Privacy Policy

1. Who we are and what this covers

SponsorBridge Inc. (“SponsorBridge,” “we,” “us”) provides a workflow platform for sponsored content production. This Privacy Policy explains what personal information we handle, why, who we share it with, and what choices people have.

It covers our website at sponsorbridge.com, our application at app.sponsorbridge.com, the Sponsor Portal, and the emails we send.

2. Two different roles, and why the difference matters

We handle personal information in two distinct capacities, and different parts of this policy apply to each.

Information we handle for ourselves: When you visit our website, join our waitlist, contact us, sign up for an account, or pay us, we decide how that information is used. We are the controller, or in California terms the business, for that information. Sections 3 through 11 describe it.

Information our customers put into the platform: A SponsorBridge customer, typically a media company, uploads content and enters records about people, including sponsor contacts, contract signers, talent, and colleagues they invite. We process that information on the customer's instructions, to run the platform for them. The customer is the controller and we are the processor or service provider. We do not decide what a customer puts in, who they invite, or how long they keep it. Section 12 describes this, and explains what someone should do if their information is in a customer's workspace and they want it changed or removed.

3. Information we collect

When you create an account: Sign-in is through Google. When you sign in, Google gives us your name, email address, profile picture, and a stable account identifier. We store those, plus your role and organization membership, your notification preferences, and product-interface preferences such as pinned shows and onboarding progress. We do not receive your Google password.

When you join the waitlist or contact us: The waitlist form collects your name, email address, company, role, how many shows you run, and anything you write in the message field. We keep a record of whether we have contacted you, scheduled a demo, or converted you to a customer. If you email us, we keep the correspondence.

When you subscribe: Our payment provider collects and processes your payment details. We receive your billing contact email, subscription status, and limited card metadata, specifically the card brand, last four digits, and expiration month and year. We never receive or store a full card number.

When you use the application: We keep an activity log of meaningful actions in a workspace, recording who did what and when, including the display name of the person who acted and, where an email was sent, the recipient's address. The log exists so that customers have an audit trail, which is one of the platform's core functions.

When you connect a third-party account at your direction: If you connect Google Drive to import files, we store an access token for the narrow permission you granted so that the import works, and we retrieve only the files you select. If you connect a social account for analytics, we store the account name, handle, avatar, and the published posts and metrics for that account.

Information we do not collect: We do not use advertising or analytics trackers, session-replay tools, or third-party marketing pixels on our website or in the application. We do not build advertising profiles, and we do not log IP addresses or device fingerprints for tracking purposes.

4. Cookies and similar technologies

The application uses cookies that are strictly necessary to keep you signed in and to refresh your session securely. It also stores small preference values in your browser's local storage, such as whether a panel is collapsed and which chat thread you last had open. These stay on your device and are not sent to any third party.

We do not use advertising, analytics, or social media cookies, so there is nothing to opt out of and no consent banner. If we ever add analytics or advertising technology, we will update this policy and provide the notice and controls the law requires before turning it on.

Do Not Track: Because we do not track users across other websites or services over time, we do not respond differently to a browser Do Not Track signal or to a Global Privacy Control signal. If we ever add such tracking, we will honor these signals and say so here.

Other parties do not track you here: No third party collects information about your online activity over time and across other websites when you use our website or the application.

5. How we use information

We use the information described in Section 3 to:

• create and administer accounts, authenticate users, and enforce roles and permissions;
• provide, maintain, secure, and troubleshoot the Service, including diagnosing errors and preventing abuse;
• send transactional and service messages, described in Section 8;
• process payments, manage subscriptions, and prevent payment fraud;
• respond to support requests and communicate about the product;
• respond to a waitlist or demo request and, where permitted, follow up about SponsorBridge;
• understand aggregate, de-identified usage so we can improve the product;
• comply with law and enforce our Terms of Service.

Legal bases, where the GDPR or UK GDPR applies: We rely on: performance of a contract, to provide the Service to a customer and its users; legitimate interests, to secure the platform, prevent abuse, improve the product, and conduct business-to-business outreach to a business contact who asked to hear from us; consent, where we ask for it, which you may withdraw; and legal obligation, where we must retain or disclose information.

