Privacy Policy

Who is responsible

SponsBody (sponsbody.com) is run by Slam Dunk Labs Oy, business ID 3574810-7, Sörnäistenkatu 1, 00580 Helsinki, Finland (“we”, “us”). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about this policy or your data, email max@slamdunklabs.com.

If you’re an athlete

Your account

If you sign up with Google, Google gives us your name, email address and profile picture. If you sign up with email, we store your email address and a hashed password. We use this to run your account. Legal basis: our contract with you (GDPR art. 6(1)(b)).

If you arrived through an invite link we sent you, we record that link’s code with your account, so we know which invitation led to your sign-up. The code is random and says nothing about you. Legal basis: our legitimate interest in knowing which invitations work (GDPR art. 6(1)(f)).

Your public page

Your page shows what you add: your name, page address, profile photo, bio, country, your race, the spots you sell and their prices, your 3D model, the verified numbers of the social accounts you connect, and your sponsors. Anyone can see it. You can change it at any time. Legal basis: our contract with you.

Search engines and AI assistants can crawl and index our public pages, such as the home page, the brands page, the case study and every published athlete page. Our robots.txt allows this, including for crawlers that collect pages to train AI models, and our sitemap lists these pages.

Body scan and 3D model

To build your 3D model, you take one to three photos of yourself in training kit. With the explicit consent you give at the scan step, we send the photos to Tripo (run by Holymolly Ltd, Hong Kong), which turns them into a 3D model. We delete the photos from our storage as soon as the build finishes, usually within a few minutes. Your 3D model is stored privately and shown on your page when you publish it. It stays until you retake your scan or delete your account. You can also set up your page without a scan, with a stand-in body.

Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it at any time by deleting your account or by emailing us to delete your model.

Verified social accounts

Connecting a social account is optional. You can connect Instagram, YouTube, TikTok and a Facebook Page, one account per platform. You sign in on the platform’s own page and choose what to allow; the platform then gives us read-only access. We never post for you and never read your messages or individual followers. Per platform we read:

• Instagram (Business or Creator account): your username, account type, follower count and number of posts; views, reach and interactions of your recent posts; and your top follower countries (totals only).
• YouTube: your channel ID and handle, subscriber count and number of public videos; and the view, like and comment counts of your recent uploads.
• TikTok: the ID TikTok gives SponsBody for your account, your username and display name, follower count and number of videos; and the view, like, comment and share counts of your recent videos.
• Facebook: the Pages you manage (name, ID and follower count), to pick the one with the most followers; then that Page’s name, ID and follower count, and the views, unique viewers and reactions of its recent posts. We keep only the Page we picked.

From these we work out, per platform, your average views, reach where the platform reports it, and engagement rate. They appear on your public page with a Verified badge per platform, and we use the strongest one to suggest prices for your spots. Numbers from different platforms are never added up. We refresh them daily while you’re connected and keep a history of them. The access tokens are stored encrypted and used only to read these numbers.

Legal basis: your consent. To withdraw it, disconnect the platform in the Reach step of your page setup: that deletes the numbers, their history and the token. For YouTube and TikTok, disconnecting also revokes SponsBody’s access at Google or TikTok. For Instagram and Facebook, remove SponsBody at the platform too if you want its permission gone there: in Instagram under Settings, Apps and websites; in Facebook under Settings, Business integrations. You can also remove SponsBody’s access to YouTube from your Google Account at security.google.com/settings/security/permissions, and to TikTok from the app permissions in TikTok’s settings. If a connection stops working, it no longer shows on your page, and we delete it 30 days later unless you reconnect.

YouTube data comes through the YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy. SponsBody’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to show your verified numbers and suggest prices; we don’t sell it, use it for advertising or share it with anyone else.

