Start a campaign
Legal

Privacy Policy

VERSION 1.0 LAST UPDATED: 18 JUNE 2026 UK GDPR · PECR

1.Who we are

This policy explains how Supername Ltd (company number 16495620, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) — “Supername”, “we”, “us” — collects and uses personal data when you use our website and services. We are the data controller. We are registered with the Information Commissioner’s Office under registration ZB997576. Privacy contact: [email protected].

🟢The plain-English versionSupername decides how the data described here is used, and the ICO knows where to find us. Questions go to the privacy address. (If this summary and the policy ever disagree, the policy wins.)

2.What we collect, and from whom

Business customers. Name, work contact details, business name and address, campaign preferences, billing details (card data is handled by Stripe and never touches our servers), and your communications with us.

Creators. Name and contact details, social account handles and public profile statistics, neighbourhood/coverage areas, identity-verification outcome (performed by Stripe — we receive a pass/fail and limited metadata, not your documents), bank payout details (held by Stripe), campaign history and performance, and your communications with us.

Website visitors. The strictly-necessary cookies described in section 8, any campaign-attribution tags (such as UTM parameters) contained in a link you arrive through, and anything you submit through our forms, WhatsApp or booked calls.

🟢The plain-English versionWe collect what each role needs to function — and the sensitive bits (your card, your ID documents, your bank details) live with Stripe, not us. (If this summary and the policy ever disagree, the policy wins.)

3.Public business information & the Context engine

To draft campaign scripts, our Business Context engine reads publicly available information about a business: public reviews, menus, listings, websites and public social content. Reviews may include reviewers’ public display names and opinions; we process this content to identify themes (e.g. frequently praised items), not to profile individual reviewers, and review excerpts shown to a Business are presented for that purpose. We rely on legitimate interests for this processing and honour objections (section 7).

🟢The plain-English versionOur engine reads the public internet about a business — the reviews you can read too. It counts what crowds say; it does not build files on individual reviewers. (If this summary and the policy ever disagree, the policy wins.)

4.How we use data & lawful bases

  • Providing the service — running campaigns, matching, approvals, payouts, reports. Basis: contract.
  • Identity verification & fraud prevention — creator KYC via Stripe, payment screening. Basis: legal obligation / legitimate interests.
  • The Context engine — reading public business information to draft scripts. Basis: legitimate interests.
  • Communications — service messages (contract); marketing to business contacts where permitted, with opt-out in every message. Basis: legitimate interests / consent, per PECR.
  • Improving the service — aggregated analytics, never sold. Basis: legitimate interests.
  • Legal compliance — tax, accounting, disputes. Basis: legal obligation.
🟢The plain-English versionMostly: to run the thing you asked us to run. Marketing has an unsubscribe link; analytics is aggregate; nothing is sold to anyone. (If this summary and the policy ever disagree, the policy wins.)

5.Who we share data with

  • Stripe — payments, identity verification, creator payouts (their own privacy notice applies).
  • Social platforms — content is posted by creators to their own accounts under platform terms; campaign tracking reads the platforms’ public counts.
  • Infrastructure — DigitalOcean (hosting and the video content-delivery network), under a data-processing agreement.
  • Google — web fonts are served from Google’s CDN, which receives your IP address as a normal part of loading any page, and Google Places provides business-name lookup during onboarding.
  • AI script drafting — an AI language-model provider (OpenAI and/or Anthropic) processes publicly available business information to help draft campaign scripts; we do not send it your account login or payment details.
  • Email — when we send service messages such as sign-in or verification codes, we use a transactional email provider.
  • Between users, minimally — Businesses see matched creators’ public handles and relevant stats; creators see the campaign brief, not the Business’s billing details.
  • Authorities — where the law requires.

We do not sell personal data.

🟢The plain-English versionStripe for money and ID, the platforms for posting, vetted processors for plumbing — and each side of the marketplace sees only what it needs. (If this summary and the policy ever disagree, the policy wins.)

6.International transfers & retention

Where processors store data outside the UK, transfers are protected by adequacy regulations or the ICO-approved International Data Transfer Agreement / EU SCCs with the UK addendum. We keep personal data only as long as needed: account data for the life of the account and up to 2 years after it is closed; transaction and tax records for 6 years (HMRC); campaign content per the licence terms; and we anonymise or delete the rest on schedule — full retention table available on request.

🟢The plain-English versionData abroad travels under the standard UK safeguards, tax records keep their statutory 6 years, and the rest has an expiry date. (If this summary and the policy ever disagree, the policy wins.)

7.Your rights

Under UK GDPR you can ask us for: access to your data, rectification, erasure, restriction, portability, and to object — including to any legitimate-interests processing such as the Context engine’s use of public content, and to direct marketing (which we will always stop). Where processing relies on consent, you may withdraw it at any time. Write to [email protected]; we respond within one month. You can complain to the ICO at ico.org.uk — though we’d appreciate the chance to fix it first.

🟢The plain-English versionThe full UK GDPR toolkit, one email away, answered within a month — and the ICO as the referee if we let you down. (If this summary and the policy ever disagree, the policy wins.)

8.Cookies

We currently use only strictly-necessary cookies, which keep the site working and do not require consent under the Privacy and Electronic Communications Regulations (PECR):

  • sn_onb — remembers your business onboarding basket between pages. First-party; expires after about 30 days.
  • sn_cre — remembers your creator-application progress between pages. First-party; expires after about 30 days.

We do not use advertising, analytics or tracking cookies, and we do not load third-party tracking scripts — so there is no cookie banner to click through. If we ever add non-essential cookies, we will ask for your consent first and list them here. You can block or delete cookies in your browser settings, though the onboarding flow may not work without the strictly-necessary ones.

🟢The plain-English versionJust the essentials that make the site work — no trackers, no ad cookies, no banner. If that ever changes, we’ll ask you first. (If this summary and the policy ever disagree, the policy wins.)

9.Children

Our services are for users aged 18 and over. Creator onboarding includes age verification as part of identity checks; we do not knowingly process children’s data and will delete any we discover.

🟢The plain-English version18+, enforced at creator KYC, no exceptions. (If this summary and the policy ever disagree, the policy wins.)

10.Changes to this policy

We’ll post updates here and, for material changes, notify account holders. The “last updated” date above always reflects the current version.

🟢The plain-English versionMaterial changes come with a heads-up, not a silent edit. (If this summary and the policy ever disagree, the policy wins.)

11.Contact

Privacy questions: [email protected] · Supername Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · ICO registration ZB997576