Legal
Effective July 30, 2026 · Last updated July 30, 2026
SaySpark (“SaySpark”, “we”, “us”) respects your privacy. This page has two parts. Part 1 covers the sayspark.ca website: its public pages, the waitlist and contact forms, account sign-up and sign-in, and the browser simulator. Part 2 covers the early-access SaySpark product — the desktop and companion apps and the Spark Mini robot — whose voice and camera features handle more sensitive data and get their own rules. Both parts share the “Your choices and rights” and contact details at the end.
Part 1
Applies to sayspark.ca: public pages, waitlist and contact forms, website accounts, and the browser simulator demo.
Information you provide directly.
• Waitlist: your name, email address, and the role you select (parent, teacher, school administrator, student, or other).
• Contact forms: your name, email address, the topic you select, and your message — including pilot and partnership inquiries.
• Accounts: your email address and password when you create or sign in to an account. Passwords are handled by our authentication provider (Supabase) and stored only in hashed form — we cannot read them.
• Communications: the contents of emails and support requests you send us, and your replies to ours.
Browser simulator. The homepage simulator lets visitors try the Spark tutor without an account. When you use it we process: the messages you type, a short automatic summary of your demo scene, the responses generated for you, a random session identifier, the number of free prompts used, and your IP address (used transiently to enforce the per-visitor limit). Demo conversations are held in server memory for the session only, are not linked to your identity, are not written to our database, and are not used by us to train any model. Please don't type personal information into demo messages.
Information collected automatically. Our hosting and security providers process standard technical data: IP address; browser, device, and operating-system type; pages visited, referring page, and access time; session identifiers and authentication status; and performance, error, and security logs.
The website uses only cookies and local storage necessary to operate the site: the session tokens our authentication provider needs to keep you signed in, and functional preferences. We do not use third-party analytics, advertising pixels, session-replay tools, cross-site trackers, or marketing cookies on the website.
You can control cookies in your browser settings; blocking essential cookies may prevent sign-in from working.
We use information collected through the website to: provide, maintain, and secure the website and browser simulator; create and authenticate accounts; manage the launch waitlist and send the launch updates you requested; respond to contact, support, pilot, and partnership inquiries; generate simulator responses and enforce free-use limits; detect and prevent fraud, abuse, and security incidents; diagnose errors and improve reliability; keep records required for legal, security, and operational purposes; and comply with applicable law.
We do not sell personal information, and we do not use the website for third-party behavioural advertising.
SaySpark is an educational product designed for children, families, and schools — but the website's waitlist, contact, account-registration, and partnership forms are intended to be completed by adults (parents, guardians, teachers, and school representatives).
Children should use the website and browser simulator only with the knowledge and supervision of a parent, guardian, teacher, or school. The demo is deliberately designed to need no personal information; we ask children not to submit their full name, email address, school, address, or other personal details in any prompt, form, or message. We do not currently operate an age gate on the public demo — it is an anonymous feature that collects no profile.
If you believe a child submitted personal information through the website without appropriate adult authorization, contact us at support@sayspark.ca and we will review and delete it where appropriate and legally permitted.
We do not disclose personal information except as described in this policy or as permitted or required by law. We may share website information with: service providers that host, secure, and support the website; our authentication and database provider; email-delivery providers that carry form submissions; AI providers used to generate simulator responses; professional advisers (lawyers, accountants, insurers, security specialists) where reasonably necessary; law-enforcement, regulators, courts, or other parties where disclosure is required or permitted by law; and a purchaser, investor, or successor in connection with a financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality safeguards.
| Provider | Website purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Website hosting (sayspark.ca) | Page requests, IP addresses, server logs | United States |
| Supabase | Account sign-up/sign-in and database | Email, hashed credentials, account and session data | Outside Canada (US or EU data center) |
| Resend | Delivers waitlist/contact form messages and account notifications by email | Name, email, message contents | United States |
| Render | Hosts the cloud service behind the forms and the browser simulator | Form submissions in transit, simulator prompts, IP addresses (rate limiting) | United States |
| Anthropic | Generates the Spark tutor’s browser-simulator responses | Simulator prompts, scene summaries, responses | United States |
Our service providers process and store website information primarily in the United States (and, for our database provider, in our project's data-center region, which is outside Canada). When information is processed in another country it is subject to that country's laws and may be accessible to its courts, law-enforcement agencies, or government authorities.
| Information | Retention period or deletion rule |
|---|---|
| Waitlist submissions | Kept until we send the launch notification you asked for, and up to 12 months afterwards; deleted earlier on request. |
| Contact messages | Kept while we handle your inquiry and for up to 24 months as correspondence records; deleted earlier on request. |
| Website account information | Kept until you delete your account (see “Deleting your account” below). We may delete accounts after a prolonged period of inactivity, with notice where possible. |
| Browser simulator prompts and responses | Held in server memory only for the duration of the demo session and not written to our database. Our AI provider may retain requests briefly for abuse monitoring under its terms. |
| Server, authentication, and security logs | Short-lived operational logs kept by our hosting providers, typically 30 days or less. |
| Marketing consent and unsubscribe records | Kept while your subscription is active and afterwards as needed to honor your unsubscribe and to demonstrate compliance with anti-spam law. |
When information is no longer required we delete, anonymize, or securely isolate it, subject to reasonable backup cycles and legal retention periods.
