1. Introduction

Sparked Labs Ltd. ("we", "our", or "us") operates the spark-learn.app website, iOS app, Android app, and educational platform (collectively, "the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting the privacy of children and families using our educational platform. This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Children's Online Privacy Protection Act (COPPA).

Data Controller

The data controller responsible for your personal data is Spark Learn. For data protection enquiries, please contact us at: privacy@spark-learn.app

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (securely hashed — we never store plain text passwords)
• Google account identifier (if you sign in with Google)
• Apple account identifier (if you sign in with Apple)

Child Profile Information

When you create a child profile, we collect:

• Child's first name (we recommend using first names only)
• School year (e.g. Reception, Year 1)
• An avatar colour preference

We do not collect children's surnames, dates of birth, precise location, or any other directly identifying information about children. A child profile never contains a photograph of the child.

Some optional features do involve photographs that you choose to take and upload — for example photographing a completed worksheet so it can be marked. These are described in Photographs You Upload below and in Section 6. We never ask for a photograph of a child, and no feature requires one.

Learning Data

As your child uses the Service, we collect:

• Spelling test results and word progress
• Custom word lists created by parents
• Phonics practice sessions and sound mastery levels
• Book reading logs (titles, authors, pages, reading time)
• Maths worksheet generation history
• Marking results — the answers our AI read from a photographed worksheet, whether each was correct, and the resulting score

Photographs You Upload

Four optional features involve a photograph. Each one is started deliberately by you — nothing is captured in the background, and you can use the rest of the Service without ever taking a photo.

• Marking a maths worksheet. You photograph a completed worksheet (up to 10 pages). The image is sent to our AI marking provider to read the handwritten answers. We do not store the photograph — it is held in memory only for as long as the request takes, and only the marking results described above are saved. The marked-up copy showing ticks and crosses is generated for the response and is not stored on our servers; you can save it to your own device if you want to keep it.
• Homework set by a school. If your child's class uses Spark Learn, you may photograph completed homework as evidence for the teacher. Unlike worksheet marking, this photograph is stored so the teacher can view it. If the teacher chooses to mark it with AI, the image is sent to Anthropic and an annotated copy is also stored. Both are readable only by you, your co-parents, and staff at that school, via links that expire after one hour.
• Identifying a book by its cover. You photograph a book cover and the image is sent to our AI provider to read the title and author. We do not store this photograph. (Scanning a barcode instead is handled entirely on your device — no image leaves it.)
• Adding your own cover photo. Where neither book database has artwork, you may photograph the cover to use in your library. This photograph is stored. It is private to you and any co-parents you have shared the child with, is never added to the shared book record other families see, and is served only through links that expire after one hour. You can replace or remove it at any time, which deletes the stored image.

Technical Data

We automatically collect:

• Device type, operating system, and browser information
• IP address (for security and rate limiting purposes)
• Cookies for authentication and session management

Subscription and Payment Data

If you subscribe to Spark Learn Pro, payment processing is handled entirely by our payment partners (Apple App Store, Google Play, or Stripe via RevenueCat). We do not collect or store your credit card number, bank details, or other financial information. We receive only:

• Subscription tier and status (active, expired, cancelled)
• Subscription start and renewal dates
• A transaction identifier from the payment platform

What We Do Not Collect

We do not collect:

• Advertising identifiers or tracking IDs
• Precise geolocation data
• Microphone or contact list data
• Camera access in the background — the camera is used only when you actively start one of the photo features described above, and only the resulting image is sent
• Data from other apps on your device
• Behavioural data for advertising purposes

3. Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following bases:

• Contract performance: To provide the Service you signed up for, including account management, learning features, and progress tracking.
• Consent: For creating child profiles and processing children's learning data. You provide consent when you create a child profile and can withdraw it at any time by deleting the profile.
• Legitimate interest: For security measures (rate limiting, fraud prevention), service improvements, and essential communications about your account.

4. How We Use Your Information

We use the collected information to:

• Provide and maintain our educational services
• Track learning progress for each child
• Generate personalised worksheets and practice materials
• Generate contextual sentences for spelling words using AI (see Section 6)
• Allow parents to monitor their children's progress
• Manage subscriptions and feature access
• Send important service-related communications
• Protect against abuse and maintain security

We do not use your data or your children's data for advertising, behavioural profiling, or any purpose unrelated to providing the educational Service.

5. Third-Party Services

We use the following third-party services to operate the platform. These services process data on our behalf under data processing agreements:

• Supabase (database and authentication) — Stores your account data, child profiles, and learning data. Data is hosted in the EU/UK. Supabase Privacy Policy
• RevenueCat (subscription management) — Processes subscription status and entitlements. Does not receive children's data. RevenueCat Privacy Policy
• Anthropic (AI sentence generation and homework marking) — Receives individual spelling words to generate example sentences. Where a teacher marks homework with AI, it also receives the photograph of the completed homework. No child names, account data, or identifying information is sent alongside either. Anthropic Privacy Policy
• Alibaba Cloud (AI worksheet marking and book cover recognition, via its Model Studio / DashScope service) — Receives the photographs you submit for maths worksheet marking and for identifying a book by its cover, in order to read the text in them. Requests are handled by Alibaba Cloud's international service, hosted in Singapore. No child names, account data, or identifying information is sent with the image. Alibaba Cloud Privacy Policy
• Vercel (hosting) — Hosts the web application. Processes standard web request data (IP address, user agent). Vercel Privacy Policy
• Google (authentication, if used) — Processes authentication data only if you choose to sign in with Google.
• Apple App Store / Google Play (payments) — Processes payment transactions for subscriptions. We do not receive financial details.

