YOUR DATA.
YOUR CALL.

01 / Who we are.

SponsorBody is run by Tehidea Ltd, a company registered in England and Wales under number 05902165, with its registered office at 86-90 Paul Street, London, England, EC2A 4NE. Tehidea Ltd decides why and how your personal data is used, which makes it the controller.

Write to [email protected] about anything on this page. That address reaches the people who can act on it.

02 / What your account holds.

If you request a launch notification, we store your email, language, signup source, consent time and confirmation status. We send a confirmation link before the launch notification. Confirmation links use hashed tokens that expire after seven days. This does not create an account. You can withdraw your consent by writing to [email protected].

Your account holds your email address, your name, whether that address is verified, and a link to a profile image if you give one. Your password is never stored as you typed it; we keep only a hash of it. We need all of this to open your account and let you sign in, so we process it to perform our contract with you.

Confirming your address and resetting your password work differently. A confirmation link stays valid until the expiry stored with it, so opening it twice is harmless. A password-reset link is consumed the moment it is used: the record is taken and the link will not work again.

You sign in with an email address and a password. SponsorBody has no social login, so no other platform tells us who you are.

03 / Keeping your account safe.

Each sign-in creates a session that records the address you connected from, the user agent your browser sends, a session token and an expiry seven days ahead. An IPv6 address is truncated to its /56 network before it is stored. That is less precise than the whole address, but it still identifies the connection one household or office uses, and it is kept alongside the session.

We also count sign-in, sign-up, password-reset and verification attempts against a key derived from that address. In production those counters sit in our database; everywhere else they live only in memory.

This is how we stop password guessing and abuse of the sign-up form. We rely on our legitimate interest in keeping accounts and the service secure, and you can object to it at any time.

04 / What athletes publish.

A published athlete profile needs six things: a display name, a page address, a biography, a category of fighter or athlete, a body model of male or female, and a location. Without them there is no page to show, so those six are the profile.

You can add more if you want the page to say more: a nickname, a sport, a birth year, a fight record, a country, your height, a build, a link to a social profile and a link to a photo. Everything a profile holds, required or added, appears on your public page, which anyone can read.

You publish a profile so that sponsors can find you and judge a placement, which is what the six required fields are for. Publication rests on your consent, and you withdraw it by writing to [email protected] and asking us to unpublish or delete the profile. We do that within 48 hours. There is no button for it yet, and that is a gap we are closing.

SponsorBody stores no photographs. A profile photo is an https address you supply, and the image itself stays on whatever service hosts it. That service, not us, sees the traffic when someone loads it.

05 / What sponsors and brands give us.

A campaign records the event name, the place, the date, the time bidding closes, a description, and the moment the athlete confirmed that the event and their existing sponsors allow the placement.

A bid records who placed it, the amount, the brand name, the brand website address, a logo address and how the creative review ended. Delivery evidence records a link to the proof, a note and the decision taken on it. The note is required and runs from 10 to 2,000 characters. We process all of it to perform the contract you entered.

A winning sponsor’s brand name and approved logo become public on the athlete’s page, because that is what the placement is. Creative details and delivery evidence are shared with the people taking part in that campaign — the athlete and the sponsor — and with nobody else.

Logos and proof links work the same way as profile photos: you supply an https address and the file stays where you host it.

06 / Payments.

Payments are not switched on. When they are, your full card number and your security code will never reach SponsorBody — your browser sends them to Stripe. We read back only the card metadata Stripe exposes to us, such as the expiry and the last digits.

We will also store the Stripe identifiers for your customer record, your payment method and your connected account, the time and version of the consent you gave, and the identifiers, amount and status of each checkout session, payment intent, transfer, refund and transfer reversal. We will update this page before the first live charge.

07 / Cookies.

Signing in sets one cookie, __Secure-better-auth.session_token. It is HttpOnly, so no script on the page can read it. It is SameSite=Lax, which means it travels with a top-level navigation to SponsorBody but never with a cross-site request made by another site. It is served over HTTPS only.

That is the only cookie we set. There is no session_data cookie, because the cookie cache is off, and no language cookie: the language is in the address, as /en or /pl.

A session renews when you use it, at most once a day, and expires seven days after its last renewal. Signing out ends it immediately.

While you are signing up, your browser holds your email address in sessionStorage under zera:pending-verification-email, so the button that resends the confirmation link knows where to send it. Pressing that button sends the address to us, which is the whole point of it. The entry goes when you close the tab.

All of that is strictly necessary to run the service, so the law does not require us to ask for consent and there is no cookie banner. We set no advertising cookies, no profiling cookies and no cross-site trackers.

08 / How we measure traffic.