Sponsors and payouts

When a brand buys one of your spots, we record the sale: the brand, the spot, the amount and our fee. You see each sponsor’s company name, logo and contact email, so you can coordinate the print with them. We email you about each sale (the brand, the spot and the amount), with a link to share it. To pay you, we need your payout details, such as your name and bank account, which we ask for when a payout is due. Legal basis: our contract with you, and our legal duty to keep accounting records (GDPR art. 6(1)(c)).

If we contacted you on Instagram

We invite HYROX athletes to SponsBody with a direct message on Instagram, sent by a person, not a bot. To find athletes we use public information: race results, athlete lists, podcast show notes and public Instagram profiles (collected with Apify, a web data service). For each athlete we keep the public username, name, follower count and bio, the source we found you in, the messages we sent and a random invite code.

Legal basis: our legitimate interest in inviting athletes to a service built for them (GDPR art. 6(1)(f)). You can object at any time: reply “stop” or email us, and we delete your details and never contact you again. If you don’t sign up, we delete them six months after our last message.

If you sponsor an athlete

When you buy a spot, you give us your company name, website, a contact email, your logo and an optional message. We use them to place your logo on the athlete, process the payment, send receipts and refunds, and keep accounting records. If another brand takes your spot over, or your payment can no longer buy it, we refund you and email that contact address about it.

• Public: your company name, logo and website, and the amount you paid, appear on the athlete’s page and in its activity feed.
• Shared with the athlete: your contact email, so they can coordinate the print with you.
• Payment: Stripe takes your card details on its own checkout page. We receive the payment status and a payment reference, never your card number.

Legal basis: our contract with you or your company, and our legal duty to keep accounting records.

If you join a waitlist

With your consent, we store your email address, whether you joined as an athlete or sponsor, and your signup date. If you fill them in, we also store the optional details on the form: athletes may add their name and Instagram handle, and sponsors may add their website. We use these only for waitlist updates and invitations, not public profiles or unrelated marketing. Joining does not create an account or reserve a sponsorship. You can withdraw consent and ask us to remove your entry by emailing max@slamdunklabs.com. We keep your entry until you withdraw consent or the waitlist closes.

Everyone who visits

When you load a page, our hosting provider processes your IP address, browser type and the page requested, to deliver the page and protect the site against abuse. These technical logs are kept for a short time. Legal basis: our legitimate interest in running a working, secure website (GDPR art. 6(1)(f)).

To see which pages people use, we send PostHog (on its EU servers in Germany) the page you view, without its query string, together with your browser type and the page you came from. We don’t use cookies or browser storage for this and don’t tell PostHog who you are, so your visits can’t be linked to your account or to each other. PostHog also receives your IP address with each request. Legal basis: our legitimate interest in improving the site (GDPR art. 6(1)(f)).

We don’t use advertising or tracking cookies. Our fonts and scripts load from our own site, so visiting sponsbody.com sends nothing to Google, Meta or ad networks.

Cookies and browser storage

We only store what the site needs to work:

• your sign-in session, in your browser’s local storage, until you sign out;
• your page-setup progress, in local storage, so you can continue where you left off;
• the code of an invite link you arrived with, in local storage, until you create your page (at most 30 days);
• a security cookie while you connect a social account (one per platform), which expires after 10 minutes.

Stripe’s checkout page and the sign-in pages of Google, Instagram, Facebook and TikTok set their own cookies under their own policies. We use no other cookies, so we don’t show a cookie banner.

Who we share data with

These providers run parts of SponsBody for us:

• Supabase: database, sign-in and file storage, on servers in Ireland (EU).
• Vercel: website hosting, on servers in Dublin (EU). Vercel is a US company.
• Resend: sends our emails (sign-up, password reset, and the sale and refund emails above), from servers in Ireland (EU). Resend is a US company.
• Stripe: card payments and refunds.
• Tripo (Holymolly Ltd, Hong Kong): turns scan photos into 3D models.
• Apify (Apify Technologies s.r.o., Czech Republic): collects the public Instagram profile data we use to find athletes to invite.
• PostHog (PostHog Inc.): anonymous page statistics, on its EU servers in Germany.

