1. Who we are
HypeStax is provided by SponsorStack Ltd, a company registered in Scotland (company number SC883405), registered office Touch West Lodge, Touch, Stirling, FK8 3AG, United Kingdom ("HypeStax", "we", "us"). We are registered with the Information Commissioner's Office (ICO) under registration number ZC114185. You can contact us about privacy at hello@hypestax.co.uk.
HypeStax is a SponsorStack software product and a service for businesses. This policy explains how we handle personal data when you visit our website, create an account or use the HypeStax app.
2. Our two roles
- Controller: we decide how to use the personal data of the people who use HypeStax, such as your name, email address, login details, billing details and how you use the service.
- Processor: when you put information into HypeStax about your business, your customers or your prospects (for example, posts, uploaded images, or leads researched for outreach), we process it on your behalf and on your instructions. You are responsible for having a lawful basis for that data. Our processor terms form part of our Terms of service.
3. What we collect
- Account details: name, work email, password (stored securely by our login provider, never in plain text), and your role in a workspace.
- Business information: your business name, website address and the Business Brain we draft from your public website and your answers.
- Content: posts, feedback, images and any other material you create or upload.
- Connected accounts: if you connect a social or email account, we store access tokens (encrypted) and basic account details so we can publish or send what you approve, and read basic performance data where the platform allows.
- Outreach data (Outreach add-on): business contact details of prospects, gathered from public sources such as company websites, plus the emails you approve and their replies.
- Usage and technical data: log data, device and browser information, and records of AI usage for billing and fair-use limits.
- Billing data: plan, invoices and payment status. Card details are handled by our payment provider and are never stored by us.
4. How we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing your account and the HypeStax service | Contract |
| Account emails (confirmations, password resets, service notices) | Contract |
| Billing, accounting and tax records | Contract and legal obligation |
| Security, fraud prevention and fair-use limits | Legitimate interests |
| Improving HypeStax (using aggregated usage information) | Legitimate interests |
| Cookie-free website statistics (which pages are visited) | Legitimate interests |
| Product news and offers by email | Consent or soft opt-in for existing customers; you can unsubscribe at any time |
5. AI and your content
HypeStax uses AI models from third-party providers to draft your Business Brain, posts and emails. We send them only what is needed for each task. Under our agreements with these providers, your content is not used to train their models. AI output can be inaccurate, so HypeStax asks you to review and approve everything before it is published or sent.
6. Who we share data with
We don't sell personal data. We use these service providers (sub-processors) to run HypeStax:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, login and file storage | United Kingdom (London) |
| Vercel | Website and app hosting, and cookie-free website statistics | Global edge network, including the UK, EU and US |
| Anthropic | AI that drafts your Business Brain, posts and emails | United States |
| OpenAI | AI image generation (only when you use that feature) | United States |
| Inngest | Running background jobs (receives IDs, not your content) | United States |
| Resend | Sending account emails, such as sign-up confirmations | United States / EU |
| Social and email platforms you connect (e.g. Meta, LinkedIn, TikTok, Google, X, Microsoft) | Publishing posts and sending emails you approve | Varies by platform |
We may also share data with professional advisers, or where the law requires it. If our business is sold or restructured, data may transfer to the new owner under the same protections.
7. International transfers
Your workspace data is stored in the UK. Some providers above process data outside the UK. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
8. How long we keep data
- Account and workspace data: while your account is active, then deleted within 30 days of closure (backups roll off within a further 30 days).
- Billing records: 6 years, as required for tax and accounting.
- Security logs: up to 12 months.
- Outreach suppression lists (people who asked not to be contacted): kept for as long as needed to respect their request.
9. Security
Each business's data is kept separate by access rules enforced in our database. Data is encrypted in transit and at rest, connected-account tokens are encrypted, and access to production systems is limited to authorised staff.
10. Your rights
You have the right to access, correct, delete, restrict or object to the use of your personal data, to data portability, and to withdraw consent at any time. To use these rights, email hello@hypestax.co.uk. We'll respond within one month. If the data is held on behalf of one of our business customers, we'll pass your request to them.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, but we'd appreciate the chance to help first.
11. Cookies
Our website does not use advertising or tracking cookies. To see which pages are useful, it uses Vercel Web Analytics, which counts page visits without cookies, without storing anything on your device and without identifying you or following you across other websites. The HypeStax app uses essential cookies to keep you signed in securely. If we ever add analytics that use cookies, we'll ask for your consent first and update this policy.
12. Children
HypeStax is a business service and is not intended for anyone under 18.
13. Changes
We'll update this policy when our practices change and show the date at the top. Significant changes will be emailed to account owners.