Privacy Policy

At SponsorLink, we value the trust you place in us to protect your information. This Privacy Policy details how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What Information We Collect

We only collect information that is necessary to provide and secure our digital sponsorship and loyalty services. This includes:

A. Member Accounts & Digital Passes

• Profile Details: Full name, email address, mobile phone number, residential address, date of birth (used for age verification and optional Birthday Blast promotions), and gender.
• Affiliations & Preferences: Club affiliation, your custom discount split preference (e.g. 50/50, 20/80), and any fishing/sport interests you provide.
• Family & Dependent Details: Where a club's registration form requests it, details of a second adult on your membership and of any children/dependents you register — this may include their names and other details you choose to provide.
• Waiver & Consent Records: Your acceptance of a club's liability waiver or constitution, where applicable, is recorded against your account.
• Custom Club Questions: Answers to any additional questions a specific club adds to its registration form (e.g. boat registration, shirt size).
• Loyalty Cards (Wallet Drawer): Card name, membership or barcode number, merchant brand, and optional latitude/longitude coordinates of nearby merchants (used locally to auto-sort cards based on your physical location).
• Last Known Location (Wallet Members, Opt-In): If you grant location permission in the SponsorWallet app, we store only your single most recent GPS position (no location history) so a participating business can send you a promotional SMS if you're currently within its area. This is separate from the always-local "nearby offer" popup, which never sends your position to our servers at all — see Section 2's Google Maps entry.
• Transaction History: Date, description, transaction amount, and status of support payments.
• Referral Source: How you heard about SponsorLink or the club, if provided at signup.

B. Club & Merchant Accounts

• Entity Profile: Legal name, physical address, ABN (Australian Business Number), website domain, contact email, and phone number.
• Integration Tokens: Cryptographically generated portal credentials, PINs, and Stripe merchant identifiers. Where a business connects its own point-of-sale system, we also store the OAuth access token issued by that provider (Shopify, Square, Lightspeed, or Clover), used solely to sync that business's own sales and loyalty data with SponsorLink.

2. Third-Party Subprocessors & Analytics

We do not use advertising networks, ad-targeting pixels or marketing cookies. We use one analytics tool, on public pages only (see Microsoft Clarity below and our Cookie Policy). To deliver transaction processing, authentication, analytics and core notification services, we transmit specific data to the following subprocessors:

• Microsoft Clarity (analytics, public pages only): On our public information pages (such as the home page, pricing, directories, FAQ and our policies), Clarity records how visitors use the page - clicks, scrolling and session recordings - so we can improve it. It masks text typed into forms, uses cookies described in our Cookie Policy, and is processed by Microsoft under its own privacy statement. It is not used on sign-in, sign-up, member card, wallet, business or club dashboard, payment or administration pages.
• Cloudflare: Our security and delivery network. All requests to SponsorLink pass through Cloudflare, which processes your IP address and request details to block attacks and bots and may set security cookies.
• Stripe Connect: All credit card details and payment flows are processed directly by Stripe. SponsorLink does not receive, view, or store payment card details on our servers.
• GCP Identity Platform (Firebase Auth): Where a login flow uses Firebase (e.g. certain member sign-ins), Google verifies the identity token; SponsorLink does not receive your password. Administrator and executive portal access is authenticated directly by SponsorLink's own systems (not Firebase), secured with a hashed credential and a second verification step sent to your registered email.
• SendGrid: Used to dispatch transactional receipts, monthly newsletters, and notifications. Only your email address and transaction context are shared.
• Google Maps API: Used locally within the portal to determine nearby merchant sponsors and map club locations, and to power the in-app "nearby offer" popup — this specific feature is computed entirely on your device, and your coordinates are never sent to or stored by SponsorLink for it.
• Twilio: Used to deliver SMS notifications (digital wallet pass links, club event alerts, and geofence notifications). Your mobile number and message content are shared with Twilio, a US-based provider, solely to send these messages.
• Google Wallet: If you add your membership pass to Google Wallet, we create a loyalty pass object via Google's Wallet API containing your name, member ID, discount split, portal link, and active loyalty stamp counts — Google stores this pass object on its own infrastructure to display and update it on your device.
• Apple Wallet: If you add your membership pass to Apple Wallet, the pass file (.pkpass) is generated and cryptographically signed entirely on SponsorLink's own servers using our Apple Developer certificate, then delivered directly to your device. Apple's servers are not contacted and do not receive or store your pass data as part of this process.

Overseas disclosure: Some of these providers store or process information outside Australia, mainly in the United States: Stripe, Twilio and SendGrid, Microsoft (Clarity), Cloudflare, and Google (Firebase sign-in, Google Maps and Google Wallet). Cloudflare may also process a request in the data centre nearest to you, which can be in another country. SponsorLink's own databases stay in Sydney, Australia. By using SponsorLink you consent to your information being processed by these providers outside Australia for the purposes described above.

3. Storage and Data Security

All personal information is stored securely within Google Cloud Platform (GCP) databases located in Australia: the Sydney region, with backup copies kept in the Melbourne region.

Database storage volumes are encrypted at rest by Google Cloud's default disk encryption. Select sensitive fields (such as club payout details) are additionally encrypted at the application layer using authenticated encryption. Administrator access is protected by a second verification step and industry-standard security protocols.

Retention: We keep your personal information while your account is active. When an account is closed or you ask us to delete it, we clear your profile details straight away (see Section 4), but we keep a secure, restricted copy of the records we need for our tax obligations and to show what was agreed and done if a dispute arises: payment, transaction and payout records; who the account belonged to (name, contact details and, for clubs, the ABN); and records of the terms, consents and any club waiver you accepted, including the waiver wording, when you accepted it and your date of birth. These records are kept for 7 years after the account closes and are then deleted automatically. We also keep de-identified statistics, such as when accounts started, changed plan or closed, which do not identify you. Our internal technical error logs are deleted after 90 days.

4. Accessing, Correcting, and Deleting Your Information

Under the APPs, you have the right to request access to the personal information we hold about you and to ask for updates or corrections. Members can download a copy of their information at any time from their account page (sign in, open your card, then "Your account"). For anything else, please contact our Privacy Officer at [email protected] to make a request.

You may also request deletion of your account. Requesting deletion clears your name, contact details, address, date of birth, gender and family/dependent details from your profile and immediately revokes access to your account. As explained in Section 3, a restricted copy of your payment records, your identifying details and the records of terms, consents and waivers you accepted is kept for 7 years after your account closes, for tax purposes and to resolve any dispute, and is then deleted. Contact our Privacy Officer at the address above to request deletion or to ask what is retained and why.

Copies held by our providers: SponsorLink clears your profile straight away when you ask and keeps only the restricted records described above. Payment and messaging providers (such as Stripe, SendGrid and Twilio) keep their own records of payments made and messages sent, under their own retention schedules and financial and tax laws. SponsorLink cannot delete those copies and does not use them after your account is deleted.

5. Complaints & Contact Details

If you have questions or wish to file a privacy complaint, please contact us at:

• Email: [email protected]
• Location: Queensland, Australia