Privacy policy

1.Who we are

Sponsorbook is operated by Be a Goose, LLC, a California limited liability company (we, us, our). We are the controller of the personal data described in this policy, which covers www.sponsorbook.io, the Sponsorbook application, Chrome extension, and agent (MCP) interface.

Write to us about anything in this policy at privacy@sponsorbook.io, or by post at Be a Goose, LLC, 5716 Corsa Avenue, Suite 110, Westlake Village, CA 91362-7354.

2.Two kinds of data, handled differently

Almost every question about Sponsorbook and privacy comes down to which of these two things you mean.

Data about you, our customer

Your account, your workspace, your billing, how you use the product, and, if you connect one, your YouTube channel. Sections 3 to 5 cover this.

Data in the catalogue

Information about brands, the creators who disclosed sponsorships from them, and business contacts at those brands. Most of it is about companies rather than people, but some of it is personal data about individuals who are not our customers and never signed up. Section 6 covers this, and it is where the rights of people in the catalogue are explained.

3.What we collect about you

Account and workspace

Your name, email address, password credentials or social sign-in identifier, workspace name, role, and the colleagues you invite. Authentication is handled by our identity provider; we do not store your password ourselves.

Billing

Your plan, billing cycle, subscription and credit history, billing email, billing address, tax status, and the last four digits and brand of your payment card. Card numbers are collected and stored by our payment processor, not by us.

What you create in the product

Saved lists, notes, saved searches, watched brands, contact reveals, contact requests, catalogue reports, exports you run, and any content you submit.

Usage and device

Pages and features used, searches run, timestamps, IP address, browser and device type, referring page, and diagnostic logs and error reports. We use this to run the product, secure it, enforce plan and rate limits, and understand what to build next.

Support and marketing

Messages you send us, and, if you give it to us, your email address for product updates or the newsletter, which you can unsubscribe from at any time.

YouTube channel data

If you connect a channel, the data described in section 5.

Sponsorbook Chrome extension

On supported YouTube channel and video pages, the extension reads the channel or video identifier from the current page and sends that identifier to Sponsorbook to retrieve sponsorship context. It does not collect your YouTube searches, viewing duration, comments, or browsing activity outside supported Sponsorbook requests.

If you are signed in, the extension uses our identity provider to recognise your Sponsorbook session and apply your workspace access. Session tokens are handled by the extension background worker and are not added to the YouTube page. Anonymous responses can remain in the extension background worker’s memory for up to ten minutes. The extension uses Chrome’s cookies and storage permissions only to recognise and maintain your Sponsorbook session on our configured Sponsorbook and identity-provider domains.

4.How we use it, and our legal bases

• To provide the Service: creating and running your account and workspace, serving the catalogue, applying plan limits and credits, and supporting you. Basis: performance of our contract with you.
• To take payment: subscriptions, renewals, top-ups, invoices, tax. Basis: performance of our contract, and compliance with legal obligations.
• To secure and maintain the Service: authentication, abuse and fraud prevention, rate limiting, detecting scraping and redistribution, debugging. Basis: our legitimate interests in keeping the Service and its data safe.
• To improve the Service: analysing aggregate usage, measuring which features are used, prioritising work. Basis: our legitimate interests in developing the product.
• To communicate with you: service notices, renewal and price-change notices, security alerts, and support replies (basis: contract and legal obligation); product marketing where you have opted in or where we may rely on legitimate interests, always with an unsubscribe (basis: consent or legitimate interests).
• To comply and to defend claims: record-keeping, responding to lawful requests, establishing or defending legal claims. Basis: legal obligation and legitimate interests.

We do not use your account data, your lists, or your searches to build the catalogue, and we do not sell them.

We do not use your Customer Data to train generative AI models. Where the Service uses automated extraction or scoring, it runs on public source material and catalogue records, not on your private workspace content.

Chrome extension data

We use data received through the extension and Chrome extension APIs only to show sponsorship context for the supported YouTube page you are viewing, recognise your Sponsorbook session, apply access and rate limits, keep the extension secure, and diagnose faults. We do not use it for personalised advertising, creditworthiness, lending, or selling data.

