Privacy Policy
Contents
1. Introduction
This policy explains what personal data SparkSave collects, why, how long we keep it, and what rights you have.
SparkSave is designed for children and young people, so we follow one simple principle: collect as little as possible.
2. Data controller
Pedro Miguel Lameiras Lima
Tax number: 219197606
Address: Rua Campo de Ourique, 105, 1250-060 Lisboa, Portugal
Email: suporte@sparksave.pt
3. What data we collect
3.1. Guardian data (only if an account is created)
- Email address — to create the account, sign in, recover the password and send essential service messages.
- Password — stored only as a cryptographic hash. We never have access to the readable password.
- Record of acceptance — the date the guardian confirmed they are over 18 and accepted these documents.
3.2. App usage data (only if an account is created)
When an account exists, the following is stored in the cloud so it can be restored on another device:
- Selected age group (Under 7, 7-10, 11-15, 16+). We do not collect date of birth.
- Learning progress — completed lessons, quiz results, modules and badges.
- Dream Bank — goals and tasks set by the guardian, and their status.
- Virtual coins and accessories for Lumi.
- Preferences — language, narration voice and app settings.
- Parents menu code — stored only as a cryptographic hash, never in readable form.
3.3. Data that stays on the device only
- The child's name or nickname ("What should Lumi call you?") is stored only on the device and is never sent to our servers. If the account is opened on another device, Lumi asks again.
- Anyone using the app without an account has all their data stored on the device only. Nothing is sent to us.
3.4. What we do NOT collect
- The child's name, surname or photo
- Date of birth
- Address or phone number
- Location
- Bank or payment details
- Access to contacts, camera, microphone or photos
- Data for advertising or profiling
SparkSave uses no analytics, advertising or tracking tools.
4. How we use the data
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email and password | Create and authenticate the account; recover access | Performance of contract — Art. 6(1)(b) |
| Age group | Show age-appropriate content | Performance of contract |
| Progress, Dream Bank, preferences | Save and sync progress across devices | Performance of contract |
| Record of acceptance | Demonstrate the guardian's consent | Legal obligation and legitimate interest |
5. Protecting children
5.1. The account is created and managed by an adult guardian, who authorises the processing of data relating to the child.
5.2. We require a guardian's involvement for all users under 18, although Portuguese law sets the age of digital consent at 13.
5.3. We store no data on our servers that directly identifies the child.
5.4. We never use children's data for advertising, marketing or profiling.
6. Who we share data with
6.1. We do not sell personal data.
6.2. Providers that process personal data on our behalf:
- Supabase — account authentication, database and storage. Servers in the European Union.
- Amen Portugal — domain hosting and sending account confirmation and password reset emails. Receives the guardian's email address only for that purpose.
6.3. Narration services, which receive no personal data:
Lesson narration is generated by speech synthesis services. These receive only the lesson text, which is the same for every user — never the child's name, the email, progress or any other account data.
- Rork — the app's development platform, which routes narration requests
- ElevenLabs — English narration
- Fish Audio — Portuguese narration
- OpenAI — backup narration, used if the others do not respond
Generated audio is kept in shared storage so it can be reused for all users. It contains only the narrated lessons and is not linked to any person.
The "iPhone voice" option runs entirely on the device and sends nothing externally.
6.4. We may disclose data where required by law or by a competent authority.
7. Where data is stored
7.1. Account data is stored on servers in the European Union.
7.2. Should personal data ever be transferred outside the European Economic Area, this will be done with the safeguards required by the GDPR, such as standard contractual clauses approved by the European Commission.
8. Security
- Data encrypted in transit and at rest
- Account password stored as a cryptographic hash
- Parents menu code stored as a cryptographic hash
- Each guardian can only access their own account's data
- Parents menu protected by a code
No system is completely secure, but we will report any personal data breach within the terms and deadlines set by the GDPR.
9. How long we keep data
9.1. For as long as the account is active.
9.2. When an account is deleted, its data is erased within 30 days, unless the law requires it to be kept longer.
9.3. Accounts inactive for 24 months may be deleted, with prior notice by email.
9.4. Data from users without an account stays on the device only and disappears when the app is deleted.
10. Your rights
The guardian may, regarding their own data and that of the child in their care:
- Access — find out what data we hold and get a copy
- Rectify — correct inaccurate data
- Erase — ask for the data to be deleted
- Restrict processing
- Portability — receive the data in a structured format
- Object to processing based on legitimate interest
- Withdraw consent, where applicable
To exercise these rights: suporte@sparksave.pt. We will respond within one month.
The account and all its data can also be deleted directly in the app: Parents → Manage account → Delete account and all data.
11. Complaints
You can complain to the supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt
12. Cookies and tracking
SparkSave uses no cookies, analytics tools, advertising or tracking of any kind.
13. Changes
We may update this policy. Significant changes will be notified in the app or by email. The date of the last update appears at the top.
14. Contact
suporte@sparksave.pt