Privacy Policy
Last updated: 27 October 2026
This Privacy Policy explains what personal data sponsors.page collects, why, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
The data controller is:
- Gonzalo Rodriguez Gonzalez-Salamanca, self-employed (autónomo), trading as sponsors.page
- NIF: 70423377E
- Address: Calle Cervantes 4, 2º I, 28400 Collado Villalba, Madrid, Spain
- Email: support@sponsors.page
In this policy, “we” and “us” mean the controller above.
2. What we collect
Creators and brands (account holders)
- Account data (via Amazon Cognito): email address, user ID, account type (creator or brand) and sign-in data. If you sign in with Google, we receive your Google account email and basic profile details from Google.
- Profile and page content: what you enter, such as username, display name, bio, avatar, social links, deals, codes and brand details. Most of this is published on your public page.
- Instagram (only if you connect it): your Instagram user ID, username, account type, follower count, media count, and the access token Instagram issues with its expiry date. We use these only to confirm that the account is yours and to decide whether to show a verified Instagram badge. We do not read your posts, comments or messages, and we never show the token to anyone.
- Support emails: the content of messages you send us.
Visitors to creator pages
- Views and clicks: when you view or click a deal, we record the creator, the deal, the time, a salted hash of your IP address (not the IP itself), your browser’s user agent and the referring page. A hashed IP is still personal data, so we protect it like other personal data.
- Bot checks: clicks may be checked with Cloudflare Turnstile, which processes technical data about your browser and device to tell people from bots.
3. Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, public page and dashboard | Performance of our contract with you (Art. 6(1)(b)) |
| Recording visitor views and clicks to give creators and brands statistics | Our legitimate interest, and that of creators and brands, in measuring how offers perform (Art. 6(1)(f)) |
| Security, rate limiting, bot checks and fraud prevention | Our legitimate interest in keeping the Service and its users safe (Art. 6(1)(f)) |
| Instagram verification badge | Your consent when you connect Instagram (Art. 6(1)(a)). You can withdraw it at any time by disconnecting |
| Improving the Service, using aggregated statistics on how features are used | Our legitimate interest in improving the Service (Art. 6(1)(f)) |
| Answering support requests | Contract or legitimate interest, depending on the request |
| Meeting legal obligations, such as tax records if fees apply | Legal obligation (Art. 6(1)(c)) |
You need to provide your email address to create an account. Everything else in your profile is optional.
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share data with
We use these service providers (processors), which act on our instructions:
- Amazon Web Services (hosting, storage, authentication through Amazon Cognito, email). Region: eu-west-1 (Ireland)
- Cloudflare (Turnstile bot checks on public deal clicks). Cloudflare’s processing for Turnstile is described in the Cloudflare Turnstile Privacy Addendum, which forms part of how visitor technical data may be handled for human verification.
If you choose to use them, these providers act under their own privacy policies:
- Google (Google sign-in)
- Meta / Instagram (Instagram Login)
Your public page is visible to anyone on the internet. We may disclose data to authorities when the law requires it.
5. International transfers
Google, Meta and Cloudflare are based in the United States, and some AWS services may process data there. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the provider is certified, or on the Commission’s standard contractual clauses. You can ask us for more information.
6. How long we keep data
- Account and profile data: while your account is active. We delete it within 30 days of a deletion request.
- Instagram data: deleted immediately when you disconnect or remove the app in Instagram.
- Raw view and click logs: up to 12 months. After that they are deleted or kept only as aggregated statistics that do not identify anyone.
- Security and abuse records: up to 12 months, or longer if needed for an ongoing investigation or legal claim.
- Support emails: up to 2 years after the conversation ends.
- Billing records, if fees apply: as long as tax law requires (generally 4 to 6 years in Spain).
7. Cookies and similar technologies
We only use storage that is strictly necessary to run the Service: sign-in session tokens and Cloudflare Turnstile’s bot checks. Under Article 22.2 of the LSSI-CE, these do not need consent. We do not use advertising or third-party analytics cookies. If that changes, we will ask for your consent first.
8. Your rights
You have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- have your data erased;
- restrict how we process your data;
- receive data you gave us in a portable format;
- withdraw consent at any time, without affecting processing that took place before; and
- lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with your local supervisory authority.
Right to object: where we rely on legitimate interests (Section 3), you can object at any time on grounds relating to your particular situation. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
To exercise your rights, email support@sponsors.page from the email address on your account. Visitors can write from any address. We reply within one month, and may ask you to verify your identity.
9. How to delete your data
Remove Instagram data
- On sponsors.page, open your dashboard and click Disconnect on the Instagram card. Your Instagram data and access token are deleted right away, and the badge is removed.
- Or, in Instagram, go to Settings, then Apps and websites, and remove sponsors.page. Instagram notifies us and we delete the same data automatically.
Delete your account Email support@sponsors.page from your account’s email address. We will delete your account, profile, deals and connected Instagram data within 30 days and confirm by email.
10. Children
You must be 18 or over to create an account. We do not knowingly collect personal data from children. If you think we have, contact us and we will delete it.
11. Security
We use encryption in transit, access controls and hashing of visitor IP addresses to protect personal data.
12. Changes
We may update this policy. We will change the “Last updated” date, and we will email account holders before any material change takes effect.
13. Contact
support@sponsors.page Gonzalo Rodriguez Gonzalez-Salamanca, Calle Cervantes 4, 2º I, 28400 Collado Villalba, Madrid, Spain