Three questions to apply.Nothing hidden.

Portal Media Group Ltd, company number 15224555, of 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, is the controller of the personal data described here. Write to services@portalbunny.com about anything on this page.

We have not appointed a Data Protection Officer, and we are not required to. We are not a public authority; we do not process criminal offence data or special category data; and our core activity is not the large-scale, regular and systematic monitoring of people. If what PortalBunny does changes, we will take that decision again. The address above is a privacy contact, not a Data Protection Officer.

What you send us in an application:

• Your LinkedIn profile link. We also keep the name in that link (for example alex-rivera) as the name on your application.
• Whether you have a sponsored LinkedIn post coming up in the next 30 days — yes, in talks or not yet.
• Your email address. It is how we answer an application — our Telegram address is in the footer if you would rather reach us, but applications are answered by email.
• Your confirmation that you are 18 or over. We store the fact that you confirmed it. We do not ask for a date of birth and do not hold one.

Applications sent before 13 October 2026 used an earlier form and also hold whether you applied as a creator or a brand, the name you typed, a second link for companies, and whether you ticked the box asking for occasional updates — with the exact sentence you were shown, the date and time, and the version of the form.

The Stage 2 question. If you answer the question at /vision, we hold the network you chose, whether you have a paid collaboration coming up, and your email if you chose to leave one. We use it only to decide which network to add next and, if you left an email, to tell you when it opens. It is kept on the same terms as an application (section 08).

And what we attach to it ourselves: a reference for the application, a private key that lets whoever applied open their own entry and nobody else, its status, the language of the form, which version of the form was used, which version of the terms you agreed to when you sent it and the exact sentence that said so, and the times it was created and last changed. Since 18 September 2026 the form also notes the country the application was sent from (worked out from the network address at that moment; the address itself is not kept), whether it came from a phone or a computer, and the site it came from, if there was one. We use these three to see where applications come from and to decide which markets to support first.

The chat helper. The small chat window on the site is answered by an AI model (OpenAI) using only the text published on this site. What you type in it is sent to that model to produce the answer. If you leave an email or a Telegram handle in the chat, or use the contact form inside it, the conversation is forwarded to the PortalBunny team so a person can reply. We do not use the chat to build a profile of you.

One necessary cookie remembers your cookie choice; analytics only if you accept. The site carries no advertising or tracking pixels. The analytics cookies are described in section 09, and they are not set unless you accept them. Most pages use fonts served from our own domain. Three pages for investors and partners (/summary, /pitch and /memo) load their fonts from Google Fonts, so opening one of them sends your IP address to Google.

The host that serves the site keeps an ordinary access log, which records IP addresses along with the pages requested, for a short time under its own retention rules. We do not keep a copy.

Every purpose we have, and the ground each one actually stands on:

Reading an application from a creator, and replying to it

Steps taken at your own request before any contract — Art. 6(1)(b).

Reading an application from a company, and replying to it — including the business contact details of whoever sent it

Our legitimate interest in assessing and speaking to prospective business partners — Art. 6(1)(f). The contract in prospect would be with the company, not with the person who filled the form, so their details do not rest on 6(1)(b).

Running the site, keeping it secure and working out what went wrong when something does — including the server logs that requires

Our legitimate interest in a service that stays available and can be examined after an incident — Art. 6(1)(f). It is a narrow interest: the log is read when something breaks or is abused. It is not read to build a picture of anybody, and nothing in it is joined to an application.

Remembering the answer you gave about analytics

A strictly necessary cookie, used only to remember your privacy choice, so that we do not have to ask again on every page. It holds nothing but your answer. Analytics itself stays off unless you accept it.

Sending you occasional updates, if you asked us to

Your consent, given only if you leave your email on the Stage 2 question at /vision (on applications sent before 13 October 2026, by ticking a box that started empty) — Art. 6(1)(a).

Using your answers to the Stage 2 question to decide which network to add next

Our legitimate interest in adding the network people actually make deals on — Art. 6(1)(f). No count is published, and an answer on its own does not decide what is built.