We do not transfer data received through Chrome extension APIs except to service providers acting on our instructions where necessary to provide or secure the extension, when required by law, or as part of an acquisition of our business. People do not read that data except with your affirmative agreement for a specific support case, where necessary for security or legal compliance, or after it has been aggregated and de-identified for internal operations.

5.YouTube API Services

Connecting a YouTube channel is optional and is not needed to use Sponsorbook.

What we access and store

When you authorise the connection through Google, we access and store: your channel’s public identifiers and profile (channel ID, title, handle, thumbnail, description); public channel statistics such as subscriber, view, and video counts; and metadata about your public videos. We store the OAuth tokens Google issues so we can refresh that data, and a record of which of your workspace’s members connected the channel and when.

We use it for one purpose: to confirm you control the channel and to tailor results and fit scoring to it. We do not post to your channel, read your private videos or comments, or access your monetisation or revenue data.

How long we keep it

We refresh or delete stored YouTube API data within 30 days, except for aggregate statistics we are permitted to retain. Disconnecting the channel deletes the stored tokens and channel data.

How to revoke access

You can revoke Sponsorbook’s access to your Google data at any time from the Google security settings page at myaccount.google.com/permissions, or by disconnecting the channel in your Sponsorbook settings. To ask us to delete YouTube data we hold about you, write to privacy@sponsorbook.io.

6.The catalogue: data about brands, creators, and business contacts

Where it comes from

We build the catalogue from sponsorships that creators disclosed publicly in their own YouTube videos, from publicly available web sources such as company websites and public professional profiles, and from third-party data providers who represent to us that they collected the data lawfully. We do not buy consumer data and we do not collect special-category data.

What it contains

Brand records (name, domain, description, category, logo, and the sponsorship evidence behind them); channel and video records (public channel and video metadata and the disclosed sponsorship segments); and, for some brands, business contact records: a name, job title, work email address, professional profile link, and the provenance and verification status of that record.

Our role and our legal basis

For catalogue data we act as an independent controller. Where the GDPR or UK GDPR applies, our legal basis is our legitimate interests, and those of our customers, in operating a business-to-business research tool that identifies which companies sponsor creators and who at those companies handles it. We limit the catalogue to business contact information in a professional capacity, we do not include personal email addresses or home contact details, and we have weighed this against the interests and reasonable expectations of the people concerned. You can ask us for our balancing assessment.

Business contact email addresses are masked in the product until a customer spends a credit to reveal one. When a customer reveals a contact, that customer becomes an independent controller of the data and is separately responsible for its own outreach complying with the law.

If you are in the catalogue

You have the rights set out in sections 11 and 12 even though you are not our customer, including the right to object to our processing and to ask us to delete your details. Email privacy@sponsorbook.io from the address in the record, or tell us enough to identify it, and we will act on the request and suppress the record so it is not re-added by a later import. We will confirm when it is done.

Customers can also flag a catalogue record as wrong. We review those reports and may correct, amend, or remove the record.

7.Who we share data with

We do not sell data about our customers. We share personal data only as follows.

• Service providers who run parts of the Service for us, under contract and only on our instructions: authentication and user management, payment processing, application and database hosting, email delivery, error monitoring, product analytics (Google Analytics and PostHog; see section 13), and customer support tooling. A current list of subprocessors is available from privacy@sponsorbook.io.
• Google, in respect of the YouTube API connection described in section 5.
• Within your workspace: your name, email, and the lists, notes, searches, and reveals you create are visible to other members and administrators of your workspace.
• Our customers, in respect of catalogue records including revealed business contact details, as described in section 6.
• Professional advisers, authorities, and acquirers: where we must comply with law or a lawful request, to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets, in which case we will tell you.

8.International transfers

We are based in the United States and our service providers may process data in the United States and elsewhere. Where we transfer personal data out of the UK, the EEA, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the additional safeguards those require. Ask us at privacy@sponsorbook.io for a copy of the mechanism that applies to a particular transfer.

