Privacy Notice

Spark is operated by AKOJ ("AKOJ", "we", "us"). AKOJ is the data controllerfor personal data we process about you in connection with the Service. You can reach us at hello@akoj.se.

• Account data: email address, password hash, and (for social sign-in) the identifier returned by the identity provider.
• Profile data: optional name and preferences you provide.
• Content data: the tasks, voice transcripts, rules, and prompts you submit to Spark, and the AI-generated outputs.
• Usage and telemetry: pages visited, features used, request timestamps, error logs, and similar diagnostic data.
• Device and connection data: IP address, browser type, operating system, device identifiers, language, and time zone.
• Support communications: messages you send us and our replies.
• Payment data: collected and processed by our payment processor Stripe; AKOJ receives only the subscription status, plan, last-four digits of the payment method, and the email tied to the order.

• Provide the Service — create your account, run task breakdowns, save your rules, deliver AI outputs. Legal basis: performance of a contract.
• Billing and subscription management via Stripe. Legal basis: performance of a contract; legal obligation (invoicing, tax).
• Security, fraud prevention, and abuse handling, including rate limiting and webhook signature verification. Legal basis: legitimate interests in keeping Spark safe.
• Product improvement — analysing aggregated usage to fix bugs and improve features. Legal basis: legitimate interests.
• Customer support — responding to your messages. Legal basis: performance of a contract; legitimate interests.
• Transactional emails (welcome, confirmation, password reset, billing receipts). Legal basis: performance of a contract.
• Marketing emails only where you have opted in, with an unsubscribe link in every message. Legal basis: consent.
• Compliance with law (e.g. responding to lawful requests). Legal basis: legal obligation.

• Stripe — our payment processor. Stripe handles checkout, card processing, billing, invoices, and refunds on our behalf. See Stripe's Privacy Policy.
• Cloud and infrastructure providers that host the database, edge functions, and email delivery on our behalf, acting as data processors.
• AI model providers we use to generate task breakdowns. Prompts and the minimum context required are sent to these providers solely to produce a response.
• Email delivery providers for transactional emails sent from notify.akoj.se.
• Professional advisers (legal, accounting) where necessary to run AKOJ.
• Authorities when required by law or to protect our rights, your safety, or the safety of others.

We do not sell your personal data.

Some recipients may be located outside the EU/EEA. Where this is the case, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions. You can request a copy of the safeguards in place by emailing hello@akoj.se.

We keep account, content, and profile data for as long as your account is active. If you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where we are required to keep certain records (for example invoices and tax records) for the period required by law. Diagnostic and security logs are typically retained for up to 12 months.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data.
• Restrict or object to certain processing (including direct marketing).
• Withdraw consent at any time, where processing is based on consent.
• Receive your data in a structured, machine-readable format (data portability).
• Lodge a complaint with your supervisory authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).

To exercise your rights, email hello@akoj.se. We will respond within one month of receiving your request.

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), encryption at rest for the database, access controls, row-level security on user data, rate limiting, and webhook signature verification. No method of transmission or storage is perfectly secure; if you become aware of a vulnerability please report it to hello@akoj.se.

Spark uses only strictly necessary cookies and local storage required to keep you signed in, remember your preferences, and operate the Service. We do not use third-party advertising or cross-site tracking cookies. If we introduce optional analytics or marketing cookies in the future, we will ask for your consent first and provide a way to manage your preferences.

Spark is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Notice from time to time. Material changes will be notified by email or in-app. The "Last updated" date at the top reflects the latest revision.

Privacy questions or requests: hello@akoj.se. For payment-related data handled by our payment processor, see Stripe's Privacy Policy linked above.