Privacy Policy
Last updated: October 15, 2026
This Privacy Policy describes how INGERSLEV.IO ApS ("the Company", "we", "us") collects, uses and shares your personal data when you use Sponsometer, and explains your rights under the General Data Protection Regulation (GDPR).
Who We Are
Sponsometer is operated by INGERSLEV.IO ApS, which is the data controller for the processing described here, except where this policy says otherwise.
- Company: INGERSLEV.IO ApS
- CVR number: 36393041
- Address: Løgten Østervej 90, 8541 Skødstrup, Denmark
- Contact: emil@ingerslev.io or the contact form
What Data We Collect
Account Data
You do not need an account to pledge. If you sign in, to run for a charity or to see and manage your pledges, you do so with Google, Microsoft, Facebook, GitHub or a sign-in link sent to your email address. We then receive and store your email address and, where the provider gives it to us, your name and profile picture. We also store the language you prefer, the time of your last sign-in, and the technical tokens your login provider issues so that the connection to it keeps working. We never see your password.
Pledge Data
When you pledge, you provide:
- A sponsor name (optional) and whether it may be shown publicly. It is shown unless you switch that off; without a name, or with it switched off, you appear as "Anonymous".
- An optional message, which is always shown publicly on the event page.
- The type of pledge (per kilometre, per hour, per round, or a fixed amount), your rate and your maximum amount.
Your pledge is linked to an email address: the one you are signed in with, or the one you type in the pledge form when you pledge without an account. We store that address with the pledge and use it for the confirmation of your pledge and for the emails about the charge. Signing in with the same address later shows the pledge under your sponsorships, where you can change or withdraw it before the event. We also keep an internal log of who made, changed or cancelled a pledge, which only our administrators can see.
Payment Data
Payments run through Stripe. The card form on the pledge page is Stripe's own: your card number goes straight to Stripe and never reaches our servers. Stripe stores the card on the Stripe account of the charity you are supporting, together with your name and email address, so that the charity can charge it after the event.
We store the references Stripe gives us (customer, saved card and charge identifiers), the exact wording you agreed to when you saved your card and when you agreed to it, the amounts calculated and charged, and the notifications Stripe sends us about the saved card and the charge. These records are internal and never shown publicly.
Runners and Organisations
Runners provide a name, an email address, a profile text and a photo, and choose whether their profile may be shown publicly. Applications to become a runner contain the applicant's name, email address and message. For the organisations that collect through Sponsometer we keep the name, role, email address and phone number of their contact person, to administer the collection.
Contact Form
A message sent through the contact form, with the name and email address you enter, is emailed to us and kept in our mailbox. It is not stored in the Sponsometer database. Your IP address is held in memory for a few minutes to limit how many messages one address can send.
Server Logs and Error Reports
Our servers keep standard logs (IP address, browser type, pages requested) for security and operations. Some operational messages in the logs name the email address an action concerned, for example an email we could not deliver. Logs and performance metrics are collected by Dash0, our monitoring provider.
When something goes wrong, a report is sent to Sentry, our error-reporting provider, in its EU data region. Before it is sent we remove cookies, request contents and query strings, and replace email addresses in the report with a placeholder. The report contains technical details of the failure and the identifiers of the records involved, not their contents.
Visitor Statistics
We count visits to Sponsometer with Plausible Analytics, which we host ourselves on our own servers in the EU, so no analytics data is sent to Plausible or any other third party. It sets no cookies and stores nothing on your device.
We record the page visited, the referring website, browser, operating system, device type and country, plus a few steps in the pledge flow (opening the pledge form, submitting it, saving a card) together with the donation type, whether the pledge was resumed after being abandoned and whether it was made without signing in. We never record names, email addresses, amounts or anything that identifies a sponsor, and we remove query parameters other than campaign tags from page addresses.
Your IP address is used only at the moment of the visit, to work out your country and to tell unique visitors apart through a code that is reset every 24 hours. The IP address itself is never stored, and the statistics cannot be traced back to you.
The legal basis is our legitimate interest in understanding how Sponsometer is used and where people abandon the pledge flow, so that we can improve it (GDPR Article 6(1)(f)). You can object at any time by writing to us, or block it in your browser.