Measuring how the site is used, through Google Analytics 4, if you accepted analytics

Your consent, given on the banner — Art. 6(1)(a), and reg. 6 of PECR for the cookies themselves.

Keeping a limited record after an application has been declined or has closed

Our legitimate interest in knowing what we decided, not reviewing the same application twice, and being able to answer if you come back to us or disagree with the outcome — Art. 6(1)(f). How long that lasts is in section 08.

If you reject analytics, PortalBunny carries on working normally. We still process the limited information needed to deliver the site, keep it secure and remember your privacy choice — that much happens for every visitor, and it is the first four rows above. What stops is the measuring.

Nobody has to apply. If you do, every field is needed to review the application; without them there is nothing for us to look at, and no address to answer.

PortalBunny is intended for people aged 18 and over. We do not knowingly collect applications from anyone under 18, and the application asks you to confirm your age before it can be sent.

If we learn that we have collected personal information from someone under 18, we will delete it unless we have a legal reason to retain it.

If you believe someone under 18 has submitted personal information to PortalBunny, please contact us at services@portalbunny.com.

We do not use automated decision-making, or profiling, to accept or reject an application. Applications are read by people. That is not a legal flourish — it is why the confirmation says we will read it ourselves.

Our hosting provider and our email provider, because the site has to be served and the reply has to be sent. The AI model provider named in section 02 (OpenAI), but only for what you type into the chat helper, and only to produce the answer. Google, as the provider of the analytics described in section 09, but only if you accepted them. Authorities, where the law requires it.

No payment provider or data partner receives your application. We do not sell personal data, and we do not share it for advertising.

Your email address, and anything you write to us, is handled by Google Workspace, and reaches the United States. Under UK law that is a restricted transfer, so it needs a basis of its own.

It has one. Google LLC holds active status under the UK Extension to the EU-US Data Privacy Framework — the UK-US data bridge — for the kind of data we send, and you can check that yourself on the register the US Department of Commerce publishes. Google’s Cloud Data Processing Addendum also carries the UK Addendum to the EU Standard Contractual Clauses, which stands behind that. Google acts as our processor; we remain responsible for your data.

An application is kept while we are considering it and while we are talking to you about it.

If we decline it, or if it simply goes quiet, it is deleted twelve months later. The twelve months run from the moment it went quiet — the day we said no, or the last day anything happened to it — not from the day you sent it. The deletion is automatic: the server checks once a day and removes what is past the date. It is a rule that runs, not a sentence on a page.

Analytics data, if you accepted it, is kept by Google for fourteen months and then deleted.

If we accept it, what you sent becomes part of onboarding you and of the relationship that follows. We keep it for as long as we reasonably need it to bring you on, talk to you and run that relationship — so an accepted application is not on the twelve-month clock above.

When that relationship ends, we delete what we no longer need. Anything kept past that point is kept only because a specific, continuing reason requires it — a legal or regulatory obligation, an accounting record, a security matter, an unresolved dispute — and only for as long as that reason lasts. That is a narrow door, not a wide one: it covers the records that arose for those reasons, not a licence to hold your original application for ever.

PortalBunny uses analytics to understand how the site is used: which pages are viewed, where a visit came from, roughly where in the world it is, what device and browser it used, and what was clicked or opened. We use it to see what works on the site and what does not.

The product is Google Analytics 4. Two things about how it is set up, because they are the difference between measurement and surveillance: Google Signals is off and no advertising features are enabled, so nothing here is joined to an advertising profile or used to target you anywhere; and we do not send Google any details you gave us. Analytics data is kept for 14 months and then deleted by Google.

None of it runs until you say yes. No analytics cookie is set and no analytics script is loaded before you accept, and refusing takes exactly one press — the same as accepting. If you change your mind either way, the choice is at the foot of every page, and it is remembered in a single cookie that holds nothing but your answer.

Google Analytics involves the same transfer to the United States, and rests on the same basis, as the email described in section 07.