6. Customer content and AI processing

This section describes what happens to the content a customer uploads. It is the part of our processing most people want to understand, so we are specific.

Content types: Customers upload video, audio, images, and documents, including unreleased episodes and cuts, insertion orders, media plans, brand guidelines, and creative assets. They also enter deal terms, deliverable schedules, comments, and approvals.

Video and audio delivery: Original files are stored in object storage. Video is transcoded for streaming playback through our video provider. Playback of confidential content uses signed, time-limited links.

Brand Check: When a user runs Brand Check on a deliverable, the audio is transcribed by our speech-to-text provider, which retrieves the media file through a short-lived signed link. The resulting timestamped transcript, sampled frames from the video, images, and the relevant brand rules and house rules are then sent to our AI provider, which analyzes them and returns findings that appear as comments. Transcripts are stored with the file version they came from.

The in-product assistant and document extraction: When a user chats with the assistant, the conversation and the workspace records the assistant needs to answer are sent to our AI provider. When a user uploads an insertion order or media plan for extraction, the document, including any names, email addresses, and financial terms in it, is sent to our AI provider, which returns structured fields. Scanned documents and images may be transcribed by the AI provider so their text can be searched.

Search indexing: Text from uploaded documents and assets is converted into numerical embeddings so that the assistant can find relevant material. The embedding provider receives the text for that conversion. The resulting embeddings are stored inside our own infrastructure.

We do not train models on customer content: We do not use customer content to train, fine-tune, or develop machine-learning models. Our AI, transcription, and embedding providers do not use content we submit through their APIs to train their models under the terms applicable to our account.

Automated output is not a decision about anyone: Brand Check evaluates content against brand guidelines. It does not evaluate people, and it does not make or support any decision about an individual's employment, credit, housing, insurance, education, or access to a service.

No voiceprints, no face recognition: Transcription converts speech to text and does not create a voiceprint. Frame analysis describes what appears in an image and does not measure facial geometry, create a face template, or identify or match any person. We do not build or keep any record capable of recognizing a specific individual by voice or face, and no feature identifies who appears in content.

7. Who we share information with

Sub-processors and service providers: We use the providers below to run the Service. Each is bound by contract to process information only for the purposes we specify and to protect it.

Within a customer's workspace: Content and activity are visible to the customer's own users according to the roles that customer configures, and to the sponsor contacts and other recipients that customer chooses to send links to.

Legal and safety: We may disclose information if required by law, subpoena, or court order, or where we believe in good faith that disclosure is necessary to investigate fraud or a security incident, enforce our Terms, or protect the rights, property, or safety of any person. Where we are permitted to do so, and the request concerns a customer's workspace, we will notify the customer so they can respond.

Corporate transactions: If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to the receiving party continuing to honor this policy or giving notice of a material change.

No sale of personal information: We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for purposes beyond those permitted under applicable law.

8. Email we send

Transactional and service email: We send email that is part of the Service: sign-in and invitation messages, sponsor review requests, comment digests, Brand Check results, mentions and assignments, daily digests, and billing notices such as a trial ending. Users can control which product notifications they receive, and how often, in their notification settings.

Waitlist and sales email: If you join our waitlist or ask for a demo, we may email you about SponsorBridge. Every such message includes a way to opt out, and you can also email privacy@sponsorbridge.com to be removed.

Email to people who are not our users: When a customer invites someone or sends a sponsor review request, the resulting email comes from our domain but is sent at the customer's direction. To stop receiving those, ask the customer who sent them, or contact us at privacy@sponsorbridge.com and we will pass the request to them.

9. Retention

We keep information for as long as we need it for the purposes described in this policy, and we are deliberately specific about the cases where “as long as needed” is longer than people expect.