Cookies and Storage on Your Device
Sponsometer sets no cookies for advertising or for tracking you across websites. The cookies and browser storage we use are:
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
__Secure-next-auth.session-token | Sponsometer | Keeps you signed in | 30 days, renewed while you use the site |
__Host-next-auth.csrf-token, __Secure-next-auth.callback-url | Sponsometer | Protects the sign-in form and returns you to the page you came from | Until you close your browser |
__Secure-next-auth.pkce.code_verifier, __Secure-next-auth.state, __Secure-next-auth.nonce | Sponsometer | Only while you sign in with Google, Microsoft, Facebook or GitHub | 15 minutes, or until you close your browser |
cc_cookie | Sponsometer | Remembers that you have seen the cookie notice | 6 months |
i18nextLng (local storage) | Sponsometer | Remembers your language | Until you clear your browser data |
__stripe_mid, __stripe_sid, m | Stripe | Fraud prevention. Stripe's card form loads only when you reach the card step of a pledge. Stripe lists these cookies as strictly necessary on its cookie settings page | 1 year, 30 minutes and 2 years, as stated by Stripe |
plausible_ignore (local storage) | You | Our visitor statistics check for this flag so that an opt-out you set yourself is honoured. We read it and never set it | Until you remove it |
We use these cookies without asking for consent because each one is needed to sign you in, to protect the sign-in or the payment, or to remember a choice you made. The cookie notice at the bottom of the page is there to inform you.
How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Signing you in and running your account | Email, name, picture, login tokens | Contract (GDPR Article 6(1)(b)) |
| Showing and settling your pledge, including the emails about it | Pledge data, email, Stripe references, amounts | Contract (Article 6(1)(b)) |
| Showing your name on the event page | Sponsor name | Legitimate interest (Article 6(1)(f)) of the runner and the charity in showing who backs the event; you can switch it off when pledging and at any time afterwards |
| Bookkeeping and financial records | Pledge and charge records, email | Legal obligation (Article 6(1)(c)), the Danish Bookkeeping Act |
| Security, operations, error reporting and visitor statistics | Server logs, error reports, statistics | Legitimate interest (Article 6(1)(f)) in running a secure and working service |
| Answering your messages | Contact form data | Legitimate interest (Article 6(1)(f)) in answering you |
Stripe's fraud prevention is Stripe's own processing; see "Who Receives Your Data".
Public Data and the Donation Record
The following is publicly visible on the event page:
- Your sponsor name, unless you switched it off; otherwise "Anonymous"
- Your message, if you wrote one, also when you are anonymous
- Your rate and the amount your pledge has reached, and the final amount after the event
Your maximum amount is shown only to you. Runner pages list named sponsors with their totals and show anonymous sponsors as a count. Your email address and card details are never public.
Once a donation has been charged, it is part of the event's financial record and the entry is kept (see Data Retention). You can ask us at any time to stop showing your name; the entry is then shown as "Anonymous".
Who Receives Your Data
| Recipient | What and why |
|---|---|
| The charity you support | Receives your name, email address, pledge and saved card in its own Stripe account, and charges the card after the event. For the payment itself, the charity is the data controller. |
| Stripe (privacy policy) | Processes the card and the charge on the charity's Stripe account and runs its own fraud prevention. Stripe's policy asks you to read the privacy policy of the business you pay, which here is the charity, as well as Stripe's own. |
| Google, Microsoft, Facebook, GitHub | Your login provider, when you sign in with it. |
| Resend | Delivers the emails we send you (sign-in links, pledge confirmations, the notice before a charge). |
| Sentry | Error reports, in Sentry's EU data region, scrubbed as described above. |
| Dash0 | Server logs and metrics. |
| DigitalOcean | Stores the images runners and organisations upload (event banners, logos, profile photos) in Frankfurt. The images are public. |
| Hetzner | Hosts Sponsometer and its database in Helsinki, Finland. |
We do not sell your data or share it for marketing. Stripe, Resend and the login providers are international companies and may process your data outside the EU; their privacy policies describe the safeguards they use.
Data Retention
- Account data is kept while your account exists. See how to delete your account.
- Pledge and charge records are kept for at least 5 years, as the Danish Bookkeeping Act requires, together with the payment notifications from Stripe.
- Cancelled pledges that were never charged are marked as deleted and kept for audit purposes.
- Contact messages stay in our mailbox for as long as we need them to answer you.
- Server logs and error reports are kept for a limited time by the providers named above.
- Visitor statistics are aggregate and anonymous, and are kept for as long as we run the service.
Your Rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted, within the limits of the retention rules above: charged donation records cannot be deleted while bookkeeping law requires us to keep them.
- Restrict or object to processing based on our legitimate interest.
- Receive the data you gave us in a machine-readable format.
- Withdraw your choice to show your name publicly.
To exercise these rights, write to emil@ingerslev.io or use the contact form.
Complaints
If you are unhappy with how we handle your personal data, please write to us first. You also have the right to complain to the Danish Data Protection Agency, Datatilsynet:
- Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark
- dt@datatilsynet.dk, +45 33 19 32 00
- How to complain on datatilsynet.dk
Datatilsynet itself recommends that you contact the company you want to complain about before you complain to them.
Children's Privacy
Sponsometer is not directed at anyone under the age of 13. We do not knowingly collect data from children.
Changes to This Policy
We will notify users of material changes by posting an updated policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance.
Contact
- Company: INGERSLEV.IO ApS
- CVR number: 36393041
- Address: Løgten Østervej 90, 8541 Skødstrup, Denmark
- Contact: emil@ingerslev.io