1. Introduction

Sparked Labs Ltd. ("we", "our", or "us") operates the spark-learn.app website, iOS app, Android app, and educational platform (collectively, "the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting the privacy of children and families using our educational platform. This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Children's Online Privacy Protection Act (COPPA).

Data Controller

The data controller responsible for your personal data is Spark Learn. For data protection enquiries, please contact us at: privacy@spark-learn.app

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (securely hashed — we never store plain text passwords)
• Google account identifier (if you sign in with Google)
• Apple account identifier (if you sign in with Apple)

Child Profile Information

When you create a child profile, we collect:

• Child's first name (we recommend using first names only)
• School year (e.g. Reception, Year 1)
• An avatar colour preference

We do not collect children's surnames, dates of birth, photographs, precise location, or any other directly identifying information about children.

Learning Data

As your child uses the Service, we collect:

• Spelling test results and word progress
• Custom word lists created by parents
• Phonics practice sessions and sound mastery levels
• Book reading logs (titles, authors, pages, reading time)
• Maths worksheet generation history

Technical Data

We automatically collect:

• Device type, operating system, and browser information
• IP address (for security and rate limiting purposes)
• Cookies for authentication and session management

Subscription and Payment Data

If you subscribe to Spark Learn Pro, payment processing is handled entirely by our payment partners (Apple App Store, Google Play, or Stripe via RevenueCat). We do not collect or store your credit card number, bank details, or other financial information. We receive only:

• Subscription tier and status (active, expired, cancelled)
• Subscription start and renewal dates
• A transaction identifier from the payment platform

What We Do Not Collect

We do not collect:

• Advertising identifiers or tracking IDs
• Precise geolocation data
• Microphone, camera, or contact list data
• Data from other apps on your device
• Behavioural data for advertising purposes

3. Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following bases:

• Contract performance: To provide the Service you signed up for, including account management, learning features, and progress tracking.
• Consent: For creating child profiles and processing children's learning data. You provide consent when you create a child profile and can withdraw it at any time by deleting the profile.
• Legitimate interest: For security measures (rate limiting, fraud prevention), service improvements, and essential communications about your account.

4. How We Use Your Information

We use the collected information to:

• Provide and maintain our educational services
• Track learning progress for each child
• Generate personalised worksheets and practice materials
• Generate contextual sentences for spelling words using AI (see Section 6)
• Allow parents to monitor their children's progress
• Manage subscriptions and feature access
• Send important service-related communications
• Protect against abuse and maintain security

We do not use your data or your children's data for advertising, behavioural profiling, or any purpose unrelated to providing the educational Service.

5. Third-Party Services

We use the following third-party services to operate the platform. These services process data on our behalf under data processing agreements:

• Supabase (database and authentication) — Stores your account data, child profiles, and learning data. Data is hosted in the EU/UK. Supabase Privacy Policy
• RevenueCat (subscription management) — Processes subscription status and entitlements. Does not receive children's data. RevenueCat Privacy Policy
• Anthropic (AI sentence generation) — Receives individual spelling words to generate example sentences. No child names, account data, or identifying information is sent. Anthropic Privacy Policy
• Vercel (hosting) — Hosts the web application. Processes standard web request data (IP address, user agent). Vercel Privacy Policy
• Google (authentication, if used) — Processes authentication data only if you choose to sign in with Google.
• Apple App Store / Google Play (payments) — Processes payment transactions for subscriptions. We do not receive financial details.

We do not sell, trade, or otherwise transfer your personal information to third parties for marketing or advertising purposes.

6. AI-Generated Content

Our spelling module uses Anthropic's Claude AI to generate example sentences for spelling words. When this feature is used:

• Only the individual spelling word is sent to the AI service — no child names, account data, or personal information
• Generated sentences are cached in our database to reduce repeat requests
• Anthropic does not use this data to train their models (per their API terms)

7. Children's Privacy and COPPA Compliance

Spark Learn takes children's privacy seriously. Our Service is designed for use by parents and guardians with their children aged 4-11.

Parental Consent

Children do not create their own accounts. All accounts are created by parents or legal guardians who are at least 18 years old. By creating a child profile, you as the parent or guardian:

• Provide verifiable parental consent for us to collect and use your child's learning data as described in this policy
• Confirm that you are the parent or legal guardian of the child
• Understand what data is collected and how it is used

Parental Rights

As a parent or guardian, you have the right to:

• Review all data associated with your child's profile, including learning progress, test results, and book logs
• Delete your child's profile and all associated data at any time via the Settings page
• Refuse further collection of your child's data by deleting their profile
• Request a copy of your child's data by contacting us at privacy@spark-learn.app

Data Minimisation

We only collect the minimum data necessary to provide educational services. We do not require children's full names, dates of birth, school names, or photographs. We do not engage in behavioural advertising, build marketing profiles, or share children's data with advertisers.

8. Multi-Parent Sharing

Our Service allows parents to share access to a child's profile with other parents or guardians (e.g. a co-parent). When you share a child profile:

• An invite code is generated that you share directly with the other parent
• The invited parent gains access to the child's learning data
• You can revoke shared access at any time
• We do not facilitate sharing with anyone other than those you explicitly invite

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure password hashing (bcrypt)
• Row-level security policies in our database
• Rate limiting on all API endpoints
• Regular security reviews
• Access controls limiting employee access to personal data

10. Data Retention

We retain your data as follows:

• Account data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
• Child profiles and learning data: Retained for as long as the child profile exists. Deleted immediately when the child profile is removed.
• Subscription data: Retained for as long as your account is active, plus up to 12 months after cancellation for billing dispute resolution.
• Technical logs (IP addresses, request data): Retained for up to 90 days for security purposes, then automatically deleted.

11. International Data Transfers

Our primary database is hosted in the EU/UK via Supabase. Some third-party services (Anthropic, RevenueCat, Vercel) may process data in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• Data processing agreements with all third-party processors
• Adequacy decisions where applicable

12. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at privacy@spark-learn.app. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

13. App Tracking Transparency

Spark Learn does not track you across other companies' apps or websites. We do not use advertising identifiers, and we do not participate in any ad networks. We do not request App Tracking Transparency permission because we do not engage in tracking.

14. Cookies

We use essential cookies only for authentication and session management. These cookies are strictly necessary for the platform to function and cannot be disabled. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and where appropriate sending an email notification to the address associated with your account. We encourage you to review this policy periodically.

16. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us at:

Email: privacy@spark-learn.app