Privacy Policy — SparkFlow
SparkFlow

Privacy Policy

How SparkFlow collects, uses, and protects your personal data.

Effective: 18 Jun 2026 Last updated: 18 Jun 2026

1 Who We Are

SparkFlow ("SparkFlow", "we", "our", or "us") is operated by Ignite Software and Design, a company registered in Bahrain.

SparkFlow is an AI-powered social media marketing platform. We generate content plans and artwork for social media posts and enable users to publish content directly to their connected social media accounts.

For privacy-related enquiries, contact us at: privacy@spark-flow.app

2 What Information We Collect

2.1 Account & Profile Information

When you create an account, we collect:

  • Email address and/or phone number
  • Full name
  • Business name and brand information
  • Industry and business category
  • Content preferences and style choices set during onboarding
  • Profile photo (if provided)

2.2 Content You Create

We store content you generate or upload through the app, including:

  • Marketing briefs and AI-generated content plans
  • Post captions, schedules, and creative briefs
  • AI-generated artwork and images
  • Brand assets, logos, and images you upload to your Library
  • Comments and revision requests on posts and plans

2.3 Social Account Data

When you connect a social media account (Instagram, Facebook, LinkedIn, TikTok), we receive and store:

  • Your social account ID, handle, and display name
  • Profile photo URL from the social platform
  • Account connection tokens necessary to publish on your behalf
  • Performance metrics and analytics data from your connected accounts (reach, impressions, engagement, follower counts)
ℹ️ We do not store your social media passwords. We access your accounts only through official OAuth authorisation flows provided by each platform.

2.4 Payment & Billing Information

When you subscribe to SparkFlow, we collect:

  • Your chosen subscription plan
  • Billing history and invoice records
  • Payment method type (e.g. card type and last four digits — stored by our payment processor, not us)
🔒 We do not store full payment card details on our servers. All card data is handled directly by Tap Payments (see Section 5).

2.5 Usage & Technical Data

We automatically collect:

  • Features you use and actions you take within the app
  • Device type and operating system
  • App version and build number
  • Device token for push notifications (via Firebase)
  • Session activity and error logs

2.6 Support Communications

If you contact us for support, we keep a record of that correspondence to resolve your request and improve our service.

3 How We Use Your Information

Purpose Legal Basis
Creating and managing your account Contract performance
Generating AI content plans and artwork Contract performance
Publishing posts to your connected social accounts Contract performance / Consent
Processing subscription payments Contract performance
Sending push notifications (plan ready, artwork complete, approvals pending) Consent
Displaying social media analytics within the app Contract performance
Improving and securing the platform Legitimate interests
Responding to support requests Legitimate interests / Contract
Complying with legal obligations Legal obligation
We do not use your content or personal data to train AI models without your explicit consent.

4 Workspace & Team Data

SparkFlow is a workspace-based platform. If you are part of a workspace:

  • The workspace administrator can see all content plans, posts, and generated assets within that workspace.
  • If your administrator invited you to a workspace, they act as the data controller for your use within that workspace and we act as their data processor.
  • Removing a user from a workspace does not automatically delete the content they created within it. Contact your workspace administrator for content removal requests within a workspace.

5 Third-Party Services

We use the following third-party services to operate SparkFlow. By using our app, you acknowledge that your data is processed by these providers under their own privacy policies.

Provider Purpose Data Shared
Supabase
Supabase Inc., USA
Database, authentication, and file storage Account data, content, uploaded assets
Google Firebase
Google LLC, USA
Push notifications Device push token
Tap Payments
Tap Payments Co., UAE
Subscription billing and payment processing Name, email, billing information
Getlate.dev Social account connections, post scheduling, and analytics Social account tokens, post content, media files
n8n
Workflow automation
AI content plan and artwork generation workflows Marketing brief, workspace profile, content parameters

We require all third-party processors to handle your data securely and only for the purposes we specify.

6 Social Media Platforms

When you connect your social accounts through SparkFlow, you authorise us to:

  • Publish posts, images, videos, and carousels to those accounts on your schedule
  • Read performance analytics from those accounts to display within the app
  • Manage scheduled content on your behalf

You can disconnect any social account at any time from Settings → Social Accounts within the app. Disconnecting revokes our access going forward but does not delete posts already published to the platform.

⚠️ Your use of connected platforms (Instagram, Facebook, LinkedIn, TikTok) is also governed by their respective terms of service and privacy policies.

7 Data Retention

Data Type Retention Period
Account and profile data Lifetime of your account, plus 30 days after deletion request
Content plans, posts, and artwork Lifetime of your account, plus 30 days after deletion request
Uploaded brand assets Lifetime of your account, plus 30 days after deletion request
Social account connections Until you disconnect the account or delete your SparkFlow account
Payment and billing records 7 years (as required by applicable financial regulations)
Usage and error logs 90 days
Support correspondence 2 years

You may request deletion of your account and associated data at any time by contacting privacy@spark-flow.app. Billing records may be retained for the legally required period even after account deletion.

8 International Data Transfers

We are based in Bahrain, but we use service providers located in other countries including the United States and the United Arab Emirates. Your data may therefore be transferred to and processed in countries outside your own.

Where required by applicable law, we ensure such transfers are protected by appropriate safeguards, such as standard contractual clauses or adequacy decisions.

9 Data Security

We take the security of your data seriously. Our safeguards include:

  • All data transmitted between the app and our servers is encrypted using TLS (HTTPS)
  • Data at rest is encrypted in our database and file storage systems
  • Access to production data is restricted to authorised personnel only
  • Row-level security policies are enforced in our database to prevent cross-workspace data access
  • We monitor for suspicious activity and security incidents
⚠️ No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@spark-flow.app.

10 Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

Right What It Means
Access Request a copy of the personal data we hold about you
Rectification Ask us to correct inaccurate or incomplete data
Erasure Request deletion of your personal data (subject to legal retention obligations)
Restriction Ask us to limit how we process your data in certain circumstances
Portability Receive your data in a structured, machine-readable format
Objection Object to processing based on legitimate interests
Withdraw Consent Where processing is based on consent (e.g. push notifications), withdraw it at any time without affecting prior processing

To exercise any of these rights, email privacy@spark-flow.app. We will respond within 30 days.

If you are located in Bahrain, your rights are governed by Bahrain's Personal Data Protection Law (Law No. 30 of 2018). If you are located in the European Economic Area, your rights are governed by the General Data Protection Regulation (GDPR).

11 Push Notifications

We send push notifications to inform you when:

  • Your AI content plan has been generated
  • Artwork generation for your plan is complete
  • A post or plan requires your approval

You can disable push notifications at any time through your device's system settings. This will not affect core app functionality.

12 Children's Privacy

SparkFlow is a professional business tool. It is not directed at or intended for use by anyone under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children.

If you believe a child has provided us with personal information, please contact us at privacy@spark-flow.app and we will delete it promptly.

13 Links to Other Services

SparkFlow connects to third-party social media platforms and may display links to external content. We are not responsible for the privacy practices of those platforms. We encourage you to read their privacy policies separately.

14 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

  • Update the "Last Updated" date at the top of this page
  • Notify you via a push notification or in-app notice where required by applicable law

Continued use of SparkFlow after changes take effect constitutes your acceptance of the updated policy.

15 Contact Us

For any questions, requests, or concerns about this Privacy Policy or how we handle your data, please contact us:

✉️
Ignite Software & Design
Bahrain
Email: privacy@spark-flow.app
Website: spark-flow.app