Privacy Policy

1. Data Controller

Spark is the data controller for the personal data collected through the Service. Our registered address is 64 Clifton Street, EC2A 4HB.

2. What Data is Collected

We collect various types of personal data to provide and improve our Service:

• Account Data: This includes your name, email address, and payment information (processed securely by our third-party payment processor).
• Authentication Data: Collected and processed by Clerk, our third-party authentication provider, to manage user identities and access.
• Usage Data: Information about how you interact with the platform, such as features used, session duration, and other analytical data.
• Content Data: Videos, GIFs, and images that you save, upload, or otherwise make available through the Service. This content is stored on Cloudflare R2.
• Technical Data: Your IP address, browser type, device information, operating system, and other technical identifiers.

WhatsApp: If you connect WhatsApp to Spark, we process the messages you send to Spark's WhatsApp number (and the links, videos and pictures in them), your WhatsApp profile name, and an id WhatsApp gives Spark for your account. We do not store your phone number. WhatsApp is provided by Meta, which delivers these messages to us. You can disconnect at any time in Settings in the Spark app.

3. How Data is Used

We use the collected data for the following purposes:

• To Provide and Improve the Service: To operate, maintain, and enhance the functionality and features of Spark.
• To Process Payments and Manage Subscriptions: To handle billing, invoicing, and subscription management through our payment processor.
• To Send Transactional Emails: To communicate important information regarding your account, billing, and service updates.
• To Provide Customer Support: To respond to your inquiries, troubleshoot issues, and provide assistance.
• Marketing Communications: With your explicit consent, we may send you promotional emails about new features, offers, and updates. You can opt-out of these communications at any time.

4. Legal Basis for Processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases for processing your personal data:

• Contract: Processing is necessary for the performance of a contract with you, specifically to deliver the Spark service as per our Terms of Service.
• Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our product, ensuring the security of our systems, and preventing fraud, provided that these interests do not override your fundamental rights and freedoms.
• Consent: We rely on your consent for sending marketing communications. You have the right to withdraw your consent at any time.
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject, such as tax and accounting requirements.

5. Third-Party Processors

We engage third-party service providers to assist us in providing and improving the Service. These processors have access to your personal data only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose. We have data processing agreements in place with each of these processors to ensure compliance with data protection laws.

6. Browser Extension (Spark: Save to Library)

The Spark browser extension allows you to save content directly to your Spark library while browsing the web. This section explains how the extension handles your data.

Data Collected by the Extension

• Authentication credentials: Your authentication token is stored locally in your browser (via Chrome Storage) to maintain your session. This token is only transmitted to Spark servers over encrypted connections.
• Content URLs and page titles: When you choose to save an item, the URL and page title are sent to Spark servers so we can add the content to your library.
• Media metadata: The extension identifies images, GIFs, and videos on the page you are currently viewing when you interact with the extension. This information remains local to your browser unless you choose to save an item.

Permissions and Why They Are Needed

• Active Tab: Allows the extension to identify saveable media on the page you are currently viewing, only when you interact with the extension.
• Context Menus: Provides a right-click "Add to Spark" option for convenient saving.
• Storage: Stores your authentication credentials locally in the browser so you remain signed in between sessions.
• Notifications: Displays confirmation messages when content is successfully saved to your library.

What the Extension Does Not Do

• Does not track or record your browsing history.
• Does not collect data passively or run in the background.
• Does not access page content unless you actively interact with the extension.
• Does not collect or transmit any personal data beyond what is described above.

7. Data Storage and Transfers

Your data, including content data, is stored on Cloudflare R2, which may involve storage in various geographical regions. If your data is transferred outside the UK or European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), to protect your personal data in accordance with UK GDPR requirements.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. The retention periods for different data types are as follows:

• Account Data: Retained while you have an account, and afterwards only as described below.
• Content Data: Retained until you delete it, or delete your account (see below).
• Usage Logs and Technical Data: Retained for a limited period for analytical and security purposes.

