Privacy Policy

1. Information We Collect

Information You Provide

We collect information you provide directly, including:

• Account registration details (name, email address, company name);
• Payment information (processed securely through Stripe; we do not store card details);
• Communications you send to us (support tickets, contact form submissions);
• User Content uploaded or created through the Platform.

Information Collected Automatically

When you use the Platform, we automatically collect:

• Log data (IP address, browser type, pages visited, timestamps);
• Device information (hardware model, operating system, unique device identifiers);
• Usage data (features accessed, actions taken, performance metrics);
• Cookie and tracking data (see Section 4).

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform and Services;
• Process transactions and send related information (confirmations, invoices);
• Send technical notices, updates, and support messages;
• Respond to enquiries and provide customer support;
• Send marketing communications (where you have consented);
• Monitor and analyse usage patterns to improve user experience;
• Detect, investigate, and prevent fraudulent or illegal activity;
• Comply with legal obligations.

Our legal bases for processing under GDPR include: performance of a contract, legitimate interests, compliance with legal obligations, and where required, your explicit consent.

3. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service Providers: Third parties who perform services on our behalf (cloud hosting, payment processing, analytics). These parties are bound by data processing agreements.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections.
• Legal Requirements: When required by law, court order, or governmental authority.
• Protection of Rights: To enforce our Terms, protect our rights, or the safety of users or the public.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect usage information and improve the Platform. Cookie types we use:

• Essential Cookies: Necessary for the Platform to function (session management, security).
• Analytics Cookies: Help us understand how the Platform is used (we use privacy-respecting analytics).
• Preference Cookies: Remember your settings and preferences.
• Marketing Cookies: Used to deliver relevant advertisements (with consent only).

You can control cookies through your browser settings. Disabling essential cookies may affect Platform functionality. You can manage your cookie preferences at any time through our Cookie Consent Manager.

5. Data Security

We implement industry-standard security measures to protect your personal data, including TLS encryption for data in transit, AES-256 encryption for data at rest, access controls and authentication requirements, regular security audits and penetration testing, and SOC 2 Type II compliance for our infrastructure.

While we take all reasonable precautions, no method of internet transmission is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Upon account termination, we retain data for 30 days to allow for reinstatement, after which personal data is permanently deleted. Some data may be retained longer where required by law (e.g., financial records for 7 years).

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent where processing is consent-based.

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

8. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18 without parental consent, we will take steps to delete that information as soon as possible.

9. International Data Transfers

SpinSparkStack operates globally. Your data may be transferred to and processed in countries other than your country of residence, including the United States. For transfers from the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission or other legally approved transfer mechanisms.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on the Platform. The date at the top of this page indicates when it was last revised. We encourage you to review this Policy periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

EU residents may also lodge a complaint with their local data protection supervisory authority.