Sparks Privacy Notice
Last updated: 11 October 2026
This notice explains how Sparks handles personal data about people who use bysparks.com: beta applicants, account
holders, editors, and anyone who contacts us. It does not cover visitors to sites our customers publish on
<slug>.bysparks.net: each of those sites has its own privacy notice, because the site's owner decides how their
visitors' data is used, and we only host it for them (see section 4).
1. Who we are
Nir Ninio, a registered business in Israel (Osek Murshe no. 034134452), trading as "Sparks", runs Sparks and is the controller of the data described here. If a company is formed to run Sparks, it will take over this role and we'll update this notice. We work by email; a postal address is available on request.
- Privacy questions and requests (including security reports): privacy@bysparks.com
- Everything else: support@bysparks.com
- EU and UK users: the beta is open worldwide, and the GDPR and UK GDPR apply to how we handle your data. We haven't appointed a representative in the EU or UK (GDPR Art. 27) during the free beta; we'll appoint one before the paid launch and name it here. Until then, contact us directly at privacy@bysparks.com, and you can always complain to your local data protection authority (section 8).
- Data protection officer: we haven't appointed one. Privacy questions go to privacy@bysparks.com, which the founder answers.
2. What we collect, and why
| What | Examples | Why we use it | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Waitlist application | First and last name, email, LinkedIn URL, your answers on the "Join the private beta" form (your type of work, whether you have a website and its address, your country, how you'd use Sparks and start with it, whether you'd give feedback, whether you'd pay), how you heard about us (including which Sparks site referred you, if you came from a site's badge) | To choose and invite beta testers | Legitimate interests (running a selective beta) |
| "Sparks news" opt-in (optional) | Your email and that you ticked the box | To send you news about Sparks | Consent (unsubscribe at any time) |
| Account data | Name, email, sign-in method (email code or Google), invite code, plan, role on each site | To create and run your account | Contract |
| Your material | Links you paste, text you type (such as your bio), files you upload (e.g. a LinkedIn PDF), your existing website's pages (up to 12), your answers in the build, photos | To build and maintain your site, which is the service you asked for | Contract; plus your AI consent at sign-up (section 3) |
| Free website audit | The website address you ask us to check, and the result | To show you the audit | Legitimate interests |
| Your site's content | The text, facts, photos and posts on your site, including AI edits and their originals | To host and publish your site | Contract |
| Consent records | That you agreed to the AI consent, when, and which text version | To prove what you agreed to | Legal obligation / legitimate interests |
| Security and login records | Logins, failed logins, sign-outs, password resets, IP address, browser/device, time | To keep accounts safe and investigate misuse | Legitimate interests (security) |
| Usage and cost data | Which features you use, AI and email usage, build jobs | To run the service within each account's budget and fix problems | Legitimate interests |
| Support emails | What you write to support@ and our replies | To help you | Contract / legitimate interests |
| Service emails | Delivery and bounce data for the emails we send you | To send required notices (welcome, preview ready, beta ending, suspension and deletion warnings) | Contract |
| Website analytics | Page views on bysparks.com, counted without cookies (section 9) | To understand how the site is used | Legitimate interests |
| Abuse protection | Your IP address, held briefly in memory to limit how often a form can be sent; not stored | To stop spam and abuse | Legitimate interests (security) |
| Billing (paid launch only; there are no payments in the beta) | Plan, invoices, payment status. Card details go to Paddle, never to us | To bill you | Contract; legal obligation (tax records) |
What we don't do: we don't sell personal data, we don't use it for advertising, we run no ad pixels, and we don't train AI models on it.
During the beta we don't search the web about you and don't use photos of you found online. If we switch this on later, we'll update this notice and ask for your consent first.
Giving us your account details and material is needed to provide the service; without them we can't build your site.
3. AI processing
- What happens: AI models read your material and write your site: they extract facts, draft sections, check every sentence against the facts, and edit your photos (background, lighting, clothing, framing; never your face).