When you delete your account we lock it straight away and delete it 7 days later. We keep records of payments for 6 years after the end of the financial year they belong to, because UK tax law requires it. We also keep a minimal record that a deletion happened (account and workspace ids and dates, no name or email) for 6 years, so we can show we did it and, if we ever restore a backup, delete the data again.

9. User Rights (UK GDPR)

Under UK GDPR, you have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the deletion of your personal data under certain circumstances.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data under certain conditions.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to Object: You have the right to object to the processing of your personal data in certain situations.

To exercise any of these rights, please contact us using the details provided in Section 15. We will respond to your request within one month, as required by UK GDPR.

Deleting your account

You can delete your account at any time at get-spark.io/account, or from the Spark app (Settings, then Account, then Delete account), which takes you there. We lock your account straight away and delete it 7 days later, so you can change your mind in that time at get-spark.io/account by choosing Keep my account. If you're the only person in your workspace, we delete the workspace and everything in it. If you're part of a team, you leave the workspace: shared boards and collections, and the videos and frames you added, stay with your team, shown as added by a former member, and your private boards and collections are deleted. We'll email you when your account has been deleted. We keep records of payments for 6 years after the end of the financial year they belong to, because UK tax law requires it, and our payment provider Stripe keeps its own records. You can also ask us to delete your account by emailing hello@get-spark.io, and we'll do it within one month.

Complaints

If you're unhappy with how we've handled your data, email hello@get-spark.io and we'll acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk.

10. California Users (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights regarding your personal information:

• Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell.
• Right to Delete: You have the right to request the deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: Spark does not sell your personal information. Therefore, there is no need to opt-out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us using the details provided in Section 15.

11. Cookies

Spark uses cookies and similar tracking technologies to enhance your experience, analyse site usage, and for marketing purposes. Cookies are small text files placed on your device when you visit our website. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until they expire or you delete them).

We use cookies for:

• Authentication: To keep you logged in and remember your preferences.
• Analytics: To understand how users interact with our Service and improve its performance.
• Marketing: To deliver relevant advertisements and measure the effectiveness of our campaigns.

We obtain your consent for the use of non-essential cookies in compliance with UK Privacy and Electronic Communications Regulations (PECR). You can manage your cookie preferences through your browser settings.

12. Referral Partners

Spark works with a small number of referral partners ("ambassadors") who recommend Spark to their audience. A partner is paid a commission when a workspace they introduced becomes a paying customer. This section explains what we record to make that work and what a partner can see.

• The _spark_ref cookie: If you arrive at Spark through a partner's link, we set a cookie named _spark_ref. It holds the partner's short code and nothing else, and it expires after 90 days. The first partner link you follow is the one we record. A later link does not replace it.
• Promotion codes: If you enter a partner's promotion code at checkout, Stripe tells us which code was used and we credit that partner. A code used at checkout takes precedence over a link.
• What we link to your account: When you sign up, the partner code is copied onto your account, and when your workspace is created it is linked to that partner. The only things that change that link are a different partner's promotion code used at checkout before your workspace first pays, or a correction made by us. If your workspace does not start a paid subscription within 90 days of that first introduction, the link lapses and no commission is paid.
• What a partner can see: A partner sees only pseudonymous information about the workspaces they introduced: the plan, the number of seats, the month the workspace joined, whether the referral is active, and the commission due to them. A partner never sees your name, email address, workspace name, payment details or any identifier that could be used to look you up, and cannot contact you through Spark.

We process this data on the basis of our legitimate interest in running the partner programme and paying partners accurately. You can remove the _spark_ref cookie at any time through your browser settings, or contact us using the details in Section 15 if you would prefer that no partner record is kept for your workspace.

13. Children's Data (COPPA)

Spark is not intended for use by individuals under the age of 13 (in the United States) or under the age of 16 (under UK GDPR, unless a lower age is specified by national law). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such information as quickly as possible.

14. Changes to the Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of the Service after such modifications constitutes your acknowledgment and acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: hello@get-spark.io

Registered Address: 64 Clifton Street, EC2A 4HB

If you're unhappy with how we've handled your data, email hello@get-spark.io and we'll acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk.