Privacy Policy

1. Data Controller

Sponsoly is operated by KILOS AI LLC, a limited liability company organized under the laws of the State of Wyoming, United States, located at 1621 Central Ave, Cheyenne, WY 82001, USA ("Sponsoly," "we"). We act as the controller of the personal data we collect as described in this Privacy Policy, except in the cases described in Section 3, where we act as a processor on behalf of our users.

2. Data We Collect

Account data:

• Name, email address, and password (stored encrypted).
• Your direct selling or network marketing company's name.
• Preferred language and profile settings.

Payment data:

We process your payments through Stripe. Sponsoly does not store or have access to your full credit or debit card numbers; Stripe processes them directly under its own privacy policy and PCI-DSS standards.

Content and messages:

• Content you generate or publish on the Service: public page copy, content generated or translated with AI tools, and other material you enter.
• The content of conversations you have with your prospects through WhatsApp, SMS, email, or connected social media accounts, to the extent you use the Service to manage them.

Your leads' data:

Name, phone number, email address, and other information your visitors enter into your public pages or capture forms.

Technical and usage data:

IP address, browser and device type, pages visited, actions taken within the Service, and cookies (see our Cookie Policy).

3. Our Dual Role: Controller and Processor

Sponsoly acts in two distinct roles depending on the type of data:

• **As controller** for your account data (name, email, billing data, platform usage), which we collect and use to run our own business.
• **As processor** for the personal data of your leads and contacts that you capture or manage through the Service — for example, via your public pages or the inbox. In that case, you are the controller with respect to those data subjects: you decide the purposes for which the data is collected and how it is used, and you are responsible for having a valid legal basis (such as consent) and for meeting your own privacy obligations toward them. Sponsoly processes that data only on your instructions, in order to provide you the Service.

If you need a Data Processing Agreement (DPA) for compliance purposes, you can request one by writing to privacy@sponsoly.com.

4. Purposes and Legal Bases

We use your personal data to:

• Provide, maintain, and improve the Service.
• Process payments and manage your subscription.
• Send you operational communications about your account.
• Prevent fraud and abuse, including within the referral program.
• Generate aggregated product usage analytics.
• Comply with legal obligations.

Where the General Data Protection Regulation (GDPR) or other equivalent law of the European Economic Area or the United Kingdom applies, the legal bases for these processing activities are: performance of a contract (providing you the Service under our Terms), our legitimate interest (product improvement, security, fraud prevention), your consent (for example, for non-essential analytics cookies or optional marketing communications), and compliance with a legal obligation.

5. Who We Share Your Information With

We do not sell your personally identifiable information to third parties. We share data only with the following service providers (subprocessors), to the extent necessary to operate the Service:

• **Supabase** — database and authentication (U.S.).
• **Vercel** — application hosting.
• **Stripe** — payment processing.
• **Resend** — transactional email delivery.
• **Anthropic** — AI processing (assistants, content generation).
• **OpenAI** — AI processing (assistants, embeddings).
• **PostHog** — product analytics.
• **Sentry** — technical error monitoring and logging.
• **Bunny.net** — video hosting and CDN delivery.
• **Social media integration providers** — connection to your Instagram, Facebook, and other platforms you enable.
• **Messaging infrastructure providers** — sending WhatsApp and SMS messages on your behalf.

We may also disclose information when required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any material change in how your data is handled.

6. Use of Artificial Intelligence

When you use Sponsoly's AI assistants (for example, to respond to prospect messages or to generate and translate content), the relevant text is sent to our AI processing providers, Anthropic and OpenAI, to generate a response or output. Under those providers' API commercial terms, that content is not used to train their general-purpose, publicly available models. It is your responsibility to obtain your contacts' consent, where applicable, before their information is processed by these tools, and to review generated content before using it.

7. Data Retention

We retain your data while your account is active. When you cancel your account, we delete your personal data within a reasonable period, except where the law requires us to retain it longer (for example, accounting or billing records). Your leads' data is retained while you administer your account and is deleted per your instructions or upon account deletion, except where a legal obligation requires otherwise.

8. Security

We implement reasonable security measures consistent with industry standards, including:

• Encryption in transit (TLS).
• Encryption at rest for sensitive credentials.
• Row-level security in our database.
• Access controls for authorized personnel.

These measures reduce the risk of unauthorized access to your information, although no system is completely infallible. We do not hold formal compliance certifications (such as ISO 27001 or SOC 2) as of the date of this publication.

9. Your Rights if You Are in the EEA, UK, or Switzerland

If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the right to:

• Access your personal data and request a copy of it.
• Rectify inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Request restriction of, or object to, the processing of your data.
• Request portability of your data in a structured format.
• Withdraw your consent at any time, where processing is based on it.
• Lodge a complaint with the data protection authority in your country of residence.

To exercise these rights, contact us at privacy@sponsoly.com. We will respond within the timeframes established by applicable law.

10. Rights of Users in California and Other U.S. States

If you reside in California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the right to: know what personal information we collect about you, request its deletion, correct it, and not be discriminated against for exercising your rights. Sponsoly does not sell or share your personal information as those terms are defined under the CCPA/CPRA. Under California's "Shine the Light" law, you may ask us about any disclosure of your data for direct marketing purposes to third parties; we currently make no such disclosures.

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, or another state with a comprehensive privacy law in effect, you may have similar rights of access, correction, deletion, portability, and objection to processing (including targeted advertising and certain automated decisions), as recognized under your state's law. To exercise any of these rights, contact us at privacy@sponsoly.com and indicate your state of residence.

11. ARCO Rights for Users in Mexico and Latin America

If you reside in Mexico, you have the rights of Access, Rectification, Cancellation, and Opposition (ARCO rights) recognized under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). You may exercise these rights by writing to privacy@sponsoly.com, stating your name, the right you wish to exercise, and documentation proving your identity. We will respond to your request within the timeframes established by applicable law.

If you reside in another Latin American country, we will apply, as a matter of good practice, the same principles of access, rectification, cancellation, and opposition to your personal data, to the extent your country's local data protection law grants you equivalent rights.

12. Children

The Service is intended for people 18 years of age and older. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal data, contact us at privacy@sponsoly.com so we can delete it.

13. International Data Transfers

Sponsoly and its subprocessors operate primarily from the United States, so your personal data may be transferred to, and processed in, countries other than your country of residence, including the United States. When we transfer personal data of individuals in the EEA, UK, or Switzerland outside those regions, we rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses (SCCs), together with reasonable additional safeguards where applicable.

14. Cookies

We use cookies and similar technologies to operate the Service and for product analytics. See our Cookie Policy for full details on the cookies we use and how to control them.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice within the Service. The "last updated" date at the top indicates when the current version took effect.

16. Contact

For questions about this Privacy Policy, contact us at privacy@sponsoly.com or by mail at KILOS AI LLC, 1621 Central Ave, Cheyenne, WY 82001, USA. Phone: +1 (321) 408-3622.