Privacy policy
This is a translation. The French version is the legally binding version. Read the French version
On this page
This policy explains which personal data we process, why, with whom and for how long. It applies to:
- the website www.amaspark.com;
- the Amaspark account, the single account used to sign in to Amaspark apps.
Each Amaspark app that processes other data will have its own section here.
In short
- This website has no trackers, no ads and no audience measurement. It loads no external resources.
- The only cookie stores your language choice, and only if you change the language.
- The Amaspark account uses only the data needed to sign you in: email address, hashed password, identifier and, if you choose Google, your basic Google profile.
- We do not sell your data and do not use it for advertising.
Data controller
Anas MAROUF EI, trading as AMASPARK, 99 avenue Achille Peretti, 92200 Neuilly-sur-Seine, France.
For any question about your data: privacy@amaspark.com.
We have not appointed a data protection officer (DPO), as this is not required for our activity.
The amaspark.com website
Technical connection data
To display a page, your browser necessarily sends our hosting provider, Amazon Web Services (CloudFront service), your IP address, the address of the page requested and technical information about your browser.
- Purpose: delivering the website’s pages and protecting the service.
- Legal basis: our legitimate interest in providing a working and secure website (GDPR art. 6(1)(f)).
- Retention: we do not record access logs (CloudFront logging is turned off). This data is processed only for the time needed to answer your request.
Language cookie
If you choose a language in the switcher, the website sets a lang cookie that only contains the code of the chosen language (en, fr, es or zh), so that this language is shown on your next visits.
- Lifetime: 1 year.
- This cookie only personalises the interface at your request, so it is exempt from consent (article 82 of the French Data Protection Act; CNIL guidelines of 17 September 2020). It does not allow any tracking of your browsing.
- You can delete it at any time in your browser settings.
The website uses no other cookie, local storage or tracker.
Contact by email
If you write to us (for example at contact@amaspark.com), we process your email address, your message and any information you choose to include.
- Purpose: replying to you and following up on your request.
- Legal basis: our legitimate interest in answering the messages we receive (GDPR art. 6(1)(f)) or, for a request about your rights, our legal obligation (art. 6(1)(c)).
- Provider: our email is hosted by Hostinger.
- Retention: 3 years from our last exchange.
Amaspark account
The Amaspark account lets you sign in to every Amaspark app with the same identity. It is managed by our authentication service, hosted by Supabase in the European Union (Ireland).
Data processed
| Data | Source |
|---|---|
| Email address and its verification status | You |
| Password, stored only in hashed form (never in clear text) | You |
| Technical account identifier, shared by Amaspark apps | Generated by the service |
| Account creation and last sign-in dates | Generated by the service |
| Sign-in sessions (access and refresh tokens) | Generated by the service |
| Technical authentication logs: IP address, browser or app used, type of event (sign-up, sign-in, sign-out…), date and time | Generated by the service |
| If you use “Continue with Google”: your Google account identifier, name, email address, its verification status and the address of your profile picture | Google, with your permission |
On your phone, the app stores your session encrypted (AES-256, with a key protected by the Android system) and excluded from backups. It is erased when you sign out.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, signing you in and keeping your session in the apps | Performance of the contract (terms of use), art. 6(1)(b) |
| Sending account emails: address confirmation, password reset | Performance of the contract, art. 6(1)(b) |
| Securing the service: limiting abusive attempts, detecting incidents, rejecting passwords known to have leaked | Legitimate interest in protecting your account and the service, art. 6(1)(f) |
| Answering requests to exercise your rights | Legal obligation, art. 6(1)(c) |
Leaked-password check. When you choose a password, our authentication provider checks it against the “Pwned Passwords” database of the Have I Been Pwned service. Only the first 5 characters of a fingerprint (SHA-1 hash) of the password are sent. Neither your password nor your email address is sent.
We make no automated decisions that produce legal effects concerning you, and we do no profiling.