We do not sell, trade, or otherwise transfer your personal information to third parties for marketing or advertising purposes.

6. Use of AI

Spelling Sentences

Our spelling module uses Anthropic's Claude AI to generate example sentences for spelling words. When this feature is used:

• Only the individual spelling word is sent to the AI service — no child names, account data, or personal information
• Generated sentences are cached in our database to reduce repeat requests
• Anthropic does not use this data to train their models (per their API terms)

Marking and Recognising Photographs

Where you use one of the photo features in Section 2, the image is sent to an AI provider to read the text in it — Alibaba Cloud for maths worksheet marking and book cover recognition, Anthropic for teacher-initiated homework marking. In each case:

• Only the image is sent. Your child's name, your account details, and all other profile data stay with us.
• The provider uses the image to answer that single request. It is not used to build a profile of your child.
• If a photograph cannot be read on the first attempt, worksheet marking retries it, so the same image may be sent up to three times for one marking request.
• AI marking can make mistakes. Scores and corrections are a starting point for you or the teacher to review, not a definitive assessment, and you can override any result.

We do not use any photograph, or anything derived from one, for advertising or profiling, and we do not sell them.

7. Children's Privacy and COPPA Compliance

Spark Learn takes children's privacy seriously. Our Service is designed for use by parents and guardians with their children aged 4-11.

Parental Consent

Children do not create their own accounts. All accounts are created by parents or legal guardians who are at least 18 years old. By creating a child profile, you as the parent or guardian:

• Provide verifiable parental consent for us to collect and use your child's learning data as described in this policy
• Confirm that you are the parent or legal guardian of the child
• Understand what data is collected and how it is used

Parental Rights

As a parent or guardian, you have the right to:

• Review all data associated with your child's profile, including learning progress, test results, and book logs
• Delete your child's profile and all associated data at any time via the Settings page
• Refuse further collection of your child's data by deleting their profile
• Request a copy of your child's data by contacting us at privacy@spark-learn.app

Data Minimisation

We only collect the minimum data necessary to provide educational services. We do not require children's full names, dates of birth, or photographs of children. The only images we process are pictures of schoolwork or book covers that you choose to upload, as described in Section 2. We do not engage in behavioural advertising, build marketing profiles, or share children's data with advertisers.

8. Multi-Parent Sharing

Our Service allows parents to share access to a child's profile with other parents or guardians (e.g. a co-parent). When you share a child profile:

• An invite code is generated that you share directly with the other parent
• The invited parent gains access to the child's learning data
• You can revoke shared access at any time
• We do not facilitate sharing with anyone other than those you explicitly invite

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure password hashing (bcrypt)
• Row-level security policies in our database
• Rate limiting on all API endpoints
• Regular security reviews
• Access controls limiting employee access to personal data

10. Data Retention

We retain your data as follows:

• Account data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
• Child profiles and learning data: Retained for as long as the child profile exists. Deleted immediately when the child profile is removed.
• Subscription data: Retained for as long as your account is active, plus up to 12 months after cancellation for billing dispute resolution.
• Technical logs (IP addresses, request data): Retained for up to 90 days for security purposes, then automatically deleted.
• Worksheet and book cover photographs: Not retained. These are processed to produce a marking result or a book match and are discarded once the request completes.
• Cover photos you add to your library: Retained until you replace or remove the photo, which deletes it.
• Homework evidence photographs: Retained, along with any AI-marked copy, for as long as the school assignment record exists, so that you and the school keep a record of the work submitted.

11. International Data Transfers

Our primary database is hosted in the EU/UK via Supabase. Some third-party services (Anthropic, RevenueCat, Vercel) may process data in the United States. Photographs submitted for maths worksheet marking or book cover recognition are processed by Alibaba Cloud in Singapore. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• Data processing agreements with all third-party processors
• Adequacy decisions where applicable

12. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at privacy@spark-learn.app. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

13. App Tracking Transparency

Spark Learn does not track you across other companies' apps or websites. We do not use advertising identifiers, and we do not participate in any ad networks. We do not request App Tracking Transparency permission because we do not engage in tracking.

14. Cookies

We use essential cookies only for authentication and session management. These cookies are strictly necessary for the platform to function and cannot be disabled. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and where appropriate sending an email notification to the address associated with your account. We encourage you to review this policy periodically.

16. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us at:

Email: privacy@spark-learn.app