These services handle data as independent controllers, under their own privacy policies:

• Google, if you sign in with Google or connect YouTube;
• Meta, if you connect Instagram or a Facebook Page;
• TikTok (TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited, its joint controllers for Europe), if you connect TikTok;
• Stripe, for its own fraud prevention and financial regulation duties.

We also share data when the law requires it, for example with tax authorities, and with a buyer if SponsBody is sold, who must then follow this policy. We never sell personal data.

Transfers outside the EU

Our database, files and servers are in the EU. Data leaves the EU in these cases:

• Scan photos go to Tripo in Hong Kong. The EU has not found Hong Kong’s data protection equal to its own, so your photos may be less protected there. We send them only with your explicit consent at the scan step (GDPR art. 49(1)(a)), and you can use SponsBody without a scan.
• Apify processes data in the EU and the US, under the EU Standard Contractual Clauses.
• Resend keeps a record of each email it sends for us, including the recipient’s address, in the US, under the EU Standard Contractual Clauses.
• Vercel, Stripe, Google, Meta and PostHog are US companies and may access data from the US. They are certified under the EU–US Data Privacy Framework, which the EU has found adequate.
• If you connect TikTok, you sign in with TikTok, and we send TikTok only the codes and tokens needed to read your numbers. TikTok’s own privacy policy for Europe says it stores data on servers in the United States, Malaysia and Singapore and gives group companies in other countries, including China, limited remote access. That is TikTok processing as its own controller; the numbers we read are stored with us in the EU.

How long we keep data

• Account and page: until you delete your account.
• Invitation details (if we contacted you and you didn’t sign up): six months after our last message, or sooner if you ask.
• Scan photos: until the 3D build finishes, usually a few minutes.
• 3D model: until you retake your scan or delete your account.
• Social account numbers, their history and tokens: until you disconnect the platform or delete your account, or 30 days after a connection stops working and isn’t reconnected.
• Sales, payments, refunds and payouts: six years after the end of the financial year, as Finnish accounting law requires, even after an account is deleted. When an athlete deletes their account, these records are unlinked from their profile.
• Technical logs: a short time, for security.
• Emails with us: as long as we need them to handle your request.

Your rights

You can:

• see the data we hold about you and get a copy of it;
• correct it;
• delete it: use Delete account on your dashboard, or email us. We keep only what the law requires, as described above;
• restrict or object to how we use it;
• withdraw your consent for the body scan or a social account at any time. This doesn’t affect what we did before.

Email max@slamdunklabs.com. We answer within one month. You can also complain to a data protection authority: in Finland, the Data Protection Ombudsman (tietosuoja.fi), or the authority where you live or work.

Deleting your data

To delete the data we got from Instagram, YouTube, TikTok or Facebook:

• disconnect the platform in the Reach step of your page setup. This deletes its numbers, their history and the access token straight away;
• or delete your whole account with Delete account on your dashboard. This deletes your page, body scan, photos, social account data and login. Orders stay for bookkeeping without your name on them;
• or email max@slamdunklabs.com and we’ll delete it for you within one month.

For Instagram, removing SponsBody in Instagram’s settings (Apps and websites), or asking Instagram to delete your data from SponsBody, does the same as disconnecting: Meta tells us and we delete your Instagram numbers, their history and the token straight away.

Age, automated decisions and security

SponsBody is for people aged 18 and over. We don’t knowingly collect data from children.

We suggest prices for your spots based on your verified reach. They are suggestions: you set the prices. We make no automated decisions with legal or similarly significant effects on you.

All connections are encrypted. Scan photos and 3D models are kept in private storage and shared only through short-lived links. Social account tokens are encrypted in a vault. Only the people who run SponsBody can access the data, and only when they need to.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use your data in a significant way, we email account holders before it takes effect.