We count page views with Umami, which Tehidea hosts on its own infrastructure at umami.tehidea.cloud rather than sending the numbers to an analytics company. It sets no cookies and writes nothing to your device, it is limited to the SponsorBody domains, and it drops the search terms from an address before recording it.

The tracker honours your browser’s Do Not Track setting. It also has a switch of its own, and this is it.

Choosing "Do not measure my visits" stores one flag and measurement stops at once. The flag belongs to this site in this browser, so it does not carry to www.sponsorbody.com, to another browser, or to another device — make the choice again there. A change applies to new page loads; in-page navigation follows the tracker’s current state, and the switch tells you which that is.

Measurement tells us which pages are read and where readers arrived from. It builds no profile of you and it feeds no advertising network. We rely on our legitimate interest in knowing which pages earn their place, and you can object with the switch above or by writing to [email protected].

We run no error tracking and no other third-party scripts.

09 / Who else handles your data.

Every request reaches us through Cloudflare, which provides our DNS and our edge proxy and therefore sees the connection details of each one. Cloudflare handles that under its data processing agreement, which incorporates the Standard Contractual Clauses.

The site and its database run on a Hetzner virtual server in the EU, deployed and managed with Dokploy. Tehidea administers that server.

Transactional email — confirming your address, resetting your password and confirming account deletion — is delivered through Resend, or through Resend-compatible mail infrastructure that Tehidea hosts itself. The provider’s data processing agreement incorporates the EU Standard Contractual Clauses and the UK Addendum or IDTA.

Analytics runs on Umami, self-hosted by Tehidea. No third party receives it.

When payments launch, Stripe will process them for us and will at the same time be a controller in its own right for the anti-fraud and reporting duties the law puts on it, under the Stripe data processing agreement. We do not sell your data and we share none of it for advertising.

10 / How long we keep things.

Account data — your email address, your name, your profile and your sign-in credentials — is deleted when your account is deleted.

Sessions expire as the cookie section describes. A clean-up job deletes sessions and verification records once they have passed their expiry; the operator schedules that job, so how often it runs depends on that schedule.

Financial records, meaning payments and payouts, are kept for six years from the end of the company financial year they fall in, which is what UK company law requires. Polish accounting records are generally kept for five years, counted from the start of the year after the one they concern.

Campaign, bid and delivery-evidence records are kept while a sponsorship is live and for six years after it is settled, so that a dispute about the contract can still be answered. After that we anonymise them: the figures stay, the person does not.

Raw visit data on our own Umami server is kept for twelve months and then reduced to totals that name nobody.

Nothing else has an automatic clean-up. To find out what is held about you, ask at [email protected].

11 / Deleting your account.

You can delete your account from your profile page. We email you a link to confirm it, because deletion cannot be undone. Deleting removes your sessions, your sign-in credentials and your athlete profile.

If any sponsorship or payment record still refers to you — a campaign you own, a payment account, a payment, a bid, a leading bid, or delivery evidence you reviewed — the deletion is refused outright and nothing is removed. Those records are part of other people’s bookings as well as yours, so they cannot leave with your account.

When that happens, write to [email protected]. We will tell you what is held, remove whatever is no longer needed, and anonymise the rest once its retention period has run out.

12 / Your rights.

Under the UK GDPR and the EU GDPR you can ask for a copy of your data, take it elsewhere in a machine-readable form, ask us to correct it, ask us to delete it, ask us to pause a particular use, object to anything we base on legitimate interest, and withdraw any consent you gave. Withdrawing consent does not undo processing that was lawful before you withdrew it.

"Download my data" on your profile page gives you your account, your profile and your sponsorship records as JSON, on the spot. For anything else, email [email protected] and we will answer within one month.

You can complain to a supervisory authority at any time, whether or not you have raised the matter with us first. In Poland that is the Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa. In the United Kingdom it is the Information Commissioner’s Office, at ico.org.uk. You may also complain to the authority where you live or where you work.

13 / Moving data between the UK and the EU.

Tehidea Ltd is established in the United Kingdom and our servers are in the EU, so personal data crosses between the two. Where a transfer leaves the UK or the EEA, we rely on the safeguards in each provider’s data processing agreement, which incorporate the EU Standard Contractual Clauses and the UK Addendum or IDTA.

Ask at [email protected] which safeguard covers a particular transfer and we will tell you.

14 / Adults only.

SponsorBody is for adults. You confirm that you are 18 or older when you create an account, and campaigns and profiles are for adults only.

A profile stores a birth year, not a date of birth, so the age we can check is accurate to the calendar year and no finer. We do not knowingly collect data from anyone under 18, and we delete it if we find that we have.

15 / Changes to this policy.

When what we do changes, we change this page and the date at the top of it. If a change matters to you, we will say so rather than leave you to spot it.

Questions go to [email protected].