerous requests, in which case we will tell you why.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with a data-protection supervisory authority — in particular, the supervisory authority of your habitual residence, place of work or where you consider an infringement to have occurred. See the "Supervisory authorities" section below.

Sponsor Finder is operated as a free, advertising-supported service. Throughout this Privacy Policy, "controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" have the meanings given to them in Article 4 of the UK GDPR / EU GDPR.

Our contact email for privacy enquiries is hi@sponsorfinder.io. We have not appointed a Data Protection Officer because the conditions in Article 37(1) GDPR do not apply to us; we keep this position under review as the Service grows.

We process your personal data under one or more of the following lawful bases (Article 6(1) GDPR):

• Performance of a contract — Article 6(1)(b). To create and maintain your account, to authenticate you, and to provide the features you ask for (search, bookmarks, job tracker, profile, file uploads, session management).
• Consent — Article 6(1)(a) and PECR / Tw 11.7a. For analytics cookies (Google Analytics 4) and advertising cookies (Google AdSense). You can withdraw consent at any time using the cookie-settings link in the footer.
• Legitimate interests — Article 6(1)(f). For security and abuse-prevention (including IP-based rate limiting and short-retention request logs), aggregated operational metrics, in-product bug reporting, and cookieless aggregated traffic measurement using Vercel Analytics and Speed Insights. We have carried out a balancing test for each of these purposes and you can request a summary by writing to hi@sponsorfinder.io. You have the right to object under Article 21 GDPR.
• Legal obligation — Article 6(1)(c). Where we are required to retain or disclose information to comply with applicable law (for example, in response to a valid request from a supervisory authority).

We operate a granular cookie-consent banner that distinguishes three categories: strictly-necessary, analytics, and marketing. Strictly-necessary cookies are required for the Service to function. Analytics and marketing items are not set, and the corresponding third-party scripts are not loaded, until you grant the relevant consent. You can accept, reject or change your choices at any time using the cookie-settings link in the footer.

Cookieless analytics on legitimate interest

Vercel Analytics and Vercel Speed Insights run on every page to give us aggregated traffic and performance metrics. Vercel does not set cookies on your device for this measurement and hashes IP addresses, rotating the hash daily. Because no information is stored on or read from your device, PECR regulation 6 and article 11.7a of the Dutch Telecommunicatiewet do not require consent for this measurement; we rely on our legitimate interest in operating, securing and improving the Service (Article 6(1)(f) GDPR). You can object to this processing at any time by writing to hi@sponsorfinder.io.

What is sent to Google Analytics 4 and Vercel Analytics after you consent

Where you grant analytics consent we additionally send the following to Google Analytics 4 (via Google Tag Manager) and to Vercel Analytics:

• Your backend user identifier and account role (USER or SUPER_ADMIN) as user properties on each event after sign-in. The identifier is a pseudonymous UUID, not your email address.
• Search query strings, truncated to 100 characters, when you submit a search. We discourage entering personal information into the search bar; consider this before granting consent.
• Authentication events (login / register / OAuth / logout), search filters, bookmark add/remove, organisation views, outbound link clicks, and job-tracker lifecycle events. Event properties include organisation identifiers, country (UK or NL), stage and priority indicators, file mime type and file size in kilobytes.
• We do not send recruiter names or emails, the contents of uploaded files, free-text notes, or salary figures to analytics providers.

Advertising

Sponsor Finder is funded by Google AdSense. We do not load AdSense scripts or set advertising cookies until you grant marketing consent. Where you consent, Google may use cookies and identifiers to serve and measure advertising on the Service in accordance with its own privacy policy.

The job tracker lets you record information about people other than yourself — typically the name, email address and LinkedIn URL of a recruiter or hiring contact. This is personal data about third parties.

You are the controller of that data: you decide what to record and why. We act as a processor on your behalf when we store it for you. By entering it into the Service, you warrant that you have a lawful basis under Article 6 GDPR (typically your own legitimate interest in pursuing a job application) and that you are using it in a manner consistent with what the individual would reasonably expect in a professional job-search context.

If a recruiter or other third party contacts us asking what data is held about them, or asks to exercise their rights under Article 14 to 22 GDPR, we will forward their request to you and may take reasonable steps to comply ourselves where required to do so under data-protection law.

If you use the in-product bug-report widget, your report is submitted to our form host Tally (Tally B.V., based in Belgium). To help us investigate the issue, the report is pre-filled with the page URL, route, status code, an error message (truncated to 500 characters), a stack trace (truncated to 2000 characters), your user-agent (truncated to 500 characters), your screen dimensions, your user identifier, the email address registered to your account, your role, the app version and the report type, in addition to anything you type yourself.

We process this data under our legitimate interest in operating and maintaining the Service. You can avoid submitting it by not using the bug-report widget; you can also ask us to delete a report we hold by emailing hi@sponsorfinder.io.

We implement appropriate technical and organisational measures under Article 32 GDPR, including: TLS for all traffic; passwords stored as salted hashes by Supabase Auth (never in plain text); HttpOnly, Secure and SameSite cookies for sessions; rate limiting of API endpoints by IP; row-level security on database tables; private object storage with short-lived signed URLs for file uploads; restricted access to production systems on a need-to-know basis; secrets held in environment variables and never logged; and circuit breakers and timeouts around third-party calls. No system can be guaranteed completely secure, and we will tell affected users and the relevant supervisory authority about a personal-data breach where required by Articles 33 and 34 GDPR.

The organisation data shown on the Service is sourced from public government registers (the UK Home Office register of licensed sponsors, refreshed daily; and the Netherlands IND register of recognised sponsors) and enriched with data from Companies House for UK entities. This data describes organisations, not individuals. We refresh and reconcile this data on a schedule and provide change history (added, removed, reactivated events) so that users can see how a sponsor’s status has evolved over time.

When the public-register data we ingest changes, our backend sends summary alerts (the names and counts of affected organisations) to a private Telegram channel monitored by our operators. These alerts contain no personal data about users of the Service.

Most data you create can be deleted directly from the product: bookmarks, individual job-tracker entries, uploaded files, your avatar, individual sessions and "sign out everywhere". A self-service "delete my account" button and a structured data-export endpoint are not yet exposed in-product.

Until they are, you can exercise Articles 17 and 20 GDPR by emailing hi@sponsorfinder.io from the address registered to your account. We will verify your identity, complete deletion or export within 30 days, and confirm backup-purge completion at the next backup-rotation cycle (no later than 180 days). We are actively working to add a self-service deletion and export flow in the product.

We will update this Privacy Policy when our practices change or to reflect changes in the law. The current version and effective date are shown at the top of this document. Where a change is material we will tell registered users by a notice in the product or by email before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy where consent is not separately required.

Material changes will be communicated by an in-product notice and, where we hold your email address, by email at least 14 days before they take effect. A version history is maintained at the top of this Privacy Policy.