Privacy policy

1. Who is responsible

ULU Studio Ltd (trading as SponsorshipNow), company number 17259257, registered office Swan Building, 20 Swan Street, Manchester M4 5JW, is the controller for this website and, in the SponsorshipNow service, for account data, billing, support and diagnostics. ICO registration number 00015215224. Contact: privacy@patronnow.app.

An organisation that uses SponsorshipNow is the controller of the sponsor, enquiry, agreement and person data it puts into the service. We process that data on the organisation's instructions, under the processing terms in section 10 of our terms of service.

2. This website

For every visitor, this website uses one cookie-free visit counter, Cloudflare Web Analytics, which records the page you visit, the site that referred you, your browser type and your country, and keeps no record that identifies you. The website is hosted by Cloudflare, which handles standard request data (your IP address, browser and the pages you ask for) to deliver and protect the site.

Analytics and advertising cookies, only if you accept them. We would like to see which pages and ads help clubs find SponsorshipNow. A bar at the bottom of the page asks first. Until you press “Accept all”, and if you press “Reject all”, nothing is loaded from PostHog, Meta or Google and nothing is sent to them. Your choice lasts six months. You can change it at any time with “Cookie settings” at the bottom of every page; if you reject after accepting, their cookies and stored data are deleted from this website and they stop loading. Our lawful basis for these cookies is your consent.

If you accept:

• PostHog (analytics, held in PostHog's EU region) records the pages you view and for how long, the links and buttons you click, the site and campaign that brought you, and your browser and device type. It may record a replay of your visit, with everything you type hidden, and all text hidden on pages with a form. It is set to discard your IP address. We never tell PostHog who you are.
• Meta (the Meta Pixel, for Facebook and Instagram ads) and Google (the Google Ads tag) receive the pages you view and whether you clicked to start an account, so we can see which ads work and show our ads to people likely to be interested. We do not send them anything you type into this website or any contact details. Meta and Google also use what they receive for their own purposes, under their own privacy policies.

The cookies and browser storage this website uses:

• pn_consent (SponsorshipNow): remembers your cookie choice; 6 months. This one is essential and is set when you make either choice.
• ph_<project key>_posthog (PostHog), as a cookie and in browser storage: a random identifier for your browser and the current visit; 1 year. PostHog also keeps a few ph_ entries for the current tab, which end when you close it.
• _fbp (Meta): a random identifier for your browser, to measure ads; 90 days. _fbc (Meta), only when you arrive from a Meta ad: that ad click; 90 days. Meta also keeps lastExternalReferrer entries in browser storage: the site that referred you, until you reject or clear them.
• _gcl_au (Google): a random identifier for your browser, to measure ads; 90 days. _gcl_aw and _gcl_ls (Google, cookie and browser storage): the Google ad click that brought you, if any; 90 days.

Apart from these, and the counter's totals, we keep no record of visits. Creating an account and using SponsorshipNow happen in the service, covered in section 3.

3. The SponsorshipNow service

Your account. When you create an account we collect your name, email address, password (stored only as a one-way hash), language and time zone, and the organisation details you enter. If you turn on two-factor authentication, we store the secret needed to check your codes.

Where you came from. If you create an account from one of our links, we save the name of the campaign that link came from (for example “google-ads”) with your account, so we can see which channels work. We also record whether you signed up yourself or through an invitation.

What your organisation creates. As you use the service we store what you create: opportunities, sponsors and their contact details, enquiries, proposals, agreements, invoices, payment records, delivery evidence and reports. We keep a history of significant actions, such as who accepted a proposal and when, because that history is the point of the service. For this data your organisation is the controller (section 1).

People who do not have an account. A Sponsor who opens a proposal confirms their email address with a one-time code before accepting or declining, and we record the acceptance: the version accepted, the time, the name and email address used. Someone who sends an enquiry from an organisation's public page gives their name, organisation, email address and message, which go to that organisation's Admins. Where an organisation presents a person for sponsorship, it records that person's details, images and permission (see below). Each of these is held for the organisation, which is the controller.

People an organisation offers for sponsorship

An organisation can record a person it offers for sponsorship, such as an athlete, performer or young member. The organisation is the controller of that person's data and is responsible for their permission and, for anyone under 18, for safeguarding; we process the data on its behalf. The record is private to the organisation's Admins. We never ask for a date of birth.