• Account information is kept while the account is active. When a user is removed from an organization, we delete their profile, preferences, memberships, notifications, and authentication records.
• Workspace content is kept until the customer deletes it or closes the account. After account closure, we delete or de-identify customer content in the ordinary course following the export window in our Terms.
• Prior versions of reviewed files are retained by design, so that a comment or approval given on one cut remains attached to the cut it was given on. Uploading a new version does not delete the old one.
• The activity log is append-only by design, because its purpose is to be a reliable audit trail. Entries are not edited or deleted when a person is removed, and they retain the display name that was recorded at the time, and, for sent email, the recipient address.
• Waitlist records are kept until we no longer have a business reason to keep them, or until you ask us to delete them.
• Billing records are kept as long as tax, accounting, and audit law requires, typically seven years.
• Backups persist for a period after deletion and are overwritten on a rolling cycle.

10. Security

We protect information with measures appropriate to its sensitivity, including encryption in transit, encryption at rest by our infrastructure providers, single sign-on through Google with no passwords for us to store, server-side enforcement of roles and permissions rather than interface-only hiding, role-gating of deal financials, signed and time-limited links for confidential media playback, revocable access links for sponsor review, redaction of sensitive values from our operational logs, and access to production systems limited to personnel who need it.

No system is perfectly secure, and we do not claim otherwise. We do not currently hold a SOC 2 or ISO 27001 certification. If we become aware of a breach of security affecting personal information, we will notify affected customers without undue delay and cooperate with them as the law requires. Report a suspected vulnerability or incident to security@sponsorbridge.com.

11. Your rights and choices

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, to limit how we use sensitive information, to opt out of sale or targeted advertising, which we do not do, to withdraw consent, and to not be discriminated against for exercising a right. Where the GDPR or UK GDPR applies you may also have the right to restrict or object to processing, to data portability, and to complain to your data protection authority.

How to make a request: Email privacy@sponsorbridge.com. We will verify your identity in proportion to the sensitivity of the request, usually by confirming control of the email address on file, and respond within the time the applicable law allows. An authorized agent may submit a request on your behalf with proof of authorization.

If your information is in a customer's workspace: We will route your request to that customer, who decides what happens to it, and we will assist them. See Section 12.

California residents: We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of and no “Do Not Sell or Share My Personal Information” link. We do not use or disclose sensitive personal information beyond what is needed to provide the Service and permitted by law. Under California's “Shine the Light” law, we confirm that we do not disclose personal information to third parties for those third parties' own direct marketing purposes. Requests under that law may be sent to privacy@sponsorbridge.com.

Nevada residents: Nevada law lets a resident direct an operator of a website not to sell their covered information. We do not sell it. To submit a request anyway, email privacy@sponsorbridge.com, which is our designated request address for this purpose.

We are not a data broker: We collect personal information to provide our Service to the customer who gave it to us, and we do not sell or license it to third parties, so we are not a data broker under California, Texas, Oregon, Vermont, or Nevada law and are not registered as one.

12. If your information is in a customer's workspace

Our customers enter information about people who never signed up with us. If you are a sponsor contact, a contract signer, an agency representative, talent, a guest, or someone a customer invited, your information is in the platform because that customer put it there.

What that means practically: The customer decides what to record, who to give access to, and how long to keep it. They are responsible under our Terms for having the right to enter your information and for giving you any notice the law requires. We process it on their behalf and do not use it for our own purposes, do not sell it, and do not use it to market to you.

What you can do: Contact the organization that sent you the link or the invitation. If you do not know who that is, or they do not respond, email privacy@sponsorbridge.com with the link or message you received and we will identify the customer and forward your request. Where the law requires us to act directly, we will.

Sponsor Portal links: A portal link is a credential. Anyone who has it can see what it grants access to. If a link reached you by mistake, or you believe a link has been shared beyond its intended recipient, tell the organization that sent it so they can revoke it, or tell us and we will alert them.

13. International data transfers

We operate in the United States, and information we handle is processed there and in other countries where our providers operate. If you are in the European Economic Area, the United Kingdom, or Switzerland, transfers of your information out of your region rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses, the UK Addendum, or a provider's certification under an applicable adequacy framework.

14. Children

The Service is for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child's information has reached us, contact support@sponsorbridge.com and we will delete it.

15. Changes to this policy

We may update this policy. We will change the “last updated” date, and for a material change we will give notice by email to account administrators or in the product before it takes effect. Continued use after that means you accept the updated policy.