Privacy policy.

What Sponsor My Body collects, why, and what you can do about it. Short, because there is not much.

One note on the site itself: the marketplace is being built in stages. Accounts are open; listings shown as examples are illustrative, and the brand logos in example images do not indicate any sponsorship or relationship. Sponsor My Body is independent and not affiliated with Marc Lou, HYROX or any brand named on the site.

Who is responsible

sponsormybody.com is operated by Jurica Krajačić, trading as Plutus X (Croatian sole trader, OIB 15630993532), Matije Gupca 45, 40315 Mursko Središće, Croatia, reachable at hello@sponsormybody.com. This is the controller of the data described here.

What is collected and why

Waitlist signup

When you join the waitlist we store your email address, whether you chose athlete, creator or brand, the time of signup, your IP address, your browser identification string, and where you came from (for example a link from X, a search engine, or direct). The email is used to tell you when placements open and to ask, occasionally, what you would want from the product. The rest is kept to prevent spam and abuse and to understand which channels bring people here.

Legal basis: your consent when you submit the form, and our legitimate interest in keeping the signup form free of abuse. You can withdraw at any time by replying to any email we send or writing to hello@sponsormybody.com; we then delete your row.

Retention: until you ask to be removed, or 24 months after the last email you opened or clicked, whichever comes first.

Athlete application

When you apply to be listed we store what you type: your name, email, sport, the city and country you live in, the event and its dates, a short text about you, your channels and follower counts, the placements and prices you propose, your campaign goal and headline, what sponsors get, and notes, plus the time, your IP address and which of our application forms you used.

You can also upload up to five photos (JPEG or PNG). Each photo is re-encoded the moment it arrives, which removes location, camera and other hidden details from the file; a photo that cannot be re-encoded is refused rather than stored. Photos are kept in private storage outside the website and only the operator can see them.

While you fill in the form, your answers (not your photos) are also kept in your own browser, so a refresh or a closed tab loses nothing; they never leave your device this way, are deleted when you send the application or press "Start over", and expire after 30 days. We use all of this to review your application and answer you by email. The application itself is never public. If you create an account with the same email, we fill in your profile and first campaign from it, and your profile page is public from the moment you save the profile (see Accounts below). Legal basis: the steps needed before entering into an agreement with you, at your request. Retention: until the listing is removed and 12 months after, or until you ask for deletion.

Spot requests, bids and offers

When a brand requests a placement, bids on one or makes an offer on an athlete's page we store the campaign and spot, the brand name, the work email, an optional website and message, the amount, the time and the IP address. We pass it to the athlete it is for, so they can reply, and the athlete sees the brand's email. A bid counts only after the bidder confirms it from their inbox; if someone bids more, we email the earlier bidder. When a spot is sold, the brand's name, website and logo appear on the athlete's page next to that spot. Legal basis: the steps needed before entering into an agreement, at the brand's request. Retention: 12 months after the event, or until deletion is requested; records of a sale are kept as long as the law requires.

New-campaign emails

On an athlete's page you can ask for an email when that athlete opens a new campaign. We store your email address, the athlete, the time and your IP address, and send nothing until you confirm from your inbox. Every email has a link that stops them and deletes your address. Legal basis: your consent. Retention: until you stop the emails, or the athlete's page is removed.

Page reports

"Report this page" stores the reason, your message and email if you give them, the page, the time and your IP address, so the operator can check the page. Legal basis: our legitimate interest in keeping the site safe. Retention: 12 months.

Accounts on the marketplace

When you create an account at sponsormybody.com/app we store your name, email address, the time you confirmed it, the country you live in, and your password as a one-way hash (nobody, including us, can read the password). We also note which way you signed up (for example the sign-up page or Google), so we can tell which works best. The country is not shown on your page. It tells us whether brands can pay you by card, because Stripe only opens accounts in some countries. If you set up an athlete profile we also store your handle, display name, sport, location, the text about you, your profile photo, and your channels with follower counts.

Your profile is public as soon as you save it. Your page at sponsormybody.com/a/your-handle/ shows your display name, sport, city, the text about you, your profile photo and your channels with follower counts, to anyone. Once the profile is complete (a profile photo, at least 150 characters about you and at least one channel) or a campaign of yours is approved, search engines may list the page; before that, the page asks them not to. We can hide a photo or take a page down that breaks the terms of use. To take your page down yourself, close your account in Settings. Search engines may keep a copy for a while after a page changes or is gone.

Campaigns you draft stay private. Once you send one for review, your page shows only its event and date as “coming soon”; the rest appears when we approve it. Photos you add to a campaign, and your profile photo, are re-encoded the moment they arrive, which removes location and camera details. Campaign photos are seen only by you and the operator until the campaign is approved. After an event you can send proof (photos and links to your posts); once we accept it, it appears on your page under that campaign and we send the links to your sponsors.

If you sign in with Google or Apple, that company tells us your account's identifier with them, your email address and, if you share it, your name. With Apple the email can be a private relay address that forwards to you. We store these to recognise you the next time. We never receive your Google or Apple password and get no access to anything else in those accounts. You can disconnect them in Settings.

While you are signed in we keep a session record with your IP address, browser identification string and last activity time, so we can keep you signed in and spot misuse. Settings shows you these devices and lets you sign them out. Changing your password signs out every other session. When you change your email address, the new one is used only after you confirm it from its inbox. If you change your public handle after a campaign has been public, we keep the old handle reserved for you for 12 months so nobody else can take it, and the old address forwards to the new one.

In Settings you can download a copy of your account data in one file and close your account. Without campaigns, the account and profile are deleted at once. With campaigns, we close the account within 30 days and keep only the records a sale requires by law.