Nothing about the person is public until the organisation publishes an opportunity for them. For an adult, the opportunity shows their name, its description and, if one is added, a photo. For someone under 18, sponsors see only their first name and the first letter of their last name and the opportunity's description: never their age, date of birth, contact details or a photo, and nothing that says they are under 18.

Someone under 18 can be recorded only with the permission of a parent or guardian with parental responsibility. The organisation records the parent or guardian's name and the month and year the young person turns 18, and confirms that a parent or guardian has given permission, that its safeguarding policy covers the profile and that the young person understands and agrees. It reviews that permission at least every six months. From the first day of the month they turn 18, the profile is hidden until the organisation records their own permission as an adult.

The person, or for someone under 18 their parent or guardian or the young person, can withdraw permission at any time by asking the organisation, and the organisation stops the public use at once in SponsorshipNow. Sponsorships already agreed keep their records. Photos of an adult are stored encrypted and are shown only on an opportunity the organisation publishes with that photo. Photos of someone under 18 are never stored or shown.

Payments. If an organisation sets up online payments, Stripe collects what it needs to verify the organisation and pay it. We receive confirmation of payments, refunds and disputes and the account's status, never card numbers or bank log-in details. Plan payments to us are also made through Stripe.

Support and diagnostics. If you contact us, we keep your message and our reply. When something goes wrong in the service, it records an error report: the page, the time and technical details, with passwords, codes and similar secrets removed. We also record security events, such as sign-ins and failed attempts.

Cookies and browser storage. The service sets one cookie, which keeps you signed in. It is essential, cannot be read by scripts, and ends when you sign out or after 24 hours without activity. The service also stores a few display preferences in your browser, such as how a list is laid out or a notice you have dismissed; they stay on your device and are not sent to us. There are no advertising or marketing-tracking cookies or scripts in the service. App crash diagnostics are described below.

The iPhone and Android apps

On your phone. The apps keep downloaded workspace records and unsent changes in an encrypted database so that you can work without a connection. Downloaded images and documents are kept in the app's private storage, protected by your phone's operating system. Sign-in tokens and encryption keys use the phone's secure storage. This offline storage is excluded from device cloud backups. A person's private sponsorship-permission details are handled online and are not kept in the offline database.

Signing out on the phone removes the account's offline records and queued changes. If a session is ended remotely, downloaded records are removed, while unsent changes may be kept encrypted for up to seven days so that the same account can sign back in and review them. They are not sent automatically. Signing in as a different account removes them.

Optional permissions. You can choose to use your phone's biometric unlock; SponsorshipNow receives only the result, never your face or fingerprint data. The app asks for camera or photo access when you choose to add an image. It does not read your contacts or track your location.

Notifications. If you enable push notifications, we register a push token for your device and use Expo's push service, Apple's Push Notification service on iPhone and Google's Firebase Cloud Messaging on Android to deliver them. These providers receive the delivery token and notification payload. You can turn notifications off in your phone's settings.

Crash diagnostics. The apps use Sentry, in its European Union region, to help us find and fix faults. Reports contain technical information such as the error type and code location, screen name, app and operating-system versions and phone model. Sentry also records session status and diagnostic installation identifiers to measure crashes. We do not attach your sponsorship records, passwords, screenshots or session replays. Sentry is configured not to store IP addresses. These diagnostics are used to keep the app reliable, not for advertising.

4. Why we process it and on what basis

• To provide the service you asked for: performance of our contract with you.
• To send service emails such as sign-in links, verification codes, invitations, enquiry notices, billing notices and replies to support requests: performance of the contract. We do not send marketing email.
• To support you and fix problems, using your messages and error reports: our legitimate interest in running a reliable service.
• To keep the service secure and prevent abuse, including rate limiting, security events and the action history: our legitimate interest in running a safe service.
• To keep the service working and fast, using the service's request log and page-load timings in aggregate (how many requests each part of the service receives, how quickly it answers, how long its pages take to load in the browser, and its errors): our legitimate interest in running a reliable service. We do not use it to follow what any one person does.
• To count visits to this website and see which of our links lead to new accounts, using the visit counter and the campaign name saved with an account: our legitimate interest in knowing which channels work.
• To measure this website and our ads with the analytics and advertising cookies described in section 2: your consent, which you can withdraw at any time with “Cookie settings”.
• To meet legal obligations, such as keeping records of invoices and payments: legal obligation.

