Privacy policy
What SponsorPass stores about publishers, contributors and the readers a site's snippet reaches, and why.
Draft
Draft pending professional review (see the Legal overview). Effective date: to be set at launch.
Who is responsible
Enova Studio operates SponsorPass. For a publisher's own data (your account, your workspace, your billing) we are the controller. For the data of a site's members and contributors we act on the publisher's instructions as a processor; the publisher is the controller and our Data-processing agreement applies.
What we store, and why
| Data | Why | For how long |
|---|---|---|
| Publisher staff: email address, name, sign-in sessions | To run the workspace and send sign-in links and notifications | While the account exists; sessions expire within 30 days |
| Billing: Stripe customer and subscription identifiers, the plan, invoices' status | To bill the plan | While the workspace exists, then as long as tax law requires |
| Site credentials: the Admin API key and, optionally, a staff access token | To create and update drafts, read posts and members, register webhooks, and read a post's referrer sources and visitor counts through the site's staff token | Encrypted; deleted when the site is disconnected |
| Contributors: the Ghost member's identifier, email address and name, the display name and company they enter | To know who may contribute and to credit the right person | Deleted within 30 days of the site's disconnection |
| Contributions: the drafts, submissions, comments and the versions of each | So the publisher can review and the contributor can revise | As above |
| The site's webhook deliveries | To keep the service in step with the site | The payload is removed after 7 days; the record that it arrived stays |
| Staff email addresses that Ghost includes in webhook payloads | Not used; they arrive with the post data | Removed with the payload after 7 days |
| Audit log | Every change to a submission, credit or setting, with who made it | For the life of the workspace |
| Technical logs | Request ids, timings, errors; email addresses in logs are replaced by a hash | 30 days |
We do not store card numbers, Ghost passwords, or the content of a site's newsletters.
The snippet on a publisher's site
A publisher adds a small script to their Ghost site. On a page view it calls the site's own members endpoint to learn whether the reader is a signed-in member of a mapped tier, and shows a "Contribute" button if so. It sends nothing to us until the reader presses that button; then it passes the site's short-lived identity token to us so the reader can sign in to the contributor dashboard. It sets no cookies on the publisher's site and loads nothing from third parties.
Cookies
The service sets one session cookie per host (the publisher app, the operator admin, each tenant site), strictly necessary for signing in. There are no analytics or advertising cookies.
Who else sees the data
| Processor | What for | Where |
|---|---|---|
| Stripe | Publisher billing | United States and the European Union |
| Resend | Sending our emails (sign-in links, notifications) | United States |
| Cloudflare | DNS, proxying, and encrypted backups in R2 | Global network; backups in a region we choose |
| The hosting provider (Hetzner at launch) | Running the service and its database | European Union |
| Ghost(Pro) or the publisher's own host | The publisher's site itself, which we talk to through its API | Wherever the publisher's site runs |
Each has signed terms that commit it to process the data only on instructions and to keep it secure. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses where they apply.
Security
Credentials are encrypted with a key held outside the database; every tenant's rows are isolated by the database itself; connections are encrypted; backups are encrypted and restored for a test every week. Details are in the developer documentation.
Your rights
Publishers can read, correct and export their data in the app and delete it by closing the workspace. Contributors should ask the publisher of the site they contribute to; we help publishers answer within the time the law gives them. Anyone can write to the support address published on this site. If you are in the European Economic Area or the United Kingdom, you can also complain to your data-protection authority.
Changes
We tell publishers about material changes by email; the date at the top changes with every edit.