9.How long we keep data

• Account and workspace data: for as long as the account is open, then deleted or anonymised within 90 days of closure.
• Billing and tax records: up to 7 years, because we are required to keep them.
• Usage and security logs: up to 12 months, or longer where a log is part of an investigation.
• Chrome extension cache: anonymous sponsorship responses remain in the extension background worker’s memory for no more than ten minutes. Account sessions follow the account retention period above.
• YouTube API data: refreshed or deleted within 30 days, as described in section 5.
• Catalogue records: for as long as they remain accurate and relevant to the catalogue, and reviewed on an ongoing basis.
• Suppression records: indefinitely, in minimal form, so that a record you asked us to remove is not re-added by a later import.

We may keep data longer where we need it to establish, exercise, or defend legal claims.

10.Security

We encrypt data in transit and at rest, restrict access to production systems to the people who need it, use a third-party identity provider for authentication, keep audit logs, and review access periodically. No service is perfectly secure, and we cannot guarantee that a breach will never happen; if one affects your personal data and the law requires it, we will notify you and the relevant regulator without undue delay.

11.Your rights

Depending on where you live, you may have some or all of these rights over your personal data: to access a copy of it; to have inaccurate data corrected; to have it deleted; to restrict or object to how we use it, including objecting to processing based on legitimate interests; to receive it in a portable format; to opt out of marketing at any time; and to withdraw consent where we relied on it, without affecting what we did beforehand.

Exercise any of them by emailing privacy@sponsorbook.io. We will respond within the time the law allows (one month under the GDPR and UK GDPR, 45 days under California law), and we will not treat you worse for asking. We may need to verify your identity first, and we will not ask for more information than we need to do that.

If you are unhappy with how we handled a request you can complain to your data protection authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the authority where you live or work. We would rather you told us first so we can put it right.

12.California privacy rights

This section applies to California residents under the CCPA as amended by the CPRA.

Categories we handle

Identifiers (name, email, account and device identifiers, IP address); commercial information (plan, subscription and credit history); internet and network activity (usage and diagnostic data); and, for catalogue records, professional or employment-related information (job title, employer, work email, professional profile). We collect them from you, from your device, from our service providers, from public sources, and from third-party data providers, for the business purposes in section 4. We do not collect sensitive personal information for the purpose of inferring characteristics, and we do not knowingly handle the data of anyone under 16.

Sale and sharing

Your other California rights

You have the right to know what we collect and why, to a copy of it, to correct it, to delete it, to limit our use of sensitive personal information, and not to be discriminated against for exercising any of them. An authorised agent may make a request for you with proof of authorisation. Exercise these rights at privacy@sponsorbook.io.

13.Cookies and tracking

Strictly necessary

Cookies that keep you signed in, remember your workspace, secure your session, and prevent abuse. The Service does not work without them and they are not optional.

Analytics

We use Google Analytics and PostHog to understand how the site and the product are used: which pages and features people reach, where they drop off, and what breaks. These are third-party providers that set their own cookies or identifiers and receive your IP address, device and browser information, and the pages you view. We use them for product analytics only: we have not enabled advertising or remarketing features, we do not build advertising profiles, and we do not run third-party advertising cookies.

Where the law requires consent for non-essential cookies we ask for it before setting them, and you can change your mind at any time. Your browser can block or delete cookies, and Google offers a browser opt-out for Google Analytics. We do not respond to Do Not Track headers, which have no agreed meaning; we do honour Global Privacy Control signals where the law requires it.

14.Children

The Service is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us at privacy@sponsorbook.io and we will delete it.

15.Changes to this policy

We will update this policy as the product and the law change. The date at the top always shows the current version. If a change materially affects how we use your personal data we will tell you by email or in the app before it takes effect.

16.Contact

Privacy questions, data subject requests, catalogue removal requests, and subprocessor or transfer documentation: privacy@sponsorbook.io

Legal notices: legal@sponsorbook.io

Be a Goose, LLC, 5716 Corsa Avenue, Suite 110, Westlake Village, CA 91362-7354.