Privacy policy

Last updated 10 October 2026

This policy explains what personal data SparkAI Language Learning ("SparkAI", "we") collects, why, on what legal basis, who it's shared with, how long it's kept and what your rights are. It's written to meet the EU and UK General Data Protection Regulation (GDPR).

Who is responsible

The data controller is Michael Sparks, 75 rue du Cherche-Midi, 75006 Paris, France, an individual: SparkAI isn't a registered company yet. Contact for anything about your data, including exercising your rights: michael@sitebatch.com, or by post to the address above. We don't have a data protection officer; we're not required to.

What we collect, why, and the legal basis

Data	Why	Legal basis
Email address, password (stored only as a secure hash), or your Google account's email and name if you sign in with Google	Your account: signing in and recovering it	Contract (Art. 6(1)(b)): needed to provide the app
Learning progress: lessons, flashcards, reading, settings, your answers to the intro questions, texts you import, conversations with SparkAI Bot, your notebook (notes, questions and SparkAI Bot's answers)	Running the course and syncing it across your devices	Contract
What you choose to tell SparkAI Bot about yourself (a name, a line about your life, interests, a goal), and short notes it keeps from your conversations (for example “has a dog called Max”). It's told not to keep health, money, religion, politics or other sensitive details.	Making conversations, role-plays, stories, phrases and check-ins fit your life	Consent (Art. 6(1)(a)): optional; edit or delete any of it, or turn memory off, in Settings at any time
What you send to the AI features: messages, writing to correct, words you look up, notebook questions you ask it to answer, recordings in “Speak & get feedback”; and, for your plan, weekly check-in, daily takeaway and progress review, a summary of your progress (levels, lessons, mistakes, study time, no account details)	Generating the reply or feedback you asked for	Contract
Text read aloud by the natural voices (lesson sentences, the bot's replies, your own cards)	Producing the audio	Contract
A one-way, salted hash of your IP address, with a count of requests per day	Fair-use limits and preventing abuse of the paid features	Legitimate interests (Art. 6(1)(f)): keeping the service affordable and secure
Problem reports you send (your message, what it's about, your account id)	Fixing mistakes in the content	Legitimate interests
Reminder settings: time, time zone and your browser's notification address	Sending the daily reminder you switched on	Consent (Art. 6(1)(a)): you turn reminders on, and can turn them off any time
Usage statistics, on the website and in the app: the pages you open (with sign-in links, invite codes and anything you typed removed from the address), the site or campaign that brought you, your browser and type of device, and what you do in the course (for example “started a lesson”, “finished a flashcard session”, “started a conversation with SparkAI Bot”). They're tied to a random id, and once you're signed in to your account's internal id, never your email. They never include your email, password, what you write or say to SparkAI Bot, your notes or your recordings, and there's no screen or session recording.	Seeing how people find SparkAI, which parts help them keep learning, and how many come back	Consent (Art. 6(1)(a)): only if you choose “Allow”. Change it any time in Settings, or by clearing your choice in the browser
Whether you arrived by clicking one of our ads on Google Search (a Google Ads click id and cookie)	Seeing which of our ads bring people to SparkAI, so we don't pay for ads that don't	Consent (Art. 6(1)(a)): only if you choose “Allow”. Change it any time in Settings
Totals calculated from everyone's saved progress (for example how many people finished a first lesson, or came back the next day)	Seeing whether the course works and where people get stuck. Only totals and percentages are looked at, never one person's data	Legitimate interests: improving the course
Your invite code, and if you joined through a friend's link, which account invited you	Crediting invitations and showing how many friends joined through your link (we never show who)	Legitimate interests: letting learners invite friends
Your confirmation that you're 16 or older, and when you accepted the terms and this policy	Showing we asked	Legal obligation and legitimate interests

We don't sell your data, show advertising in the app, or use your data to train AI models. The only advertising cookies are Google Ads ones, set only if you choose “Allow”, to measure whether our own ads on Google bring people to SparkAI. We don't make decisions about you by automated means that have legal or similarly significant effects: the placement test, level checks and AI feedback only guide your learning.

Who we share it with

Only with the service providers that run the app for us (processors), under data processing terms:

Lovable (Sweden): hosting, database and sign-in, built on Supabase and Cloudflare.
Google: the AI model (Gemini) behind SparkAI Bot and the coaches, reached through Lovable's AI gateway; and Google sign-in, if you use it.
PostHog (EU Cloud, data stored in the EU): usage statistics, only if you allow them. Your IP address is discarded, not stored.
Google Ads: measures whether our ads on Google Search lead to visits and to people starting the course, only if you allow it. It sets cookies whose names start with “_gcl”; ad personalisation and remarketing are turned off. Google's own privacy policy applies to that data.
Microsoft (Azure AI Speech): turns text into the natural voices. It receives the text to read, not your account details.

Speech recognition (when you speak to the app) is done by your browser, under your browser maker's privacy terms; Chrome, for example, sends the audio to Google to transcribe it.

Videos in the library are YouTube videos. Nothing is loaded from YouTube until you press play; then the player comes from YouTube's privacy-enhanced (youtube-nocookie.com) domain and YouTube's own privacy policy applies to that video. Audiobook recordings play from the Internet Archive, which hosts LibriVox, when you press play.

Some of these providers process data outside the EU/UK, for example in the United States. Those transfers are covered by the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or by the European Commission's Standard Contractual Clauses.

How long we keep it

Your account and saved progress: until you delete your account. Deleted data can remain in encrypted backups for up to 30 days.
AI requests and voice text: we don't store them ourselves; the providers process them only to produce the reply.
Fair-use counters (hashed IP addresses): 7 days.
Usage statistics: 13 months in our own database, 12 months at PostHog.
Google Ads cookies: up to 90 days in your browser, deleted straight away if you say no.
Problem reports: 24 months, or until you delete your account.
Reminder subscriptions: until you turn reminders off or delete your account; unused ones are removed after 12 months.

These limits are enforced automatically.

On your device

The website and the app use your browser's local storage, and no cookies unless you allow ad measurement (then Google Ads sets cookies starting with “_gcl”). Local storage holds your progress (so the app works offline), your sign-in session, and your choice about usage statistics. These are strictly necessary for the app to work, except the analytics ids (ours, and PostHog's, whose names start with “ph_”), which are only created if you allow usage statistics and are deleted if you say no, as are the Google Ads cookies. We ask before measuring anything, and treat a Global Privacy Control signal from your browser as a no. Logging out clears your progress from the device and starts a new analytics id.

Your rights

Under the GDPR you have the right to:

Access your data and take it with you (portability): Account → Download my data gives you everything we hold, as a file.
Erasure: Account → Delete my account removes your account, progress, reminders, problem reports and this device's usage statistics, including what PostHog holds about your account.
Rectification: correct your data in the app, or ask us (for example to change your email).
Withdraw consent at any time, for analytics or reminders, in Settings. This doesn't affect what happened before.
Object to processing based on legitimate interests, and ask us to restrict processing.
Complain to a data protection authority: in France the CNIL (cnil.fr, 3 place de Fontenoy, 75007 Paris), or the authority where you live (in the UK, the ICO). We'd appreciate the chance to sort it out first.

Email michael@sitebatch.com for anything the app doesn't do itself. We'll reply within one month, and may need to confirm it's you.

Security

Data is encrypted in transit; passwords are stored only as hashes; each learner's saved progress is protected so only they can read it; the keys for the AI and voice services stay on our server.

Age

You need to be 16 or older to create an account. If you think a younger child has given us data, contact us and we'll delete it.

Changes

If we change this policy in a meaningful way, we'll tell you in the app before it applies.