Privacy Notice

Artsiom Derenchuk, an individual operating Sponsa from Lithuania, decides how and why your data is used and is the controller under the GDPR. Write to legal@sponsa.net about anything in this notice; postal details are provided on request where a law or an authority requires them.

Only what the product needs to work. There is no advertising network, no data broker and no third-party analytics script in the app.

• Account: your email address, and your name and profile picture if you sign in with Google. Sign-in by email link stores no password at all — we never have one.
• Quiz answers: the interests, budget, days, areas and preferences you pick during onboarding, and any later edits. This is the basis of every recommendation.
• Activity in the app: which events you save, like, skip or open, the picks generated for you each week, and whether you have seen the intro tour.
• Product analytics: a randomly generated session identifier plus the step you reached (for example "paywall viewed"), so we can see where the flow breaks. Stored in our own database, tied to your account only once you have one.
• Subscription: your Stripe customer and subscription identifiers, plan status, trial and renewal dates, and referral codes. Card numbers never reach us — they are entered on Stripe's own checkout page.
• Settings: language, dark mode, and whether you have unsubscribed from email.
• Anything you write to us by email, for as long as we need it to answer you.

Our servers and providers keep ordinary technical logs (including IP addresses) for security and debugging; we do not use them to build a profile of you.

• To run your account, generate your weekly picks and send the emails that carry them — performance of our contract with you (GDPR Article 6(1)(b)).
• To take payment, manage trials, renewals and referral discounts — performance of that contract, and our legal obligation to keep accounting records (Articles 6(1)(b) and 6(1)(c)).
• To keep the service working and improve the matching, to understand where people drop out of the flow, and to prevent abuse — our legitimate interest in a service that works (Article 6(1)(f)). You can object to this at any time.
• To send occasional non-essential messages where consent is required by law — consent (Article 6(1)(a)), which you can withdraw with one click.

Every bulk email carries an unsubscribe link and works with the unsubscribe button built into Gmail and Apple Mail. Unsubscribing stops the weekly picks, new-event alerts and re-engagement messages; it does not stop messages about your own payments, such as a reminder the day before a trial converts.

Your picks are scored automatically: your quiz answers and your likes and skips are compared against the events we have collected, and the highest-scoring ones are shown to you. It affects which events you see and nothing else — no legal or similarly significant decision is made about you, and no profile is shared with anyone. If a pick looks wrong you can change your interests in your profile, which recalculates the list immediately.

We use a small number of providers, each under a contract that allows them to process your data only for us:

• Supabase — the database and the sign-in system, where your account, answers, saved events and analytics rows live.
• Railway — hosting for the application itself.
• Resend — sending the emails described above.
• Stripe — payments and subscriptions. Stripe handles card details as its own controller under its own privacy policy.
• Google — only if you choose to sign in with Google, which tells us your email, name and profile picture.
• Anthropic — translating event descriptions into Lithuanian, Russian and English. Only public event text is sent, never your data.

Event pages embed a map from Google Maps. When such a page opens, Google receives your IP address and the usual browser information; that happens under Google's own privacy policy.

We do not sell personal data, and we do not share it for anyone else's advertising.

• A sign-in cookie that keeps you logged in, and a cookie storing the language you picked. Both are necessary for the service to work.
• Your browser's own storage keeps your dark-mode choice, whether you have finished the intro tour, and a random session identifier used for the funnel analytics above.

There are no advertising or cross-site tracking cookies, so there is no consent banner to click away. Our emails contain no tracking pixels; our email provider does record whether a message was delivered, bounced or reported as spam.

Some of the providers above are based in, or have infrastructure in, the United States. Where your data reaches them outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. You can ask us for details of the safeguards for any specific provider.

• Account, quiz answers, saved events and picks: while your account exists, and deleted when you ask us to delete it.
• Product analytics: up to 24 months, after which it is deleted or kept only in a form that no longer identifies you.
• Payment and invoicing records: for as long as accounting and tax law requires, which in Lithuania is up to 10 years.
• Email correspondence: while a matter is open, and up to 12 months after it is closed.
• The record that you unsubscribed is kept for as long as we send email at all, because it is the only way to keep not emailing you.

You can ask for a copy of your data, its correction, its deletion, a machine-readable export, a restriction on how it is used, or object to our use of it under legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what happened before. Write to legal@sponsa.net and we will answer within one month.

If you think we have handled your data badly, you can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the supervisory authority where you live.

Deleting your account deletes your answers, saved events and picks. Invoicing records are kept for the period the law requires.

Traffic is encrypted in transit. Access to each row in the database is restricted to the account it belongs to, enforced by the database itself rather than by the app alone. Administrative access is limited to the operator. Passwords are not stored, because email sign-in links and Google sign-in mean there are none. No system is perfectly secure; if a breach ever affects your rights, we will tell you and the supervisory authority as the law requires.

The service is not for children. You must be at least 16, or older where local law requires it. If you believe a child has created an account, write to us and we will remove it.

When the product or a provider changes, this notice changes with it. The date at the top always shows the current version, and material changes are announced in the app or by email before they take effect.