Privacy Policy | Sponsorboard

This Privacy Policy explains how Sponsorboard (“we,” “us,” or “our”) collects, uses, and shares your personal data when you visit getsponsorboard.com, join the waitlist, contact us, or sign up for our newsletter.

1. Who we are (data controller)

Sponsorboard is a trading name of FWRD Digital (sole proprietorship, owned by Wesli Miggels), based in Utrecht, the Netherlands (full registered address available on request), registered with the Dutch Chamber of Commerce (KvK) under number 42057087, VAT ID NL005461307B53.

We are the data controller for the personal data described in this policy.

Privacy enquiries: [email protected]

2. What data we collect

Sponsorboard is in early access. The website collects only what’s needed for waitlist signups, brand enquiries, the newsletter, and keeping the site secure. The full Platform (creator and brand accounts, deal management, DMs) is not live yet — when it launches, we will update this policy to cover the additional data those features collect before they go live.

When you join the creator waitlist, we collect:

Name and email address (required)
Channel or handle (required)
Audience size band (optional)
How you heard about Sponsorboard (optional)
The country your request came from, derived from your IP address at submission (via Cloudflare’s CF-IPCountry header)

When you request access as a brand via the waitlist, we collect:

Name and email address (required)
Company name (required)
Monthly sponsorship budget band (optional)
A short message about your campaigns (optional)
The country your request came from, derived from your IP address at submission

Brand contact form (/for-brands)

When you submit the contact form on /for-brands, we collect:

Brand name and email address (required)
Website URL, industry, campaign goals, monthly budget band, and message (all optional)
The country your request came from, derived from your IP address at submission

When you sign up for the newsletter in the site footer, we collect:

Your email address
A record that you asked to receive the newsletter (the signup itself is your consent), with the date and time
The country your request came from, derived from your IP address at submission

All visitors (automatically)

IP address and approximate location, processed by Cloudflare’s network. Sponsorboard itself only keeps the country derived from your IP, and only when it’s attached to a form submission.
Browser type and version (in transient server logs only)
Pages visited and time on site — only if you accept analytics in the cookie banner (see Google Analytics 4 below)
Referrer URL
Cloudflare Turnstile interaction signals for bot protection on every form (waitlist, brand contact, newsletter) — see our Cookie Statement

3. How we use your data

Purpose	Legal basis (GDPR)
Managing the waitlist and inviting you to early access	Pre-contractual steps — Art. 6(1)(b)
Responding to brand enquiries	Pre-contractual steps — Art. 6(1)(b)
Sending you the newsletter	Consent — Art. 6(1)(a)
Notifying our team about new submissions	Legitimate interest — Art. 6(1)(f)
Understanding which countries signups come from (aggregate, from `CF-IPCountry`)	Legitimate interest — Art. 6(1)(f)
Preventing spam, fraud, and abuse (Cloudflare, Turnstile)	Legitimate interest — Art. 6(1)(f)
Aggregate site analytics (GA4)	Consent — Art. 6(1)(a)
Complying with legal obligations	Legal obligation — Art. 6(1)(c)

We send the newsletter only to people who signed up for it. You can unsubscribe at any time with the unsubscribe link in every newsletter email, or by emailing [email protected]. Unsubscribing does not affect anything we sent before. We don’t share the list with anyone except the processors in Section 4 that we need to store it and send the emails.

4. Third-party processors

We use the services listed below to run the website and handle your submissions. Each processor is bound by a data processing agreement (DPA) and processes personal data only on our documented instructions.

Sanity (sanity.io)

Sanity is our content management system. We use it in two ways:

Storing marketing copy and page content — the public content of the website itself, edited in the Sanity studio.
Receiving and storing form submissions — when you submit any of our forms (creator or brand waitlist, brand contact form, newsletter), the submission (your name if given, your email address, the form fields you filled in, the form type, the timestamp, whether you signed up for the newsletter, and the CF-IPCountry value at submission) is stored as a document in Sanity. The Sponsorboard team reads and follows up on these in the studio.

Form submissions are written by a server-only access token that can only create submission documents. Submissions are not published on the website.

Data location: EU / US (Standard Contractual Clauses — Module 2 — in place)
Sanity Privacy Policy: https://www.sanity.io/legal/privacy

Cloudflare

We host the website on Cloudflare Pages and rely on Cloudflare’s network for performance, reliability, and security. Cloudflare processes visitor IP addresses, request headers, and traffic metadata for routing and DDoS protection, and tells us the country a form submission came from.

