Privacy policy
Version 0.9-prelaunch (10 July 2026) · Applies to sponsorfort.com and the SponsorFort web and mobile applications. “In short” lines are plain-English summaries; the full text of each section is what applies.
1. Who we are and the two roles we play
In short: For your workers' records, your employer is in charge and we act on its instructions; for your own account and billing details, we are in charge and this policy explains how.
SponsorFort (“we”, “us”) is sponsor-licence compliance software operated by the SponsorFort founding team; the operating company's registered details (legal name, company number, registered office) will be published here, and customers notified, before any payment is taken. Our Information Commissioner's Office (ICO) registration reference will be published here once registration completes — before any real customer data is processed at scale. Contact for anything in this policy: privacy@sponsorfort.com.
We process personal data in two distinct roles:
- As processor — for the records your organisation enters about its own staff, workers and candidates. Your organisation is the controller; we act only on its instructions under the Data Processing Agreement. If you are a worker whose employer uses SponsorFort, direct any questions or rights requests to your employer first — we will assist them.
- As controller — for account, billing, website, support and marketing data described below.
2. What we collect, why, and our lawful basis (as controller)
In short: Account, billing and support data to run the service; analytics only if you consent; no advertising use and no selling of personal data — ever.
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Account data — name, work email, password hash, role | Sign-in, security, team management, service messages | Contract (Art. 6(1)(b)) |
| Billing data — plan, invoices, VAT number (card details are held by Stripe, never by us) | Payments, VAT invoicing, fraud prevention | Contract; legal obligation (tax records) |
| Audit log — who did what and when, IP address | Security, tenant isolation, compliance record-keeping | Legitimate interests (protecting the service and our customers' records) |
| Support correspondence | Answering you; improving the service | Contract; legitimate interests |
| Readiness-check answers and email (the free tool) | Sending your results; rule-update emails only if you opt in | Contract (sending what you asked for); consent for updates |
| Product analytics events (PostHog EU) | Understanding which features help sponsors | Consent (see the cookie policy) |
| Error diagnostics (Sentry) | Finding and fixing faults | Legitimate interests (a working, secure service) |
| Business-contact data of prospective customers — name, role, work contact details — compiled from public and official sources (the GOV.UK register of licensed sponsors, Companies House, company websites) | Business-to-business marketing about sponsor compliance | Legitimate interests (Art. 6(1)(f)) — relevant, proportionate outreach to businesses about duties they hold; you can object or unsubscribe at any time and we maintain a suppression list |
We do not use personal data for advertising, we do not sell personal data, and this service is for businesses — it is not directed at children.
3. Where data lives and international transfers
In short: Your records live encrypted in a UK data centre. The mobile app keeps no compliance records on your phone — only your sign-in session, in the device's secure storage.
Application data and uploaded documents are stored in the United Kingdom (London, AWS eu-west-2, via Supabase), encrypted in transit and at rest. Where a subprocessor processes limited data outside the UK, the transfer relies on a UK adequacy regulation or the UK International Data Transfer Agreement / Addendum to the EU SCCs.
The mobile app fetches records over an encrypted connection and does not store compliance records on the device. It keeps only your sign-in session, held in the operating system's secure storage (iOS Keychain / Android Keystore), and contains no advertising or analytics SDKs. Signing out removes the session from that device.
4. Subprocessors and recipients
- Supabase — database, authentication, file storage (London, UK)
- Vercel — application hosting and delivery (EU/USA)
- Stripe — payments, invoicing and VAT (EU/USA)
- Resend — transactional email (EU/USA)
- PostHog — product analytics, EU cloud (only with consent)
- Sentry — error monitoring (EU/USA)
- Anthropic — optional AI drafting of report text (USA; only when the feature is enabled by your organisation)
We may also disclose data where the law requires it, or to professional advisers under confidentiality. The current list always lives on this page; DPA customers receive 30 days' notice of changes.
5. Retention
In short: We keep data only as long as the purpose (or tax law) requires — and delete your account and data explains exactly how to remove everything.
- Organisation data (processor role): kept while the subscription is active, then 90 days for export, then deleted. Owner-initiated deletion requests are executed after a 7-day grace period.
- Account data: deleted with your account, subject to the audit and billing items below.
- Billing records: 6 years (UK tax law).
- Audit logs: up to 6 years (they are the compliance record our customers rely on).
- Readiness-check data: deleted on request, or after 24 months of inactivity.
- Prospect data: deleted on objection/unsubscribe (suppression entry retained so we don't contact you again).
6. Your rights
In short: Ask us for a copy of your data, corrections, or deletion at privacy@sponsorfort.com — we answer within a month, and objecting to marketing always works.
Under UK GDPR you can ask for access, rectification, erasure, restriction, portability, and can object to processing based on legitimate interests (including marketing, where objection is absolute). Where consent is the basis you can withdraw it at any time. Write to privacy@sponsorfort.com — we respond within one month. Where we act as processor we will pass your request to your employer (the controller) and assist them. Self-serve steps for removing your account and organisation data are on delete your account and data.
7. Complaints
If you are unhappy with how we handle your data, complain to us first at privacy@sponsorfort.com. In line with the Data (Use and Access) Act 2025 we will acknowledge your complaint within 30 days, investigate it, and reply without undue delay. You also have the right to complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — at any time.
8. Automated decision-making
SponsorFort makes no decisions producing legal or similarly significant effects about individuals by solely automated means. Compliance classifications are deterministic rules applied to data your organisation enters, and are presented for human review. The optional AI drafting feature produces draft text from facts already entered; a human reviews and submits everything.
9. Security
Measures include UK data residency, encryption in transit and at rest, per-organisation row-level isolation, role-based access, time-limited signed URLs for documents, append-only audit logging, and rate limiting. Report security concerns to security@sponsorfort.com (see SECURITY.md in brief: we welcome responsible disclosure).
10. Changes
We will post changes here and email account owners about material changes at least 14 days before they take effect. Earlier versions are available on request.