Privacy Policy

1 Who we are

SparkStation.ai (“SparkStation”, “we”, “us”) is an AI story-to-video platform owned and operated by VerSe Innovation, a company incorporated in India with its registered office in Bengaluru, Karnataka. For the purposes of this policy, VerSe is the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the “data controller” under the EU/UK General Data Protection Regulation (“GDPR”). This policy applies to personal data we process through sparkstation.ai and related apps, APIs, and services (the “Service”).

2 Personal data we collect

We collect the following categories of personal data:

• Account & contact data, name, email address, username, password (hashed), and profile details you provide.
• Billing data, plan, transaction history, and partial payment details; full card numbers are handled by our payment processors, not stored by us.
• Content you submit (“Inputs”), stories, scripts, prompts, images, audio, and video you upload to generate content.
• Generated content (“Outputs”), the videos, images, and characters the Service produces from your Inputs.
• Usage & device data, IP address, device and browser identifiers, operating system, language, timezone, pages viewed, features used, and log data.
• Cookies & similar technologies, as described in our Cookie Notice.
• Communications & support data, messages, feedback, survey responses, and information you provide when you contact us.

3 How & why we use your data

We use personal data to:

• provide, operate, and personalise the Service and generate your Outputs;
• create and manage your account, and process payments and subscriptions;
• maintain security, prevent fraud and abuse, and enforce our Terms of Use;
• provide customer support and respond to your requests;
• analyse usage to debug, evaluate, and improve the quality, performance, and safety of the Service (using de-identified or aggregated data where feasible);
• send you service messages and, with your consent where required, marketing communications; and
• comply with legal obligations and respond to lawful requests.

4 AI inputs, outputs & model training

When you use the Service, your Inputs are processed to generate Outputs. For most features you act as the owner of the content, and we act as a processor of the personal data contained in your Inputs and Outputs, handling them on your instructions to deliver the Service.

Some generation features may be powered by third-party AI providers. Where that is the case, your Inputs are transmitted to those providers solely to produce your Output, under contracts that restrict their use of the data, typically with retention limited to a short period (for example up to 30 days) for abuse monitoring.

5 Legal bases for processing

Where the GDPR or a similar law applies, we rely on the following legal bases:

• Performance of a contract, to provide the Service you request and manage your account and billing.
• Consent, for marketing communications, non-essential cookies, and any optional processing; you may withdraw consent at any time.
• Legitimate interests, to secure the Service, prevent fraud, understand usage, and improve our products, balanced against your rights.
• Legal obligation, to comply with applicable laws, tax rules, and lawful requests.

Under the DPDP Act, we process personal data on the basis of your consent or for legitimate uses permitted by that Act.

6 How we share your data

We do not sell your personal data. We share it only as follows:

• Service providers (processors), cloud hosting, storage, content-delivery, analytics, customer-support, and AI-model providers acting on our instructions under data-processing agreements.
• Payment processors, to process your payments securely.
• Within our group, VerSe group entities, for infrastructure, security, and support, under appropriate safeguards.
• Legal & safety, authorities, regulators, or advisors where required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers, to a successor in the event of a merger, acquisition, or sale of assets, subject to this policy.
• With your direction, where you publicly share or publish Outputs, or connect third-party services.

7 International data transfers

We are based in India and use service providers that may process data in other countries. Where we transfer personal data across borders, we do so in compliance with applicable law and use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or your explicit consent, to protect your data. Some destination countries may offer a different level of legal protection than your home country.

8 Data retention

We keep personal data only as long as necessary for the purposes described in this policy, or as required by law. The following table summarises typical periods:

9 Security

We implement technical, organisational, and physical safeguards designed to protect personal data, including encryption in transit (TLS/SSL), access controls, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

10 Your rights & choices

Depending on where you live, you may have the right to access, correct, update, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You can:

• access and update most account information directly in your settings;
• delete Outputs and close your account at any time;
• opt out of marketing emails using the unsubscribe link or your notification settings;
• manage cookies as described in our Cookie Notice and via Global Privacy Control signals; and
• contact us at contact@sparkstation.ai to exercise any right.

We respond to verified requests within the timeframes required by applicable law. We may need to verify your identity before acting on a request.

11 Notice to users in India (DPDP Act 2023)

If you are in India, the Digital Personal Data Protection Act, 2023 applies. VerSe is the Data Fiduciary. You have the right to access a summary of your personal data and processing, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity. Where we rely on consent, you may withdraw it at any time. You can raise a grievance with our Grievance Officer, Nahendiran, at grievance.officer@sparkstation.ai or +91 81476 93268; if unresolved, you may approach the Data Protection Board of India.

12 Notice to users in the EU, EEA & UK (GDPR)

If you are in the European Economic Area or the United Kingdom, VerSe acts as data controller and processes your data on the legal bases in Section 5. You have the rights of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw consent and to lodge a complaint with your local supervisory authority (in the EU) or the UK Information Commissioner’s Office (ICO). Where processing is based on legitimate interests or direct marketing, you have the right to object at any time.

13 Notice to United States residents (state privacy laws)

A growing number of US states have enacted comprehensive consumer privacy laws, including California, Colorado, Connecticut, Virginia, Texas, Utah, Oregon, and others, with more taking effect over time. If you are a resident of a US state that grants such rights, you may, subject to that state’s law and applicable exceptions, have the right to:

• Know / access the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Obtain a portable copy of personal information you provided to us;
• Opt out of the “sale” or “sharing” of personal information, of targeted (cross-context behavioural) advertising, and of certain profiling; and
• Limit the use of sensitive personal information, and to appeal a denial of your request where your state provides an appeal mechanism.

We do not sell your personal information for money. We may “share” certain identifiers and internet-activity data with advertising or analytics partners for cross-context behavioural advertising, which you can opt out of via our cookie controls and Global Privacy Control (GPC) signals, which we honour as a valid opt-out where required. Some states require opt-in consent before processing sensitive data or the data of known minors, and we obtain that consent where the law requires it. We will not discriminate against you for exercising your rights, and we respond to verifiable requests within the period your state’s law requires (typically 45 days, extendable where permitted). Authorised agents may submit requests with proof of authorisation, and we may need to verify your identity before we act.

To exercise any of these rights, contact us at contact@sparkstation.ai or use the privacy controls in your account. If we deny your request, you may appeal by replying to our response; if you remain unsatisfied, you may contact your state Attorney General.

14 Children

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data without the consent required by law, we will delete it. If you believe a minor has provided us data, contact contact@sparkstation.ai.

15 Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service and update the “Last updated” date above. Your continued use of the Service after the changes take effect indicates your acceptance of the updated policy.

16 Contact & complaints

For any privacy question, request, or complaint, or to reach our grievance/data-protection contact, write to us at:

Grievances may also be raised directly with our Grievance Officer:

We will acknowledge and address your request in line with applicable law. If you are not satisfied with our response, you may contact your local data-protection authority, in India, the Data Protection Board of India.