Privacy Policy

Who we are

SponsorMonster is published by Sico Software Ltd, a company registered in Scotland. We help YouTube creators price and land brand sponsorships — generating a rate card and media kit from your channel data and listing you in a brand-discovery network. We are registered with the UK Information Commissioner's Office (ICO). Privacy questions: privacy@sico.software.

Data we collect

Account data. When you register, we store your email address via our authentication provider (SuperTokens).

YouTube channel data. When you connect your channel via Google OAuth (read-only), we read and store public channel statistics — title, subscriber count, average views, engagement rate, and topic/niche categories. We store encrypted Google access/refresh tokens so we can refresh these stats.

Rate card & media kit. The AI-generated rate card (CPM floor, integration rates, niche multiplier) and the media-kit PDFs you generate, including a shareable token for public media-kit links.

Profile & contact. Your contact email and chosen niche/vertical, and your opt-in choice for the brand-discovery network.

Billing data. Your plan and subscription status. Card details are handled by Stripe — we never see or store them.

We do not store payment card details. Any subscription billing is handled directly by Stripe.

How we use your data

• To generate your rate card and media kit from your channel data
• To list you (if you opt in) in the brand-discovery network so brands can find you
• To show you brands sponsoring creators in your niche
• To process your subscription and send transactional emails (account, billing)

AI processing. Your channel statistics (subscriber count, average views, engagement, niche) are sent to Anthropic's Claude API to generate your rate card. This is core to how the service works. Anthropic processes this data as our sub-processor under a data processing agreement; they do not use your data to train their models by default. See Anthropic's privacy policy at anthropic.com/privacy. The lawful basis for this processing is contract performance — it is necessary to deliver the service you signed up for.

Brand-discovery network

If you opt in (free), your creator profile — channel name, niche, public stats, rate-card summary, and a media-kit link — is made discoverable to brands and their agencies searching the SponsorMonster creator index. You can leave the network at any time from your settings; we then stop sharing your profile with brands. Opting out does not delete your account.

Public media-kit links use an unguessable token. Anyone with the link can view that media kit without logging in — share it only with brands you intend to reach.

Data sharing

We do not sell your data. We share data only with sub-processors required to operate the service:

• Google LLC — YouTube OAuth + Data API. With your consent we read your public channel statistics to build your rate card and media kit.
• Anthropic, PBC — AI model provider. Your channel statistics are processed by Claude to generate your rate card.
• Stripe, Inc. — Payment processing. Stripe handles subscription billing; we store only your plan status.
• DigitalOcean (Spaces) — Object storage. Your generated media-kit PDFs are stored here and served via signed links.
• SuperTokens Inc. — Authentication provider. Your email address is stored for login and session management.
• Hetzner Online GmbH — our VPS provider (Germany, EU). All personal data is stored on this server.
• Resend Inc. — transactional email (account and billing notifications).
• PostHog Inc. — product analytics (page views, feature usage; no personal data).
• Sentry Inc. — error monitoring (stack traces; personal data scrubbed before transmission).

Data retention

We retain your personal data for as long as you hold an active account. You can delete your account at any time from your billing page — all personal data is erased immediately. To request deletion by email instead, contact privacy@sico.software with the subject line "Delete my data" and we will action it within 30 days.

Financial records. Payment transaction records (amount, date, product, and Stripe reference) may be retained for up to 6 years after the end of the tax year in which the transaction occurred. This is required by UK law (HMRC record-keeping obligations) and is exempt from the right to erasure under UK GDPR Article 17(3)(b). These records do not contain your CV, career data, or any application-level personal data.

Deletion audit log. When an account is deleted we record a timestamped entry containing a masked email address (e.g. "s*****n@example.com"), your anonymised account reference, and the deletion timestamp. This log has no expiry — it is the evidence we would produce to the ICO if asked to demonstrate that we honoured your erasure request.

Your rights under UK GDPR

As a UK resident you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interests

To exercise any right, email privacy@sico.software. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

Security

All data is transmitted over TLS. Our server (Hetzner, Germany) is access-controlled via SSH key and Tailscale VPN. Integration credentials and API keys are encrypted at rest using pgcrypto symmetric encryption.

Cookies

We use one strictly necessary session cookie to keep you logged in. We do not use advertising or tracking cookies. PostHog analytics uses a first-party cookie; it does not track you across other sites.

Changes to this policy

Material changes will be communicated by email and by updating the effective date above. Continued use of the service after notification constitutes acceptance.