Privacy Policy

Luodaint LLC operates Sponsor My Ultras and is responsible for the sponsor information we handle. This policy describes the current service, including its sandbox preview, and applies to information collected through this site and sponsorship support communications.

1. Information we collect

• Bid information: your brand description (up to 140 characters), brand name, email address, website, selected placement, amount, submission time and bid status.
• Artwork: logo files you upload and any print-ready artwork or instructions you send us.
• Payment records: Stripe checkout, payment and refund identifiers, amounts, tax totals and statuses needed to reconcile your sponsorship. Stripe collects your payment method and may request billing, location or tax-ID information. We do not collect or store full card numbers or card security codes.
• Communications and technical information: messages you send us and information hosting or payment services process to deliver and protect the site, such as IP addresses, browser details, request times and error or security logs.

When you sign in with X, we receive your X account ID, handle, display name and profile picture. We use the account ID to identify which bids belong to you, including repeat bids and bids on different spots. Your handle, profile picture and brand description may appear publicly with your sponsorship. We do not retain X access tokens or request permission to post on your behalf. An essential, HttpOnly session cookie keeps you signed in for up to seven days; signing out revokes it. X processes the sign-in under its own Privacy Policy.

2. How we use information

We use information to process bids and payments, determine leading sponsors, issue refunds, review artwork, produce placements, display sponsors and links, communicate about the season, provide support, prevent abuse, resolve disputes and meet applicable recordkeeping obligations. We do not use your bidding email for unrelated marketing without a separate permission or another lawful basis where applicable.

Where data-protection law requires a legal basis, we rely on performing the sponsorship agreement or taking steps at your request, complying with legal obligations, and legitimate interests in operating and securing the service. Where required, optional processing relies on your consent, which you may withdraw.

3. What other visitors can see

Qualifying bids may display your brand name, bid amount, selected spot and logo publicly. Successful sponsors' website links and logos may appear on this site, printed kit and race updates. Public race photographs can be copied or reshared by others. Your bidding email and private payment-status link are not intentionally published. Pending payment and refund records are used to administer your transaction.

4. Service providers and sharing

We use Cloudflare for hosting, database services, uploaded-logo storage and transactional email delivery, and Stripe for payment processing, tax calculation and refunds. Email delivery includes your email address, bid details, private status link, message content and delivery records. We send payment confirmations, outbid notices and refund confirmations to administer your bid. Stripe also processes information under its own Privacy Policy. Artwork may be shared with a printer or production provider to deliver your agreed placement. We share information needed for these services, support, lawful requests or protecting the service.

We do not sell personal information or use the site to share it for cross-context behavioral advertising. Sponsor logos and promotional links are advertising placements you request; they are not a sale of visitor personal data.

5. Cookies and analytics

The private admin area uses essential HttpOnly session and login-challenge cookies. Administrator email codes expire after 10 minutes, can be used once, and are checked against protected hashes; sessions expire after 12 hours or sign-out. These cookies do not track public visitors across sites.

When you visit a sponsor website through a logo menu, our server records an aggregate click count for that sponsor and day, then redirects you to their site with UTM parameters identifying Sponsor My Ultras, the season and placement. These click counts do not store visitor IP addresses or use tracking cookies. Counts can include repeat visits. The sponsor website processes your visit under its own policies.

We use DataFast in cookieless mode to measure public page visits, traffic sources and device/browser information. This mode uses sessionStorage for analytics identifiers rather than tracking cookies. DataFast receives technical information with analytics requests, including your IP address. We exclude admin, login, account and payment pages from pageview tracking. Analytics identifiers are attached to Stripe checkout for revenue attribution. Our connected Stripe integration allows DataFast to process payment information for revenue reporting. We do not directly identify your account profile through the browser analytics SDK. The public live-visitor widget also connects your browser to DataFast. We also measure recognized crawler requests on public pages using their requested path, user agent, IP address and response status. Query strings and private pages are excluded from crawler analytics. See DataFast's privacy policy for its handling of data.

Hosting and payment services may use cookies or similar technologies needed for security and their services. Stripe's own checkout may use cookies under its policies.

6. Retention and security

We retain sponsorship, payment and support information for as long as needed to fulfill the season, handle refunds or disputes and satisfy applicable accounting and legal obligations. Logos may remain with published season records and race photographs. We assess deletion requests against those purposes and any records we must keep; we do not promise that deleting a bid can remove copies of already-public photographs elsewhere.

We use reasonable safeguards and limit operational access, but no system is completely secure. Treat your private payment-status link like a receipt containing personal transaction information. Contact us if you think it has been exposed or your information is inaccurate.

7. International processing and your choices

Luodaint LLC is based in the United States. Our providers may process information in the US or other countries. Where applicable law requires international-transfer safeguards, we use appropriate safeguards for those transfers.

Depending on your location, you may have rights to request access, correction, deletion or a copy of your information; restrict or object to certain processing; or withdraw consent. Email us to make a request. We may need to verify your identity and explain any legal exceptions. Where applicable, you may complain to your local data-protection authority. We do not discriminate against you for exercising applicable privacy rights.

8. Children and policy changes

Bidding is intended for adults aged 18 or over. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has submitted information so we can investigate and address it. We will update this policy when our practices change, show the new effective date, and provide further notice when required.

9. Contact and privacy requests