Before diving in, here's what matters most:
This Privacy Policy explains how SparkText ("SparkText", "we", "us", "our") collects, uses, stores, and shares your personal data when you use:
We are the data controller for the personal data described in this policy. Where we use third-party services to process data on our behalf, those parties act as data processors or sub-processors.
We follow the EU General Data Protection Regulation (GDPR) and the UK GDPR. We also aim to respect the privacy rights of users in the United States and other regions. Relevant regional specifics are noted throughout.
We collect personal data in three ways: directly from you, automatically when you use the service, and from third-party sign-in providers.
When you create an account, we collect:
openid, email, and profile. We do not access your Gmail, Google Drive, or any other Google services.
We maintain a user profile containing:
free, plus, or pro)cus_...) — a reference token used to link your account to your Stripe billing record
We do not store credit card numbers or full payment details. Those live exclusively with Stripe.
This section is especially important. Please read it.
When you use SparkText's coaching features:
What IS stored - only if you choose to save it:
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) - processing is necessary to provide the service you signed up for.
Legal basis: Performance of a contract (Art. 6(1)(b)) and Compliance with a legal obligation (Art. 6(1)(c) for accounting record-keeping.
Legal basis: Legitimate interesta (Art. 6(1)(f) GDPR - protecting the service and users. We have balanced these interests against your rights and consider proportionate.
Legal basis: Legitimate interests (Art. 6(1)(f)) improving service reliability and quality.
Legal basis: Legal obligation (Art. 6(1)(c)) or Legitimate interests (Art. 6(1)(f)).
Legal basis: Performance of a contract (Art. 6(1)(b)) for transactional emails; Consent (Art. 6(1)(a)) for any future marketing.
We do not sell your personal data. We share data only with the service providers listed below, who process it on our behalf under contractual obligations to protect it.
OpenAI privacy policy: https://openai.com/privacy
Stripe privacy policy: https://stripe.com/privacy
Supabase privacy policy: https://supabase.com/privacy
Google privacy policy: https://policies.google.com/privacy
We keep your data only as long as needed. Here is a summary by category:
SparkText is based in the Netherlands (EU). However, some of our service providers process data outside the European Area (EEA), including in the United States.
When personal data is transferred outside the EEA, we ensure appropriate safeguards are in place. These typically include:
Specific providers and their transfer mechanisms:
If you have questions about specific transfer mechanisms, contact us using the details in section 13.
If you are in the EU or UK, you have the following rights regarding your personal data. We will respond to all verified requests within one month (extendable by two further months for complex requests)
Request a copy of the personal data we hold about you.
Ask us to connect inaccurate data or complete incomplete data.
Ask us to delete your personal data. We will comply unless we have a legal obligation to retain (e.g. financial records). Deleting your account removes your profile data, but billing records are retained for legal compliance.
Ask us to pause processing of your data in certain circumstances (e.g. while you contest its accuracy).
Request a copy of the data you have provided to us in a structured, machine-readable format (JSON or CSV).
Object to processing based on our legitimate interests at any time. We will stop unless we have compelling legitimate grounds that override your interests.
Where processing is based on your consent (e.g. analytics cookies), you can withdraw consent at any time without affecting the lawfulness of prior processing.
SparkText does not make decisions based solely on automated processing that produce legal or similarly significant effects.
We may ask you to verify your identity before processing a request. We will respond within 30 days; complex requests may take up to 3 months (we will let you know).
If you are unhappy with how we handle your data, you have the right to lodge a complaint with:
We would always prefer the chance to resolve things with you directly first. Please reach out to us.
SparkText uses cookies and similar technologies some of which require your consent before they activate. Here is what we currently use:
There are required for SparkText to work. They cannot be turned off.
We use non-essential tracking tools, each blocked by default until you give consent via our cookie banner.
We use Plausible to understand how visitors use SparkText - which pages are visited, where traffic comes from and how users navigate the site. Plausible is a privacy-first analytics tool: it does not use tracking cookies, does not fingerprint your device and does not share your data with advertising networks. It collects anonymous, aggregate statistics only.
We use the Meta Pixel to measure the effectiveness of any advertising we run on Facebook and Instagram. If you visit SparkText after seeing one of our ads, the pixel helps us understand whether thad ad led to a visit. This data may be shared with Meta Platforms, Inc.
The Meta Pixel does not load unless you have accepted Marketing cookies. If you decline or withdraw consent, no pixel data is sent.
We use Cookiebot as our consent management platform. When you first visit SparkText, a cookie banner appears asking for your preferences across three categories:
All non-essential scripts are blocked automatically until you give consent. This is handled by Cookiebot's auto-blocking mode, meaning no analytics or marketing code runs before your choice is recorded.
You can change your preference any time by clicking the cookie icon or preferences link in the footer of the site. Withdrawing consent stops all non-essential tracking immediately and does not affect the lawfulness of any processing that took place before you withdrew.
Your consent is recorded by Cookiebot and stored locally in your browser. Consent records expire after 12 months, after which you will be asked again.
For more information on how Cookiebot handles consent data, see: https://www.cookiebot.com/en/privacy-policy/
SparkText is intended for adults aged 18 and over. We do not knowingly provide services under 18, and we do not knowingly collect personal data from anyone under that age. If you are a parent or guardian and believe your child under 18 has created a SparkText account, please contact us immediately at support@spark-text.com. We will promptly delete the account and associated data. If you are under 18, please do not use SparkText.
We take the security of your data seriously. Our measures include:
Important: No system is 100% secure. While we do our best, we cannot guarantee absolute security. If you suspect unauthorized access to your account, please contact us immediately and change your password.
We may update this Privacy Policy from time to time. When we do:
We encourage you to review this page periodically. Older versions of this policy are available on request.
For any privacy-related questions, requests, or concerns, please contact:
