Legal and privacy

Privacy Policy

This policy applies to the Sparkdemy website, enquiry forms, and the optional Facebook Messenger and Instagram messaging integrations enabled by our clients.

Last updated: 20 October 2026

Data we collect

Enquiry data: your name, company, role, industry, company size, email, phone or WhatsApp number, and the message you submit.
Meta connection data: Facebook Page or Instagram professional account IDs, names, usernames, permissions, connection status and access tokens.
Customer-service conversation data: customer IDs, message content, attachments or related links, timestamps, processing status, drafts and sent replies.
Technical data: necessary security logs, request times, IP address, browser information, and website analytics or Meta Pixel event data.
Name card data: the name, company, job title, email, phone and website on a name card you gave us at an event, and which event we met at.
Email activity: whether an email we sent you was opened, which of its links were clicked, and unsubscribe requests.

Where data comes from

Information you submit directly through an enquiry form or service configuration.
Facebook Pages, Instagram professional accounts and Meta webhooks that you authorise us to connect.
People who message a connected business account.

How we use data

To answer enquiries, provide the service, authenticate authorised business accounts and handle support requests.
To receive and route customer messages and generate drafts or replies from client-approved knowledge and rules.
To enforce human approval, messaging windows, escalation rules and duplicate-reply protection.
To secure accounts and systems and investigate faults, misuse or unauthorised access.
To understand website and service usage. We do not sell personal data.

Disclosures and processors

Meta Platforms processes Facebook, Messenger, Instagram, login, permissions and message delivery.
Cloudflare and our cloud-hosting providers process website, network, security, backup and service-operation data.
Resend sends email on our behalf and tells us whether it was delivered or bounced.
The AI model provider selected for a client processes the minimum conversation content needed to generate a customer-service draft or reply.
Authorised Sparkdemy personnel and administrators of the relevant client company access data only as needed for operations, support, approval or compliance.

Retention and deletion

We retain data only as long as needed for its collection purpose, service delivery, disputes, legal obligations or security.
Disconnecting a Meta account deletes its active access token and live connection record and stops new events from being collected.
Conversation events, drafts and operational records are cleared according to operational need; verified full-deletion requests are normally completed within 30 days.
Copies in backups are removed through the normal backup rotation, except for limited records required by law or a security investigation.
Deleting Sparkdemy data does not automatically delete the original messages held by Meta, Facebook, Messenger or Instagram.

Security

Meta access tokens are encrypted at rest and network traffic uses HTTPS.
Webhooks are checked against Meta signatures, and each client uses separate signed authentication with the central service.
Access is limited by operational role, and each client's data is separated from other clients.
No system is risk-free. If an incident occurs, we will contain and investigate it and provide notices where applicable.

Website browsing records

When you browse sparkdemy.ai we record which pages you view, when, which site sent you, and the source tags on ad links. Records are tied only to a random browser ID cookie, kept for 90 days.
We do not record search terms or other parameters in the address, page content or your full IP address.
If you send our enquiry form or click a link in one of our emails, your earlier browsing records are linked to your contact details so we understand what you are interested in.
Records we cannot link to anyone are deleted after 30 days, linked records after 90 days. Browsers with Global Privacy Control switched on are never recorded.
You can stop recording and clear this browser's records at any time with the button below. This does not change email subscriptions; to unsubscribe, use the link at the bottom of any email.

Your rights and choices

You can disconnect Facebook or Instagram to stop new processing.
You can ask whether we hold your personal data and request access, correction or deletion.
We verify authority over the relevant Page, account or data before acting, to prevent unauthorised deletion.
You can also revoke Sparkdemy's permissions in your Facebook or Instagram settings.
You can unsubscribe with the link at the bottom of any email we send, and you will not get that kind of email again.

International processing, children and updates

Service providers may process data outside Hong Kong. We require them to process it only for the service purpose and with appropriate safeguards.
The service is for business users and is not directed to anyone under 18.
If this policy changes materially, we will update the date on this page and notify connected clients where appropriate.