5. Who we share it with

Only with the providers we need to run the service, each under a contract:

• DigitalOcean: hosting and the database, in London;
• Brevo: sending the service's emails;
• Backblaze: storing our encrypted backups, in its EU Central region (Amsterdam);
• Google Workspace: our own mailbox, for messages you send us;
• Sentry (Functional Software, Inc.): app crash diagnostics in its European Union region;
• Expo, Apple and Google Firebase: delivering app notifications when you enable them;
• Cloudflare: hosting this website and counting its visits;
• PostHog: this website's analytics, only if you accept them (section 2).

Stripe processes payments as an independent controller for its own purposes, under its own privacy policy. If you accept this website's advertising cookies, Meta and Google receive the data described in section 2, and use it for their own purposes too, under their own privacy policies. We do not sell personal data, and the service shares none with advertisers.

Sponsors and organisations share information with each other through the service by design: a proposal sent to a Sponsor contains the organisation's details, and an accepted agreement with its invoices and reports is visible to both.

6. International transfers

The SponsorshipNow service and its database run on DigitalOcean in London. Brevo stores email data, and Backblaze our encrypted backups, in the European Union. Stripe, Google, Expo and Apple, and Meta and PostHog for this website if you accept its cookies, may process data in the United States and elsewhere; where any provider transfers personal data outside the UK, its contract with us includes the safeguards UK law requires. Our backups are encrypted on our own server before they are sent to Backblaze, and only we hold the key.

7. How long we keep it

• Your account: for as long as it is open. If you ask us to delete your sign-in account, we do so within one month, apart from the records below that must be kept.
• A closed organisation: disabled at once; an Admin can reopen it within 30 days; then its data is deleted.
• Invoices and payment records: at least six years after the end of the financial year they relate to, as UK tax law requires.
• Accepted agreements, with the minimum identity and acceptance record: seven years after the sponsorship ends or its last payment, whichever is later, then reviewed for deletion.
• Proposals: an unsent draft 90 days after it was last edited; a declined, expired or withdrawn proposal 12 months after it ended. Email verification codes are erased within 24 hours of use or expiry.
• Website error reports and security events (sign-ins, refused sign-in attempts, and the network address and browser recorded with a change to an account or an organisation's records): 12 months. After that, the record of a change keeps only what was changed, by whom and when.
• The service's request log (each request's network address, time, the part of the service asked for and its response): 30 days.
• Native app crash diagnostics: Sentry keeps error reports for 30 days.
• This website's analytics, if you accept them: PostHog keeps what it records for 12 months. Meta and Google keep what they receive under their own policies.

Where we keep a record after the reason for its personal details has passed, we reduce those details to what the record still needs. Server logs on our host are rotated automatically and kept only briefly. We measure the service's use and speed in totals only; the service has no advertising or marketing-tracking tools. The apps also use the crash diagnostics described in section 3.

Backups. We take an encrypted backup every day. Each is kept for 35 days and then deleted, so data deleted from the service has left our backups within about five weeks. DigitalOcean also keeps its own short-term backups of the database. When permission for a person presented for sponsorship is withdrawn, or they ask for their data to be erased, the decision is recorded separately, by reference number only, so that restoring a backup cannot bring their data back into use.

8. Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict processing, and ask for your data in a portable format. Email privacy@patronnow.app; we respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

If your data is held by an organisation in its SponsorshipNow workspace, that organisation is the controller, so contact it first. We will help it answer you.

Deleting your SponsorshipNow account

• In the SponsorshipNow app: open Account (the cog), then Sign-in and security, then Delete account, and confirm with your password (and your security code if two-factor is on).
• On the website: sign in to SponsorshipNow on the web, open Settings, then Delete account, type DELETE and confirm.
• By email: write to privacy@patronnow.app from the address on the account.

Your account closes at once: you are signed out everywhere and cannot sign in again. Your name, email address, sign-in details and other account data are erased 30 days later; within those 30 days you can ask us to cancel. If you are the only Admin of an organisation, add another Admin or close the organisation first. Invoices, receipts and agreements your organisations hold are kept for the periods in section 7, without your name.

9. Children

SponsorshipNow is not directed at children. Accounts are for adults acting for an organisation. An organisation may record someone under 18 for sponsorship only with a parent or guardian's permission and under the stricter rules in section 3; otherwise organisations should not enter children's personal details in SponsorshipNow.

10. Changes

We will post changes here, with the date at the top, and email account holders about material changes before they take effect.