Sign-in with Google
If you choose “Continue with Google”, Google shares with us, with your permission, only the basic information of your profile, through the openid, email and profile permissions: Google account identifier, name, email address (and its verification status) and the address of your profile picture.
- Use: this data is used only to create your Amaspark account or sign you in, and to link it to your email address. We do not access any other data in your Google account (Gmail, contacts, files, calendar…).
- Storage: it is stored by our authentication service (Supabase, European Union) with your account, and deleted with it. The token provided by Google is used once, to verify your identity, and is not kept by the app.
- Sharing: we do not sell it, do not use it for advertising and do not share it with any third party, except the technical providers listed below and where the law requires it.
- Amaspark’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google also processes your data as a separate controller, under its own rules: see the Google Privacy Policy. For users in the European Economic Area, the controller is Google Ireland Limited. You can remove Amaspark’s access to your Google account at any time from the third-party apps page of your Google Account.
Retention periods
| Data | Period |
|---|---|
| Account and associated data | Until your account is deleted |
| Deletion at your request | Erased within 30 days of your request at most |
| Technical authentication logs | 7 days |
| Backups of the authentication service database | Rolling 7 days: deleted data disappears from backups at most 7 days after its deletion |
| Session on your phone | Until you sign out |
To delete your account: Delete your Amaspark account.
Minimum age
The Amaspark account and Amaspark apps are not intended for people under 15.
Recipients and processors
Your data is accessible only to us and, as far as strictly necessary, to the following technical providers. They act on our instructions, under a processing agreement that complies with article 28 of the GDPR.
| Provider | Role | Data location |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Website hosting (Amazon S3 in Paris, CloudFront network); sending account emails (Amazon SES, Ireland) | European Union; CloudFront points of presence may be outside the EU |
| Supabase Pte. Ltd. (Singapore) | Authentication service for the Amaspark account | European Union (Ireland, AWS infrastructure) |
| Hostinger International Ltd. (Cyprus) | Email and the amaspark.com domain name | European Union and United Kingdom, according to Hostinger |
Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia) only receives the fingerprint fragment described above, which cannot be used to recover your password or identify you.
We may also disclose data to authorities where the law requires it.
Transfers outside the European Union
Our data is hosted in the European Union. Some transfers outside the Union may still take place:
- Amazon Web Services: a page may be served to you by a CloudFront point of presence outside the Union (for example in North America), and AWS may access data to operate its services. These transfers are covered by the European Commission’s standard contractual clauses and by the participation of Amazon Web Services, Inc. in the EU–US Data Privacy Framework.
- Supabase: the contracting company is established in Singapore, and its staff or subprocessors may access data from outside the Union. These transfers are covered by the European Commission’s standard contractual clauses.
- Hostinger: email data may be processed in the United Kingdom, which benefits from a European Commission adequacy decision, and in the other cases set out in Hostinger’s data processing agreement, covered by standard contractual clauses.
You can get a copy of these safeguards by writing to privacy@amaspark.com.
Security
We apply appropriate measures: encrypted connections (HTTPS), hashed passwords, sessions encrypted on the device, sign-in links that only work on the device that requested them, restricted access to administration tools, and no access logs on the website.
Your rights
You have the following rights over your data:
- access: knowing which data we hold and getting a copy;
- rectification of inaccurate data;
- erasure, in particular by deleting your account;
- restriction of processing;
- objection to processing based on our legitimate interest;
- portability of the data you gave us;
- post-mortem instructions: deciding what happens to your data after your death (article 85 of the French Data Protection Act).
To exercise them, write to privacy@amaspark.com, if possible from your account’s email address. We may ask you to confirm your identity. We reply within one month, which may be extended by two months for a complex request; we would then tell you within the first month.
Complaint to the CNIL
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): online at cnil.fr/fr/plaintes, or by post to CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France. You can also contact us first: we will do our best to solve the issue.
Changes
We will update this policy if our processing changes, and the date of the last update is shown at the top of the page. For any significant change to the Amaspark account, we will inform you by email before it takes effect.