Welcome to SellSpark AI's Privacy Policy. This policy explains how we collect, use, share, and protect your personal information when you use our AI-powered photo optimization service.
We are committed to protecting your privacy and complying with applicable data protection laws, including:
The data controller responsible for your personal information is:
By using SellSparkAI, you consent to the data practices described in this policy.
When you create an account or use our Service, we collect:
| Data Type | Purpose | Legal Basis (GDPR) |
|---|---|---|
| Email Address | Account creation, authentication, service communications, and optional notifications (optimization completion, usage alerts, marketing, product updates) when you opt-in to platform waitlist subscriptions or notification preferences | Contract performance, Consent (for optional notifications) |
| Password (hashed) | Account security | Contract performance |
| Name (optional) | Personalization, billing | Consent |
| Phone Number (optional) | Account creation and authentication via SMS verification (free-basic tier), account security (MFA for paid tiers) | Consent |
| Billing Address | Payment processing, tax compliance | Legal obligation |
Payment data is processed by Stripe, our third-party payment processor. We do not store your complete credit card information on our servers. Stripe collects:
For more information, see Stripe's Privacy Policy.
Additionally, for tax compliance and automation, we use Quaderno as our tax automation service. Quaderno receives:
For more information, see Quaderno's Privacy Policy.
When you upload photos to our Service:
We automatically collect certain technical information:
We use your personal information for the following purposes:
We do not sell your personal information to third parties. We only share your information in the following limited circumstances:
We share data with trusted third-party service providers who help us operate the Service:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing, subscription management | Name, email, billing address, payment method |
| AI Analysis Provider (OpenAI) | AI-powered product image analysis | Product photos, product descriptions, category data |
| AI Image Generation Provider (Google Gemini / OpenAI) | AI-powered image generation and optimization | Product descriptions, style preferences, generation prompts |
| AI Upscaling Provider (Runware) | Image upscaling (fallback service) | Product photos for upscaling |
| SMS Verification Provider (Telnyx) | SMS verification for account authentication and MFA | Phone number, verification codes |
| Tax Automation Provider (Quaderno) | Tax calculation, invoice generation, compliance | Transaction data, billing address, customer location |
| Email Service Provider (Porkbun) | Email delivery and verification | Email address, verification links, name |
| Cloud Hosting Provider | Data storage, application hosting | All account and photo data |
All service providers are contractually required to protect your data and use it only for the specified purposes.
We may disclose your information if required by law or in response to:
If SellSparkAI is acquired, merged, or sells assets, your information may be transferred to the acquiring entity. You will be notified of any such change via email.
We retain your personal information for as long as necessary to provide the Service and comply with legal obligations:
| Data Type | Retention Period |
|---|---|
| Account Information | Deleted immediately upon account deletion request |
| Uploaded Photos | 60 days after processing or until account deletion (whichever comes first) |
| Optimized Photos | Until account deletion (accessible in your gallery) |
| Payment Records & Invoices | 5-7 years (required by tax/legal obligations in Brazil, EU, and USA) |
| Login History | Deleted immediately upon account deletion |
| Support Communications | Handled by our email service provider (subject to their retention policies) |
| Usage Analytics | 2 years (aggregated/anonymized) |
| Fraud Prevention Data | 30-90 days after account deletion + 365 days (see details below) |
To prevent abuse of our free tier through repeated account deletions and re-creations, we retain minimal, non-identifiable fraud prevention data after account deletion:
Retention periods:
Legal Basis (GDPR Article 6(1)(f)): Legitimate interest in fraud prevention. This data is minimized (no PII stored), purpose-limited (exclusively for fraud detection), and necessary to prevent abuse that harms our business and legitimate users.
Under GDPR (EU) and LGPD (Brazil), you have the following rights regarding your personal data:
1. Right to Access: Request a copy of all personal data we hold about you.
2. Right to Rectification: Correct inaccurate or incomplete personal data.
3. Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
4. Right to Data Portability: Receive your data in a machine-readable format (JSON).
5. Right to Object: Opt-out of certain data processing activities.
6. Right to Restriction of Processing: Request limitation of how we process your data in certain circumstances (e.g., while verifying accuracy or during objection review).
7. Right to Withdraw Consent: Revoke consent for data processing at any time.
8. Right to Lodge a Complaint: File a complaint with a supervisory authority (see Section 8.7 for ANPD contact, or your local EU Data Protection Authority).
