Privacy Policy

Scope

This Privacy Policy explains how CALCORP SLU, operating the product SAM Platform, processes personal data through samplatform.io, app.samplatform.io, related support channels, and the SAM Platform application.

The marketing website helps Properties and Sponsors learn about SAM Platform and request demos. The application helps Properties and Sponsor users manage sponsorship Contracts, Assets, Requests, Events, and related operational records.

Controller and processor roles

CALCORP SLU, NRT L-715929-V, Col de Ordino, Edificio la Llobatera, AD300, Ordino, Andorra, is the controller for website activity, demo and contact requests, account administration, security, support, legal acceptance records, and analytics where SAM Platform determines the purpose and means of processing.

Where a Property uses SAM Platform under a separate written agreement and enters or manages personal data relating to its own users, Sponsor users, Contracts, Assets, Requests, Events, or uploaded materials, that Property may be the controller and CALCORP SLU may process the data as a processor or service provider under that agreement.

Contact: info@samplatform.io

Information we collect on the website

When you contact SAM Platform through samplatform.io, we collect the details you choose to send, such as your name, work email, organization, role, and message.

The website may also collect technical and analytics information, such as page views, device type, browser, approximate location, referral source, and consent preferences.

Information we process in the application

When you use app.samplatform.io, we may process account and operational information including name, email address, organization, membership, role, language, authentication state, Contracts, Assets, Requests, Events, uploaded images, request notes, notification preferences, support messages, audit/history records, and product analytics where enabled.

SAM Platform is a B2B product. Commercial sponsorship data, contract metadata, request history, uploaded media, and similar records are treated as confidential business information and are shown only to authorized users for the relevant Property, Sponsor, Contract, or operational role.

How we use information

We use personal data and operational data to:

• Respond to contact and demo requests
• Provide, secure, and maintain SAM Platform
• Authenticate users and manage access to Properties, Sponsors, and Contracts
• Let Properties and Sponsor users submit, review, approve, reject, and track Requests
• Send transactional emails, invitations, password reset messages, and product notifications
• Provide support and investigate bugs, abuse, security events, and reliability issues
• Improve the website, product experience, and user workflows
• Keep legal, security, and operational records where required

Legal bases

Depending on the context, we process data because it is necessary to provide the requested service, perform or prepare a contract, comply with legal obligations, protect legitimate business and security interests, or because you have given consent. Optional analytics for Sponsor users is consent-based and can be rejected while continuing to use essential platform features.

Service subprocessors

These providers process Client Data to deliver SAM Platform:

• Supabase: authentication and file storage
• Neon: database
• Railway: backend hosting
• Netlify: marketing website and application frontend hosting through a global content delivery network; for the application, it is a Service subprocessor and the CDN receives request network metadata
• Resend: transactional and notification email
• PostHog EU: product analytics, in-app surveys, and session replay where enabled
• Google Workspace: support and legal mailboxes

Every service that stores SAM data runs in the EU today — database, authentication, file storage, backend, email delivery, product analytics and support mail. The web application itself is served from a global content delivery network, which sees the network metadata of each request. Your agreement permits transfers outside the EU under Standard Contractual Clauses.

Website processors

These providers support samplatform.io. In this website role, they process pre-signup visitor or technical request data, not Client Data governed by a customer DPA. Google Analytics and Cloudflare Web Analytics are website processors, not application service subprocessors:

• Google Analytics: marketing-site traffic analysis, loaded only after analytics consent; it is not used in the application and processes only pre-signup samplatform.io visitor data, not Client Data under the customer DPA, so it is not a Service subprocessor
• Google Fonts: font stylesheets and files for the marketing website
• Cloudflare DNS: authoritative DNS management for samplatform.io and app.samplatform.io; separate from Cloudflare Web Analytics
• Cloudflare Web Analytics: cookieless marketing-site traffic and performance measurement; its beacon loads before analytics consent and does not use cookies or local storage. It is a website processor for samplatform.io, not an application service subprocessor, and is separate from Cloudflare DNS
• Slack: internal notification of contact form submissions, including the name, email, organization and message you send, so our team can respond; it is a website processor for samplatform.io, not an application service subprocessor

Provider privacy information:

• Netlify: https://www.netlify.com/privacy/
• Railway: https://railway.com/legal/privacy
• Neon: https://www.databricks.com/legal/privacynotice
• Supabase: https://supabase.com/privacy
• Resend: https://resend.com/legal/privacy-policy
• PostHog: https://posthog.com/privacy
• Google Fonts, Google Workspace and Google Analytics: https://policies.google.com/privacy
• Cloudflare: https://www.cloudflare.com/privacypolicy/
• Slack: https://slack.com/trust/privacy/privacy-policy

Some providers may process data outside Andorra or the European Economic Area. Where required, we rely on adequacy decisions, standard contractual clauses, data processing agreements, or equivalent transfer safeguards.

Retention

We keep contact and demo request data for as long as needed to respond and manage the commercial relationship. Application records are kept for the duration needed to provide SAM Platform, support ongoing use of the platform, comply with contractual or legal obligations, resolve disputes, and maintain security and audit records. Analytics and operational logs are kept according to the configured retention periods of the relevant provider.

Security

We use technical and organizational measures designed to protect personal data, including access controls, authentication, tenant-scoped authorization, transport encryption, provider security controls, logging, and operational review. No internet service can be guaranteed to be completely secure.

Platform operator access to accounts

Authorized SAM Platform staff may, in limited circumstances, access your account view in read-only mode to provide support, investigate a billing matter, respond to a security or compliance event, or conduct product research to understand how the application is used. Every such access session requires the operator to re-authenticate with their password, select a documented reason category (support, billing, security investigation, compliance, or user research), and confirm the specific account and context being accessed. Access is strictly read-only — no data can be modified during the session. Sessions expire automatically after 30 minutes. Each session is recorded in an immutable audit log that captures the operator identity, email, IP address, timestamp, reason, and every page requested.

Access for support, billing, security, and compliance purposes is based on our legitimate interest in delivering and protecting the service. Access for user research purposes is also based on legitimate interest. You may object to this category of access at any time by contacting info@samplatform.io.

Your rights

You may request access, rectification, erasure, objection, restriction, portability, or withdrawal of consent where applicable. To exercise these rights, contact info@samplatform.io. If your request relates to data controlled by a Property, we may direct the request to that Property or support the Property in responding.

You may also lodge a complaint with the Andorran Data Protection Agency (APDA) or another competent supervisory authority.

Changes

We may update this Privacy Policy from time to time. The latest version will be published on this page with an updated date.