- Nothing invented: facts on your site must trace to your material or to something you confirmed. You see the facts we understood, and you review a private preview before anything goes public.
- Faces: to crop photos and to check that generated images contain no people, we use face detection only (a box and a score). We don't compare faces, recognise people or keep face templates.
- No automated decisions with legal effects about you are made by AI.
- Providers: OpenAI (text and image editing) and Anthropic (text), reached through the Vercel AI Gateway. These are providers whose API terms don't allow training on our data. They process your material only to return a result; any short-term retention (for example for abuse monitoring) follows their API terms.
- Your material is short-lived in the AI build. Our build system keeps your source material only while a build runs and deletes it when the build ends (at most about 30 minutes after it starts). See section 7.
- No training by us: we don't use your content to train AI models (D14). Your published site is public on purpose, so search engines and AI assistants can read it; that's the product's goal, not training by Sparks.
4. Data about your site's visitors
When people use your site's contact form or newsletter sign-up, you are the controller of their data and Sparks is your processor: we store it and send emails only on your instructions. Our Data Processing Agreement governs this, and your site's own privacy notice tells visitors about it. Visitors who want to exercise their rights should contact the site's owner; we'll help the owner respond.
5. Who we share it with
Only with service providers that help us run Sparks (our sub-processors), under contracts that limit them to our instructions. The current list, with locations: bysparks.com/subprocessors (draft). In short: Vercel (hosting, analytics, AI gateway), Supabase (database, sign-in, storage), Resend (sign-in emails for bysparks.com), Amazon Web Services (email for sites, from Sweden), OpenAI and Anthropic (AI), Zoho (our business email, including support@ and privacy@), Better Stack (uptime monitoring; no customer personal data) and, from the paid launch, Paddle (payments, as merchant of record: Paddle is a separate controller for payment data).
If you sign in with Google, Google tells us your name and email address under its own privacy policy.
We may also disclose data if the law requires it, to protect rights and safety, or to a company that takes over Sparks (for example, a company the founder forms to run it).
6. International transfers
Sparks is run from Israel, which the European Commission and the UK recognise as giving adequate protection. Our providers process data in the United States and the EU: for example, bysparks.com's database is in the US (Oregon) and email for sites is sent from Sweden (Stockholm). For transfers out of the EU/UK we rely on the safeguards in each provider's data processing terms (such as the EU Standard Contractual Clauses with the UK Addendum, or the EU–US Data Privacy Framework where the provider is certified); we'll list each provider's safeguard on our sub-processor page before the paid launch. Ask us for a copy of the safeguards.
7. How long we keep it
| Data | Kept |
|---|---|
| Account, material and site content | While your account is active. After a site is suspended (for example when the beta ends and you don't subscribe), 14 days, then deleted (30 days if it was on a paid plan). Deleting your account or site starts deletion at once |
| Source material in the AI build (bio, files, answers, pages read from your own site) | Kept by our build system only while a build runs and deleted when it ends (at most about 30 minutes after the build starts). Uploaded files that no build uses are deleted within 48 hours |
| Files you upload to bysparks.com | For the life of your workspace, deleted with it. If you start signing up and never finish, they're deleted after 7 days |
| Free website audit | The request and its result: at most 24 hours |
| Build progress records | 30 days |
| A preview you never publish | Suspended after 30 days, then deleted 14 days later |
| Data exports you request | About 7 days, then deleted |
| Login and security records | 12 months. If your account is deleted, your entries are pseudonymised (replaced with a one-way code) |
| "Used a free trial" record | Kept after deletion, as one-way hashes (of your email and site/profile links), only to enforce one free trial per person |
| Erasure log | Kept, with no personal data (the site address, date and which systems confirmed) |
| Invoices and billing records (paid launch) | As long as tax law requires (in Israel, 7 years). None exist during the free beta |
| Email suppression list | Addresses that bounced or complained stay on our email provider's suppression list so we don't email them again |
| Support emails | 3 years after the last message |
| Waitlist applications not invited | Deleted when the beta ends (at the paid launch) |
| System run logs | 90 days; they contain no personal data |
| Backups | Expire on their own within 90 days. If we ever restore a backup, we delete again anything that was erased |
| Legal hold | If there's a legal reason (a dispute, a request from authorities), deletion is paused until it's resolved |
A deleted site's address (<slug>.bysparks.net) is retired and never reused.