To exercise any of these rights, contact us at:
We will respond within:
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
| Category | Examples | Collected | Purpose |
|---|---|---|---|
| Identifiers | Name, email, user ID, device fingerprint | ✅ Yes | Account creation, authentication, fraud prevention |
| Contact Information | Phone number (optional), billing address | ✅ Yes | SMS verification, billing, order fulfillment |
| Commercial Information | Subscription tier, payment history, transaction records | ✅ Yes | Service provision, billing, customer support |
| Internet Activity | Usage data, photos uploaded, features used, session data | ✅ Yes | Service provision, optimization, analytics |
| Geolocation Data | Approximate location from IP address | ✅ Yes | Security, fraud prevention, service optimization |
| Visual Information | Product photos you upload | ✅ Yes | AI analysis and optimization service delivery |
| Inferences | Product category, style preferences, usage patterns | ✅ Yes | Service personalization, recommendations |
We collect the following categories of sensitive personal information:
We collect personal information from the following sources:
We collect and use personal information for the following purposes:
We share personal information with the following categories of third parties:
| Third Party | Purpose | Data Shared |
|---|---|---|
| Payment Processor (Stripe) | Payment processing, subscription management | Name, email, billing address, payment method |
| Tax Automation Provider (Quaderno) | Tax calculation, invoice generation, compliance | Transaction data, billing address, customer location |
| SMS Verification Provider (Telnyx) | SMS verification for account authentication and MFA | Phone number, verification codes |
| Email Service Provider (Porkbun) | Email delivery and verification | Email address, verification links |
| AI Analysis Provider (OpenAI) | AI-powered product image analysis | Product photos, product descriptions, category data |
| AI Image Generation Provider (Google Gemini / OpenAI) | AI-powered image generation and optimization | Product descriptions, style preferences, generation prompts |
| AI Upscaling Provider (Runware) | Image upscaling (fallback service) | Product photos for upscaling |
We retain personal information as described in Section 5 of this policy. Uploaded photos are retained for 60 days (for customer support purposes), then permanently deleted. Optimized photos are retained until account deletion.
Important: We do NOT sell your personal information.
We do NOT sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. We do NOT share your personal information for cross-context behavioral advertising.
As a California resident, you have the following rights:
Right to Know: You can request information about the categories and specific pieces of personal information we collected, the sources, purposes, and third parties with whom we shared it.
Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
Right to Correct: You can request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: Since we do NOT sell or share your personal information, this right does not apply.
Right to Limit Use of Sensitive Personal Information: You can request that we limit use of sensitive personal information to what is necessary to perform the service.
Right to Non-Discrimination: We will NOT discriminate against you for exercising your CCPA rights.
To exercise any of these rights:
Verification: We will verify your identity by confirming your email address and account details before processing your request.
Response Time: We will respond within 45 days of receiving your request, with a possible 45-day extension if necessary.
Authorized Agents: You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization.
California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do NOT share personal information with third parties for their direct marketing purposes.
Important Notice: SellSparkAI does not currently support Brazilian customers for purchases. While our company (SellSparkAI Ltda) is incorporated in Brazil, we are not yet offering services to customers located in Brazil. If you are interested in our service from Brazil, please contact us at —we may offer support on a case-by-case basis.
As a company incorporated in Brazil, we are committed to LGPD compliance for any personal data we may collect from Brazilian visitors or future customers. If you are a resident of Brazil visiting our website, your personal data is protected under the Lei Geral de Proteção de Dados (LGPD).
Legal Entity: SellSparkAI Ltda
CNPJ: 64.278.992/0001-04
Address: Av. Pref. Osmar Cunha, 416, Sala 1108 - Ed. Koerich Empresarial Rio Branco, Florianópolis - SC, 88015-100, Brazil
Email:
For LGPD-related inquiries, you may contact our Data Protection Officer:
We process your personal data under the following legal bases defined by LGPD:
As a Brazilian data subject, you have all rights under LGPD Article 18, including:
We will respond to LGPD requests within 15 days as required by Brazilian law.
Your personal data may be transferred to and processed in the United States and other countries where our service providers operate. We ensure adequate protection through Standard Contractual Clauses and data processing agreements.
You have the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD):
SellSparkAI operates in many countries (though not currently Brazil—see Section 8). Your personal information may be transferred to and processed in countries outside your country of residence, including the United States.
When transferring data internationally, we ensure adequate protection through:
If you are located in the EU or Brazil, you have the right to object to international transfers that don't meet adequate protection standards.
We use only essential cookies required for the Service to function. We do NOT use any third-party analytics or tracking cookies.
These cookies are strictly necessary for the Service to operate. You cannot opt-out of these cookies while using the Service.
| Cookie Name | Purpose | Duration |
|---|---|---|
| connect.sid | Session management - keeps you logged in during your browser session | 24 hours |
| refresh_token | Remember Me functionality - allows automatic re-login when you return | 30 days (only set if you select "Remember Me") |
We do NOT use:
You can control cookies through your browser settings. However, disabling essential cookies will prevent you from logging in and using the Service. Since we only use essential cookies, a cookie consent banner is not required under GDPR/LGPD.
SellSparkAI is not intended for users under 18 years of age. We do not knowingly collect personal information from children.
If we discover that we have collected information from a child under 18, we will immediately delete that information. If you believe we have collected information from a child, please contact us at .
We implement industry-standard security measures to protect your personal information:
In the event of a data breach affecting your personal information that poses a risk to your rights and freedoms, we will:
We may update this Privacy Policy from time to time. When we make material changes, we will:
Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree to the changes, you must cancel your account before the effective date.
This Privacy Policy is governed by the laws of the Federative Republic of Brazil, where SellSparkAI Ltda is incorporated. However, we comply with applicable data protection laws in all jurisdictions where we operate, including GDPR (EU), UK GDPR, LGPD (Brazil), and CCPA/CPRA (California). Note: While incorporated in Brazil, we do not currently support Brazilian customers for purchases—see Section 8 for details.
You have the right to lodge a complaint with a data protection supervisory authority. Relevant authorities include:
When we transfer personal data outside your country of residence, we ensure appropriate safeguards:
For privacy-related disputes, we encourage you to first contact us at . If we cannot resolve your concern:
For any privacy-related questions, data requests, or concerns, contact us:
Email:
Subject: "Privacy Request - [Your Name]"
We will respond within 30 days (GDPR) or 15 days (LGPD)