Safeguards in place for the website include: encryption in transit (TLS/HTTPS) for all connections; passwords stored only as salted hashes by our authentication provider; secrets and API keys kept in our hosting providers' managed environment stores, never in the website's code; access to production systems and stored data restricted to the founder; security headers (HSTS, content-type and framing protections) on every response; and rate limits and anti-abuse controls on public endpoints, including the demo and contact forms. No website or transmission method is completely secure, but we take reasonable measures appropriate to the sensitivity of the information.
Joining the waitlist is express consent to receive the launch-related emails you asked for — that is the only marketing use we make of your address, and we do not add you to other lists. Every marketing email we send will include a working unsubscribe mechanism, and you can always unsubscribe by writing to support@sayspark.ca. Unsubscribing does not stop necessary security, account, or support messages.
The website may link to sites and services operated by others. Their privacy practices are governed by their own policies, not this one.
Part 2
Applies to the desktop and companion apps and the Spark Mini robot during early access — the features that involve voice, camera, and robot data.
Robot information. The serial number of each robot you register, a per-device security token, and operational telemetry the robot reports (position, distance-sensor readings, connection status).
Voice. When a child talks to the robot, its microphone captures that spoken request and streams the audio to our cloud service to be transcribed, answered by the AI tutor, and spoken back. The microphone is not used to listen continuously beyond handling a request, and voice data is never used for advertising or profiling.
Camera/video. The companion app can use the phone camera to track the robot's surface (AprilTag markers) and stream a live view to the desktop app on the same Wi-Fi network; the robot's onboard camera captures frames the tutor uses to make decisions. This imagery is used for the feature in the moment — it is not sold and not used for advertising.
Usage and learning data. Progress through activities, feature usage, and basic diagnostic information, so learning can continue across sessions and we can keep the product working.
A spoken request travels through the providers below; each processes it on our behalf under its own terms and is not permitted to use it for its own advertising. We do not use voice data to train our own or third-party models.
| Provider | Role | Location |
|---|---|---|
| OpenAI | Speech-to-text (Whisper) — transcribes a spoken request into text | United States |
| Anthropic | The Spark tutor’s replies and on-robot reasoning | United States |
| ElevenLabs | Text-to-speech — turns Spark’s reply into the voice you hear | United States |
| Supabase | Accounts, robot registrations, device tokens, learning progress | Outside Canada (US or EU data center) |
| Render | The cloud backend that relays robot data and AI requests | United States |
We process voice audio to handle a request and produce a spoken reply, and keep recordings only as long as needed to deliver and operate the feature. Transcripts may be retained to provide learning history where the account owner has enabled it. The AI providers above may retain request data briefly for their own safety and abuse monitoring under their terms.
The product is set up and supervised by an adult. We rely on the parent, teacher, or school that creates the account to provide verifiable consent for any child under 13 (or the equivalent age in your region) before that child uses SaySpark, including its voice features.
For children we practice data minimization: a first name or nickname is enough, a child never needs their own account, there is no behavioural advertising, and children's data is never used to build marketing profiles. A parent, teacher, or school can review, export, or delete a child's data at any time by contacting us.
Beyond data handling, SaySpark is designed so children interact safely: there is no chat between users, no public profiles, no user-generated content visible to strangers, and no advertising. The tutor's conversations are one-on-one under adult supervision, and the robot is designed for tabletop and floor use with an adult present — follow the safety guidance included with the hardware.
If the tutor ever behaves inappropriately, report it to support@sayspark.ca — such reports go to the top of our queue.
Both parts
These sections apply to everything above.
Subject to applicable law, you may request access to or correction of personal information we hold about you, ask us to delete it, withdraw consent, or make a complaint about our privacy practices — including with the Office of the Privacy Commissioner of Canada. We may need to verify your identity before acting on a request. Contact support@sayspark.ca.
Deleting your account. Account owners can delete their account and associated data at any time — see how account deletion works, or email us and we'll do it for you.
We may update this policy as the website and product evolve. We'll post the new version here and update the “Last updated” date; where required we'll provide additional notice or obtain consent before material changes — and significant changes affecting children's data will be communicated to account owners.
Legal entity: SaySpark
Trade name: SaySpark
Privacy Officer: Ahmad Ali, Founder
Location: Windsor, Ontario, Canada
Privacy requests & general support: support@sayspark.ca