Legal basis: the contract you enter by creating the account; a public athlete page is part of that service. Retention: for as long as the account exists.

Payments, payouts and tax reporting

This part applies once card payments through Stripe are switched on. The payment terms explain how payments work.

Brands. When you bid, make an offer or request a spot, we also store your company's legal name, VAT or tax number and registered address.

You pay on Stripe's payment page. There you enter your email address, your card details or a wallet (Apple Pay, Google Pay or Link), the cardholder name and your billing address, and you may add a VAT number. Stripe receives these directly and screens the payment for fraud with Stripe Radar, under its own privacy policy. Apple, Google and Link handle a stored card under their own terms. We never see or store your full card number.

From Stripe we receive:

• your email address, your billing address and your VAT number if you gave one;
• the payment's status, amount and fee;
• your card's brand, country and last four digits;
• the result of your bank's security check (3D Secure);
• a card identifier (“fingerprint”) that lets us block a card after abuse.

Legal basis: the contract, and our legitimate interest in preventing fraud.

Athletes. To be paid, you open a Stripe account through us. Stripe collects and checks your identity, address, date of birth and bank account, and an ID document where it asks for one. It does this under its own privacy policy, as a separate controller. We receive your account's status and the details Stripe shares with platforms. Stripe may contact you directly about your account, for example to ask for more information. You see and manage your Stripe details in the Stripe Express dashboard. Legal basis: the contract.

Tax reporting. We do not currently collect athletes' tax numbers or report payments to tax authorities. If the law starts to require it (for example the EU reporting rules for platforms known as DAC7), we will update this policy and tell you before we collect anything.

Confirmation records. Each time you confirm the payment terms, we store your account or email, the version you confirmed, the time, your IP address and your browser identification string. Legal basis: our legitimate interest in being able to prove the agreement. Retention: at least six months after the last deal they cover closes, and longer while a dispute about it is open.

Disputes. If a brand's bank disputes a payment, we give Stripe the evidence of the deal. Stripe passes it to the card network and the brand's bank. The evidence is:

• the confirmation records;
• the bid or offer;
• the payment confirmation;
• the athlete's proof;
• our messages with the brand.

Legal basis: our legitimate interest, and the athlete's, in defending the payment.

We keep records of payments for as long as accounting and tax law require, even after an account is closed.

Sponsorship index

The Athlete Sponsorship Index describes sponsorship campaigns that athletes announced publicly on X and on their own campaign sites: their public name and handle, the event, the prices, what sold and to whom, and results. Legal basis: our legitimate interest in documenting public sponsorship offers. An athlete who wants a page corrected or removed can email hello@sponsormybody.com and we act on it within a week. When you submit a campaign through the form we store the post link, the optional website, email and note, the time and the IP address, and use them only to review the campaign and tell you when it is added. Retention: 12 months, or until deletion is requested.

Emails we send

A new signup, application, spot request or index submission generates an internal email to the operator with its details. Applicants and brands also get a confirmation email, which contains only our standard text and a reference, never what was typed into the form. Marketplace accounts get the emails needed to confirm the address and reset a password, plus short security notices when the password, email address or sign-in methods change. Sending is capped per day to prevent misuse, so a confirmation can occasionally be skipped; the submission itself is always saved. That mailbox runs on Google Workspace, so Google processes these messages on our behalf under its data processing terms.

Abuse prevention

To stop spam and repeated abuse we keep short-lived counters per IP address that only look at the last hour (the address is stored as a one-way hash), a daily count of emails sent (no personal data), and a list of IP addresses we have banned after abuse. A banned address can still see the site but its forms are ignored. Banned addresses stay on the list until you ask us to review it.

Cookies and analytics

The marketplace uses one strictly necessary cookie to keep you signed in and to protect forms against forgery; it is encrypted and only sent over https. While you are signed in, a second cookie holds only the value 1, so the site's other pages can show your Dashboard button; it says nothing about who you are and is removed when you sign out. We use Google Analytics 4 to understand visits only after you choose Allow analytics. This applies everywhere, regardless of browser language or timezone. Choosing No thanks prevents analytics from loading. You can reopen Analytics settings in the footer to change or withdraw your choice. Withdrawal disables analytics, removes its accessible first-party cookies and reloads the page. Your choice is stored in this browser; joining the waitlist works without analytics consent. Advertising storage, Google signals and ad personalisation are disabled.

Server logs and backups

Our hosting provider keeps standard web server logs (IP address, requested page, time, browser) for security and error diagnosis for a short period. They are not used for anything else. We keep backups of the data described here, in private storage at the same provider, for up to 30 days, so it can be restored after a failure; a deletion you ask for disappears from backups when they expire.

What is not done

No data is sold. Data is shared only as described above. A brand's request goes to the athlete it is for. A listing is published only with the athlete's agreement. Stripe receives what payments need. The processors named below act on our instructions. No advertising networks run on this site. No profiling.

Processors and transfers

Google (Analytics, Workspace) and our hosting provider in the United Kingdom act on our instructions. Google may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. When you choose to sign in with Google or Apple, that company handles your sign-in under its own privacy policy and passes us only the details listed above.

Payments are processed by Stripe Payments Europe, Ltd. (Ireland). Stripe acts as a separate controller under its own privacy policy and may process data outside the EU under the safeguards described there.

Your rights

You can ask what we hold about you, ask for it to be corrected or deleted, object to processing, or ask for a copy in a portable format. Write to hello@sponsormybody.com. If you think we have handled your data wrongly, you can complain to your local data protection authority.

Changes

This policy already covers card payments. The parts marked as applying once card payments are switched on take effect at that point. If anything here changes, we update the date at the top.