8. Your rights
Depending on where you live, you can ask us to:
- access your data and get a copy (your account page has "Download my profile"; for owners, a full export of your site's data: during the beta, email privacy@bysparks.com and we'll send it within 30 days);
- correct it;
- delete it (you can delete your account yourself);
- restrict or object to our use of it, including where we rely on legitimate interests;
- port it to another service;
- withdraw consent (for example the AI consent) at any time: this doesn't affect what we did before, but we can't build or edit your site with AI without it.
How: email privacy@bysparks.com from your account's address. We reply within one month (sometimes longer for complex requests, and we'll tell you).
Complaints: you can complain to your data protection authority, for example the ICO (UK), the supervisory authority in your EU country, or Israel's Privacy Protection Authority. We'd appreciate the chance to sort it out first at privacy@bysparks.com.
Israel: we handle data in line with Israel's Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force since August 2025), including your rights to review and correct data held about you.
US residents: we don't sell personal data or share it for cross-context behavioural advertising. You can ask us for access to or deletion of your data at privacy@bysparks.com, wherever you live.
9. Cookies
This section is published as bysparks.com/privacy#cookies.
We use only essential and functional cookies, so there's no cookie banner. There are no advertising or tracking cookies.
On bysparks.com
| Cookie | What it does | How long |
|---|---|---|
sb-<project>-auth-token | Keeps you signed in to your account (set by our sign-in provider, Supabase). The access token inside it lasts 1 hour and is refreshed while you use Sparks | Up to 400 days, unless you sign out |
active_workspace_id | Remembers which workspace you're in | Until you close your browser |
sidebar_state | Remembers whether the sidebar is open | 7 days |
On the sites we host and their editor (<name>.bysparks.net and /admin)
| Cookie | What it does | How long |
|---|---|---|
payload-token | Keeps the site's owner or editor signed in to the editor | 2 hours at a time; a session ends at most 7 days after sign-in |
payload-tenant | In /admin only: remembers which site you're editing | 1 year |
spn_preview | Lets the owner and editors preview a site that isn't published or is hidden | 24 hours (2 hours for Sparks staff) |
Browser storage (not cookies)
| Item | What it does |
|---|---|
sparks:ann | On a hosted site, remembers that you dismissed an announcement |
spn-admin-remembered-email | Remembers your email on the /admin sign-in page |
- Analytics without cookies. bysparks.com uses (from the beta) Vercel Web Analytics, which counts visits without cookies and without identifying you. Sites we host don't use visitor analytics today; if we add them, they'll be cookieless too.
- Abuse protection. Contact and newsletter forms limit how often they can be sent using your IP address, held in memory only and not stored.
- No ad or tracking pixels. If we ever add marketing cookies, we'll ask for your consent first.
- Embedded videos and other third-party content on hosted sites load only when you click them, so nothing is set by those providers until you choose.
- Payments (paid launch): Paddle's checkout window sets its own cookies under Paddle's policy.
You can block or delete cookies in your browser; if you block the essential ones, you can't sign in.
10. Children
Sparks is for adults running a professional presence. It's not for anyone under 18, and we don't knowingly collect children's data. If you think a child has given us data, tell us and we'll delete it.
11. Security
Access to your data is limited to the founder and, later, staff who need it; every login and staff action is logged; data is encrypted in transit, and our main providers encrypt the data they store; sites that aren't public never send their content. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
12. Changes
We'll post updates here and change the date at the top. For material changes we'll email account holders before they apply.
13. Contact
privacy@bysparks.com · support@bysparks.com · postal address on request