Privacy notice

Last updated: November 10, 2026

This is a courtesy translation of the Aviso de privacidad. If the two versions differ, the Spanish version governs.

This notice explains what personal data we process, what for and what you can do about it. It has two separate parts: this site's waitlist and the esponsor app for Mac. Each one describes only what it does today.

Waitlist

When you join the waitlist we store:

• Your email.
• The date and time you signed up and, if you confirm it, the date and time you confirmed it.
• The UTM tags in the link you arrived from, if it has any: utm_source, utm_medium, utm_campaign, utm_term and utm_content. They tell us where your visit came from, for example which post or campaign. They are stored only the first time you sign up.
• The language of the page you signed up from, Spanish or English. It is stored only the first time you sign up.

Then we send you an email to confirm that the address is yours. The link in that email carries your email and the time it was created, with a signature so that no one can alter it, and it stops working after 7 days. If you sign up again before confirming, we send it to you again, unless we sent it to you very recently.

To show you the site and receive your signup, Vercel, which hosts the site, processes your IP address and the technical data of each request, such as the page you open and your browser. It also uses your IP address to apply a request limit per address, which curbs anyone trying to sign up emails in bulk.

The form has a hidden field that people don't see (a honeypot) and measures how much time passes from when the page loads until you submit it. Both serve only to tell a person from an automated program and are not stored. If your email is from a known temporary email service, the server writes in its technical log only the domain, the part after the @, never your email, and your signup stays the same.

The site does not use cookies. To count visits it uses Vercel Web Analytics, which recognizes a visit by a code calculated from the request that is deleted every day and only shows us aggregate figures, so it doesn't know who you are or follow you on other sites. The only thing it stores in your browser is a localStorage entry named esponsor:waitlist:v1, which remembers that you already signed up. It stays in your browser, does not reach us, and you delete it when you clear this site's data in your browser.

The app

The esponsor app for Mac processes this data:

• Your account. To see sponsors you need an account. You sign in with your email and a six-digit code we email you, not with a password. We store your email, when you verified it and, each time you request a code, the IP address you request it from, to limit the attempts. If you add a name or an institution to your account, we store them too. We infer a country from your Mac's region settings and time zone and use it to choose ads and for per-country figures. If you add a country to your account, we store it too.
• Your Mac. The app creates a random identifier for your Mac and stores it on your Mac. It doesn't use the serial number or any Apple identifier. When your Mac is registered, when you open the app and with each click on an ad, it sends that identifier along with the model and its marketing name, the chip, the memory, the macOS and app versions, the screen resolution and scale, whether it has a notch, your region settings, your language and your time zone.
• When you're at your Mac. The app checks how many seconds have passed since you last used the keyboard or the mouse, never which keys you pressed or what you did, whether the session is locked, whether the screen or the Mac is asleep and whether the ad bar is visible.
• How you use the app. It sends events such as when you open it, when an ad starts, ends or is interrupted and why, your clicks on the bar and on ads, and when you pause, resume or disable it. While the app runs, it tells the server every so often how many seconds you were available and whether there was an interruption. For each hour it sends how long you were available and how many ads you saw and opened. Each event carries the date and time, your Mac's identifier and a session identifier.
• What you earn. The server keeps a record of the ads that count and of what you have earned with them, and the app shows you your balance.
• The pause when you share or record your screen. It comes turned on and you can turn it off. To detect that you are sharing or recording your screen, the app checks whether a known app for online meetings, screen sharing or screen recording is open and showing a floating window. It looks at which apps are open and the layer and size of their windows, never their titles or their content. When it pauses or resumes for this reason, it sends which app caused it. The detection is not perfect.

While you have the sign-in screen open, the app reads the text you copied to see whether it is a six-digit code and offer to paste it. That happens only on your Mac and is not sent anywhere. The app also keeps on your Mac a copy of its events and of your active hours, to show them to you.

The app does not ask for special macOS permissions. It never reads what is on your screen, your files, which window is active, your window titles or what you type.

None of the data in this notice is sensitive personal data, such as your health, your origin or your beliefs.

If you want to advertise

If you fill in the form to advertise your brand, on the site or on the page for brands, we receive your email, the name of your brand or business and, if you write it, what you want to advertise, along with the page's language. We keep them in a Google Sheets spreadsheet, and Resend sends you an email confirming we got them. We only use them to reply to you and talk about your campaign. The form has the same hidden field and the same timing check as the waitlist, only to stop automated programs.

