Privacy Policy

Effective: September 1, 2026

This Privacy Policy describes how CinderSparq, Inc. (“CinderSparq,” “we,” “our,” “us”) collects, stores, uses and discloses the following categories of personal data:

Submission Data: personal data contained in a conversation submitted through a CinderSparq link, together with the record we create of that submission. Where the link was issued by one of our business customers, we process Submission Data on that customer's behalf.

Submitter Data: personal data relating to the individual who submits a conversation (each, a “Submitter”). We do not ask a Submitter who they are, and the record we create of a submission contains nothing identifying them. We do, however, collect ordinary technical and usage data about visits to our pages, described under Analytics and session recording below.

Third-Party Data: personal data relating to individuals who appear within a submitted conversation without having submitted anything — the other participants in the conversation, and anyone named or described in it.

Account Data: personal data relating to the individuals who register for and administer a CinderSparq account (each, an “Account Holder”), and who issue links and receive the conversations submitted through them.

Specifically, this Privacy Policy describes our practices regarding:

Data Collection · Data Uses · Data Disclosure · Our Role · Data Retention · Data Security · Your Rights and Choices · Sale and Sharing · Cookies · Children · Changes · Contact

Data Collection

Information you provide to us

Conversation Information. When you submit a conversation, you provide us with the text of that conversation as you elect to submit it. Before submitting, the Service displays the conversation for review and allows you to remove any part of it. Removal takes place in your browser, and material you remove at that stage is not transmitted to us.

Registration Information. When an Account Holder creates an account, they provide a display name. Authentication is performed by a third-party authentication provider; sign-in credentials are collected and held by that provider and are not shared with us.

Communication Information. When you contact us, you provide us with your email address and any other information you choose to include, including the link you reference.

Information you provide us about others

If you submit a conversation, it may contain the personal data of third parties — the other participants in it, and anyone named or described within it. Before you submit, please make sure you have the necessary permissions from those individuals. The review step described above exists so that you can remove their information.

We use Third-Party Data received in this way only to provide the Service. We do not use it to contact, advertise to, or market to those individuals.

What the record of a submission does not contain

When you submit a conversation through a link, we do not ask for your name, email address, or other contact details, and the record we create of your submission contains none of them. That record holds the conversation, the consent given at the time, timestamps and checksums. It is identified by the link that was used and not by any attribute of you, and without the link we are ordinarily unable to identify a submission at all — a consequence set out under Your Rights and Choices.

This is a statement about the record of your submission. It is not a statement that we are unaware of your visit; see the next section.

Analytics and session recording

We use a third-party analytics provider to understand how the Service is used and to diagnose problems with it. Our analytics provider collects information automatically when you use the Service, including your IP address, browser user-agent string, device and operating system, the pages you visit and when, and the actions you take on them. This information is collected on our public pages, in accounts, and on the pages used to submit a conversation.

The Cookies used for analytics are described in the Cookie Policy.

Information we automatically collect

We also collect the information necessary to operate and secure the Service, including server logs generated by our hosting provider.

Data Uses

Purpose	Categories of personal data used	Disclosed to
Deliver a submission to the Account Holder who issued the link	Submission Data, Third-Party Data	The receiving Account Holder; cloud service providers
Make a submission retrievable through the link it was issued for, during the availability period	Submission Data	Cloud service providers
Maintain the integrity of the record, so that later alteration is detectable	Submission Data	—
Hold a submission made through a plain CinderSparq link until it is claimed	Submission Data, Third-Party Data	CinderSparq personnel
Develop, train and evaluate the models and software that operate the Service, only where the Submitter has selected the optional product-improvement checkbox	Submission Data	—
Operate an account and authenticate an Account Holder	Account Data	Authentication providers
Understand how the Service is used, diagnose problems and improve it	Usage and device data, IP address, session recordings	Analytics providers
Secure the Service, investigate faults and prevent abuse	Account Data, server logs	Cloud service providers
Respond to a question or request you send us	Communication Information	—
Comply with law, and establish, exercise or defend legal claims	Any of the above	Legal and regulatory authorities; advisers

Data Disclosure

The Account Holder who issued the link. Where a submission is made through a link issued by an Account Holder, we disclose it to that Account Holder.