We also use Cloudflare Turnstile on all of our forms (waitlist, brand contact, newsletter) to block automated submissions. Turnstile runs a privacy-preserving challenge — it does not set tracking cookies or build a cross-site profile. See our Cookie Statement for details.

Data location: Global CDN (EU nodes served where possible); Standard Contractual Clauses (Module 2) in place
Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

Resend (resend.com)

We use Resend to send email: notifications to our team when you submit a form, and the newsletter. Resend processes your email address and the content of each email to deliver it.

Data location: US (Standard Contractual Clauses — Module 2 — in place)
Resend Privacy Policy: https://resend.com/legal/privacy-policy

Google Analytics 4 (Google Ireland Limited)

Google Analytics 4 (“GA4”) gives us aggregate, anonymised insight into how the site is used — which pages are viewed, session duration, device class, and general traffic geography. GA4 is loaded through Google Tag Manager and fires only after you give consent through the cookie banner.

Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing for Sponsorboard’s account is governed by the Google Ads Data Processing Terms (the “Google DPA”), which we have accepted.
Purpose: aggregate, anonymised usage analytics. No advertising features, no Google Signals, no remarketing audiences, no user-ID stitching, no cross-product linking.
Configuration: IP anonymisation on; Google Signals off; ad personalisation off. We use Google Consent Mode v2 in its “basic” form: neither Google Tag Manager nor GA4 is loaded until you opt in via the cookie banner, and when it loads, all advertising storage is set to “denied” and only analytics_storage is set to “granted”. If you reject analytics, or later withdraw consent, the tag is not loaded and we delete any _ga, _ga_* and _gid cookies on getsponsorboard.com.
Event-data retention in GA4: 14 months. After 14 months, Google deletes the event-level records associated with your visit.
Legal basis: consent — Art. 6(1)(a) GDPR + Article 5(3) ePrivacy Directive (as implemented in the Dutch Telecommunications Act). You can withdraw at any time via the “Cookie settings” button in the footer.
International transfer: GA4 processing involves data centres in the United States. Transfers rely on (i) Google’s certification under the EU-US Data Privacy Framework, and (ii) Standard Contractual Clauses (Module 2 — controller to processor) under GDPR Article 46 as a fallback.
More information: Google Privacy Policy · Safeguarding your data — Google Analytics Help

5. Data retention

Data type	Retention
Waitlist signups (creator and brand)	Until you’re invited to the Platform or ask to be removed, and no longer than 24 months from submission
Brand contact form submissions	12 months from submission, unless the enquiry leads to a working relationship
Newsletter subscription	Until you unsubscribe; we then delete your address, apart from a minimal record that you unsubscribed so we don’t email you again
Server and access logs	30 days
Email delivery logs (Resend)	Per Resend’s retention policy

We review and purge data at these intervals. You may request earlier deletion — see Section 7.

We do not sell your personal data. We share data only:

With the processors listed in Section 4, under the terms described
With law enforcement or regulatory authorities where legally required
In the event of a business transfer such as a merger or acquisition — you will be notified beforehand

7. Your rights

If you are in the EU/EEA or UK, you have the following rights under GDPR / UK GDPR:

Access — request a copy of the data we hold about you
Rectification — ask us to correct inaccurate data
Erasure — request deletion (the “right to be forgotten”)
Restriction — ask us to limit how we use your data
Portability — receive your data in a structured, machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — where processing relies on consent (newsletter, analytics), withdraw it at any time without affecting earlier processing

To exercise any of these rights, email [email protected]. We respond within one month.

You also have the right to lodge a complaint with your national data protection authority. In the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. International transfers

Some of our processors (Cloudflare, Resend, and for some data Sanity and Google) process data in the United States. Transfers outside the EEA are covered by Standard Contractual Clauses (SCCs) under GDPR Article 46 — specifically Module 2 (controller to processor) — and, where the processor is certified, by the EU-US Data Privacy Framework. We have assessed these transfers in light of the Schrems II judgment and current EDPB guidance. Copies of the applicable SCCs are available on request at [email protected].

9. Children

The website and waitlist are not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has submitted personal data to us, contact [email protected] and we will delete it promptly.

10. Changes to this policy

If we make material changes, we will notify the people affected (for example waitlist and newsletter subscribers) by email at least 14 days before those changes take effect. The “last updated” date at the top of this page reflects the most recent revision.

11. Contact

Privacy enquiries and data subject requests: [email protected]

We have not appointed a Data Protection Officer (DPO); at our current scale and type of processing, GDPR Article 37 does not require one. Send any privacy question to [email protected] and it will reach the person responsible.

General questions: [email protected]