What we use your data for

These purposes are necessary to provide you the service:

• Confirming that the waitlist email is yours and letting you know when esponsor launches.
• Keeping the site running and protecting it from automated signups and abuse.
• Creating and maintaining your app account and letting you sign in.
• Showing ads only when you're at your Mac and the bar is visible, pausing them when you share or record your screen, and counting the ads you saw.
• Calculating what you have earned and showing it to you.
• Preventing fraud, such as fake activity or repeated events.
• Offering spots to sponsors with aggregate figures that don't identify you, such as how many Macs there are in a country or at what times more people are available.
• Answering your messages and your requests.
• Replying to brands that ask us about advertising.

This purpose is optional: knowing where the people who sign up come from, with the UTM tags in the link. If you don't want us to use them, write to us and we delete them. Your place on the list doesn't change.

We use the waitlist email only to confirm it, remind you to confirm it if you haven't, let you know about the launch and let you know about important changes to this notice. Today the app doesn't ask for or use your profession, your age or your city. If we ever add personalized ads, we will ask you first and update this notice.

Who receives your data

We use these providers, which process your data on our behalf and only to provide their service to us:

• Google, with Google Sheets and Google Apps Script, stores the waitlist and the requests to advertise. We receive your replies to our emails in Gmail.
• Resend sends the waitlist confirmation email, the email confirming your request to advertise and the codes to sign in to the app.
• Vercel hosts this site, processes the requests that reach it, including your IP address, and counts visits in aggregate.
• Supabase hosts the app's database.
• A cloud server provider runs the app's server.

These providers may process your data outside Mexico.

esponsor does not sell your personal data and does not transfer it to third parties, except to an authority that requires it of us under the law. When you click an ad, the sponsor's site opens in your browser, like any link, and what that site does with your visit is up to that site.

How long we keep it

• Your waitlist email and your signup data, until 12 months after the launch, or sooner if you ask us to delete them.
• The data from the form to advertise, until 12 months after our last message with you, or sooner if you ask us to delete it.
• The confirmation link stops working after 7 days. The site doesn't store the link; it only goes in the email we send you.
• The app's records of the ads that count and what you earn, 5 years.

When a piece of data is no longer needed, we block it and then delete it, as the law requires.

How we protect it

• Confirmation links are signed, so no one can create one for someone else's email or change the one you received.
• The site can only write to the waitlist with a secret key it shares with it.
• A hidden field (honeypot), a minimum time to submit the form and a request limit per IP address curb automated signups.
• The codes to sign in to the app are never stored as they are and only accept a few attempts. The app stores your session in your Mac's keychain.

If a security breach occurs that significantly affects your rights, we will let you know right away so you can protect yourself.

Your ARCO rights

ARCO is the Spanish acronym for the rights of Access, Rectification, Cancellation and Opposition. You have the right to:

• Access: know what data of yours we have and how we use it.
• Rectification: correct it if it is wrong, incomplete or out of date.
• Cancellation: ask us to delete it. Before deleting it we block it for a time, only to answer for anything arising from its use, as the law requires.
• Opposition: ask us to stop using it for a legitimate reason, or when automated processing significantly affects you.

To exercise them, write to contact@esponsor.io. Your request is handled by the Responsable de datos personales (personal data office) area and must include:

• Your name and an email or other means for us to reply to you.
• A document proving your identity or, if someone writes on your behalf, their identity and their authority to represent you.
• Which right you want to exercise and, unless you are asking for access, which data you mean.
• Anything else that helps us find your data, such as the email you signed up with.

If you ask for a correction, tell us what to change and, if needed, send the document that supports it.

We reply within 20 business days at most from when we receive your request. If your request is granted, we carry it out within the 15 business days after our reply. When the case justifies it, each period can be extended once by an equal period.

Exercising your rights is free. We could only charge you what it costs to reproduce, copy or send your data, and if you give us the means to reproduce it, we charge you nothing.

How to limit use or withdraw your consent

You can withdraw your consent at any time. Write to contact@esponsor.io, tell us which email it refers to and what you want us to stop doing. Withdrawing it doesn't change what we already did with your data before.

• To leave the waitlist, write to us and we delete your email.
• For us to stop using your UTM tags, write to us.
• In the app you can pause ads, turn off the pause when sharing your screen, sign out or disable the app, and you can uninstall it like any other app on your Mac.
• To delete your app account, write to us. Today it can't be done from the app.

The authority

If you believe we did not handle your rights properly, you can go to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government), the authority that oversees the personal data protection law. You can file your data protection request within the 15 business days after our reply or, if we did not reply, from when the deadline to do so expires.

Changes to this notice

If we change this notice, we publish the new version on this page with a new last-updated date. If the change is important, such as a new piece of data or a new purpose, we also let you know by email. To use your data for a new purpose we will ask for your consent first.

Contact

For any question about your data or this notice, write to us at contact@esponsor.io.

Who is responsible for your data

• Responsible party: [to be defined]
• Address: [to be defined]
• Email for your data and your rights: contact@esponsor.io