CinderSparq A submission made through a magic link, and not yet claimed, is additionally disclosed to CinderSparq prior to or in lieu of it being claimed Submissions are held in an account not accessed in the ordinary course of business, and are accessed only where necessary to resolve a fault reported to us, to protect the Service, or to comply with law. Please refer to Magic-Link Terms for more details on how this is handled.

Service providers. We disclose personal data to selected vendors and service providers who perform functions on our behalf, under agreements requiring them to apply appropriate privacy and security measures and to act only on our instructions, including:

Cloud service providers who we rely on for compute, data storage and encryption key management, based in the United States.

Authentication providers who verify the identity of an Account Holder when they sign in, based in the United States.

Analytics providers who help us understand how the Service is used and provide session recordings, based in the United States.

Legal and safety. We may disclose personal data where we believe in good faith that it is required by law, or necessary to protect the rights, property or safety of CinderSparq, our users, or the public.

Corporate transactions. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will give notice before personal data becomes subject to a different privacy policy.

Our Role

Our role differs according to how a submission was made, and this determines who is answerable for it.

Submissions through a link issued by an Account Holder. The Account Holder determines the purposes for which the submission is collected and used, and we process it on their behalf and on their instructions. We are not the party that decides what happens to the submission after delivery. We suggest you read the terms and privacy policy of the Account Holder who sent you the link, as those govern what is done with your conversation; direct questions about it to them.

Submissions through a magic link. No Account Holder is involved, and CinderSparq holds the submission itself. The arrangement on which we hold it, and what happens when it is claimed, are set out in the Magic-Link Terms.

Data Retention

Records. A submission delivered to an Account Holder is retained for as long as that Account Holder maintains an account, subject to their own deletion practices.

Magic Links. Magic links have no account holder and remain available for a limited period, after which it no longer resolves and cannot be used to retrieve the submission it was issued for. The period and its consequences are set out in the Magic-Link Terms.

Other data. We retain other personal data for as long as necessary to provide the Service, to comply with our legal obligations, to resolve disputes, and for other legitimate business purposes.

Data Security

We use a combination of safeguards designed to secure personal data, including encryption, network segregation and access minimization. Conversation content is encrypted before it is stored, and the credentials permitting access to stored content are held separately from those permitting use of the encryption keys, so that neither alone is sufficient to produce readable content. Access to production systems is limited to named personnel and is logged. No method of storage or transmission is completely secure, and we do not represent otherwise.

Your Rights and Choices

Product improvement. Where the optional product improvement checkbox is presented, you decide whether we may use your submission to develop and improve our products.

Access and deletion. You may elect to delete the contents of any magic link prior to the expiration period via the provided delete function. If you used a magic link whose availability period has elapsed, the link no longer resolves, the data is automatically deleted from our backend.

Submissions held by an Account Holder. Where an Account Holder received your submission, please also contact them. They hold their own copy and their own obligations, and we will ordinarily direct you to them.

Third parties within a conversation. If you believe a conversation containing your personal data has been submitted to the Service, please contact us. Because we do not record who submits a conversation, we are ordinarily unable to locate one by reference to a person, and will need the link in order to act.

Data rights. Depending on where you live, you may have rights under privacy laws to access, correct or delete your personal data, or to appeal a refusal. To exercise a right, contact us at legal@cindersparq.com. We will verify a request relating to a submission by reference to the link associated with it. You may designate an authorized agent to act on your behalf.

Sale and Sharing

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. We do not serve advertising on the Service, we do not make conversation content available to advertising partners, and we do not use analytics data for advertising.

Residents of certain states, including California, have the right to request access to the categories and specific pieces of personal data we hold about them, to request correction or deletion, and not to receive discriminatory treatment for exercising these rights.

Cookies

The Service sets cookies that are strictly necessary to operate it, and analytics cookies that are not. It sets no advertising cookies. See the Cookie Policy.

Children

The Service is not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child has provided personal data to us, please contact us and we will delete it.

Changes

We may update this Privacy Policy. Each version is retained, and each submission records the version in force at the time it was made; the version and its effective date appear at the top of this page. Superseded versions remain published, because agreement given against earlier wording is not governed by later wording.

Contact

CinderSparq, Inc. 131 Continental Dr, Suite 305 Newark, DE 19713 United States legal@cindersparq.com