PRIVACY POLICY

The data controller responsible for processing your personal data is:

Spark has not appointed a Data Protection Officer (DPO), as this is not required under GDPR Article 37 given the nature and scale of our processing activities.

2.1 Data You Provide Directly

• Account Information: Email address, display name, encrypted authentication credentials
• User-Generated Content: Questions you create, save, bookmark, or customise within the Service
• Payment Information: Processed by third-party payment providers (Stripe); we do not store full payment card details
• Communications: Messages or requests you send via email or in-app support

2.2 Data Collected Automatically

• Device and Technical Data: Browser type, operating system, device type
• Usage Data: Interactions with features, pages viewed, session duration
• IP Address: Used for security, fraud prevention, and approximate location (country-level only)
• Cookies and Similar Technologies: See Section 7

2.3 Sensitive Personal Data

Spark does not intentionally collect special category data (as defined in Article 9 GDPR), such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. If users voluntarily include such information in user-generated content, it is processed solely at the user's initiative and not for profiling or inference purposes.

Personal data is processed on the following legal bases:

• Performance of a Contract (Art. 6(1)(b)): To provide and operate the Service
• Legitimate Interests (Art. 6(1)(f)): Service improvement, security, fraud prevention, and technical maintenance
• Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies
• Legal Obligation (Art. 6(1)(c)): Accounting, tax, and regulatory compliance

Where required by law, consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Personal data is used to:

• Provide, operate, and maintain the Service
• Manage user accounts and subscriptions
• Process payments and issue transactional communications
• Store user preferences and settings
• Communicate with users regarding support requests
• Improve functionality and user experience using aggregated or anonymised data
• Detect, prevent, and address fraud or misuse
• Comply with legal and regulatory obligations

5.1 Service Providers

Personal data may be shared with trusted third parties acting as processors, including:

• Payment Processors: Stripe (PCI-DSS compliant)
• Hosting and Infrastructure Providers: Vercel, Supabase
• Analytics Providers: Only where consent has been given

All processors are contractually bound to process data only on Spark's instructions and in compliance with applicable law.

5.2 International Transfers

Where personal data is transferred outside the EU/EEA or UK, appropriate safeguards are used, including:

• Adequacy decisions where applicable
• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework (for participating organisations)

We do not sell, rent, or trade your personal data to third parties.

6.1 EU/UK GDPR Rights

You have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Request erasure of your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability (where applicable)
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

6.2 US State Privacy Rights (Including California)

Where applicable, you may have the right to:

• Know what personal data is collected and how it is used
• Request deletion of personal data
• Correct inaccurate personal data
• Opt out of the sale or sharing of personal data (Spark does not sell personal data)
• Not be discriminated against for exercising privacy rights

6.3 German Users

German users may lodge complaints with the relevant supervisory authority under the BDSG, including the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).

Spark uses:

Cookie preferences can be managed via browser settings or consent tools where available. Disabling essential cookies may limit Service functionality.

Personal data is retained only for as long as necessary:

• Account Data: Retained while the account is active; deleted within a reasonable period after account deletion
• Payment and Transaction Records: Retained as required by tax and accounting law (up to 10 years under German law)
• Usage Logs: Anonymised or deleted after operational use
• Communications: Retained for reference and legal purposes, then deleted

Spark applies appropriate technical and organisational measures to protect personal data, including:

• Encrypted data transmission (HTTPS/TLS)
• Restricted access to personal data
• Secure authentication mechanisms
• Regular review of security practices

The Service is not intended for children under 16 years (or 13 years in the United States). Spark does not knowingly collect personal data from children. If such data is identified, it will be deleted promptly. If you believe we have collected data from a child, please contact us immediately at [email protected].

This Privacy Policy may be updated from time to time. Material changes will be communicated through the Service or by email where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights:

Spark aims to respond to all requests within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA).

You have the right to lodge a complaint with your local data protection authority:

• Germany: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI) - bfdi.bund.de
• UK: Information Commissioner's Office (ICO) - ico.org.uk
• EU: Your local Data Protection Authority
• California: California Attorney General's Office