Privacy Policy

Sospark is operated by the Sospark team ("we"). Sospark helps businesses reply to comments and messages, manage an inbox and schedule posts on Instagram, Facebook, Threads, YouTube, Telegram and WhatsApp. This policy explains what we process, why, and the choices you have.

Who this covers

Our customers (businesses and their team members who sign in to Sospark), and the people who comment on or message our customers' connected accounts ("their contacts"). For contacts, the business that connected the account decides what is automated; we process the data on its behalf.

What we process

• Your account: name, email address, a hash of your password (never the password itself), two-factor settings, sign-in sessions and the IP addresses used, to keep the account secure and limit abuse.
• Connected accounts: the access tokens Instagram, Facebook, Threads and Google (for YouTube) give us when you connect, page, profile and channel IDs and names. For Telegram, your user ID, name and the business connection to our bot. For WhatsApp, the linked-device session runs on our own servers.
• Comments and messages: text, attachments, names and usernames of contacts who comment on or message your connected accounts, and the replies Sospark sends. We use them only to run your inbox, automations and reports.
• Posts and media: captions, images and videos you schedule.
• Billing: your plan, invoices and payment status. Payments are handled by Xendit; we never see or store card or bank account numbers.

How we protect it

Access tokens, comments, messages and other personal data are encrypted at rest. Team members only see the accounts and menus their owner allows. Our servers are in Singapore; traffic passes through Cloudflare.

How long we keep it

• Comments, messages, AI assistant chats and webhook delivery logs: 30 days, then deleted automatically.
• Uploaded media: about 7 days after it was last needed, unless you saved it to your media library.
• Published or failed post records and notifications: 90 days.
• Your account data: until you ask us to delete the account.

Who we share it with

We do not sell personal data or use it for advertising. We share it only as needed to run Sospark:

• Meta (Instagram, Facebook, Threads), Google (YouTube), Telegram and WhatsApp, to read and send the comments, messages and posts you automate.
• Google (Gemini), when you use Sospark AI for replies, moderation, captions or the assistant. Phone numbers, email addresses and similar details are removed from the text before it is sent. If you add your own key from an AI provider (such as Google, OpenAI, Anthropic, DeepSeek, OpenRouter, Sumopod or Z.ai), that processing runs under your account with that provider and its terms.
• Xendit for payments, an email provider for account and notification emails, and Cloudflare for network delivery and protection.
• Webhook endpoints, API clients and n8n workflows you configure.
• Authorities, when the law requires it.

Data from YouTube

When you connect a YouTube channel, Sospark uses YouTube API Services to read new comments on your videos, the titles and descriptions of those videos, and to post replies or hold comments for review as your automations say. By connecting a channel you also agree to the YouTube Terms of Service, and Google's handling of the data is covered by the Google Privacy Policy. You can remove Sospark's access at any time on your Google account permissions page; disconnecting the channel in Sospark deletes the data we stored for it.

Data from Meta platforms

We use data from Instagram, Facebook and Threads only to provide the features you set up, in line with Meta's Platform Terms. When you disconnect an account or remove Sospark in your Meta settings, we stop using its token; deletion is described on the data deletion page.

Cookies and browser storage

We use one cookie to keep you signed in, and your browser's storage for preferences such as theme and a referral code. No advertising or tracking cookies.

Your rights

Under Indonesia's Personal Data Protection Law you can ask to access, correct or delete your personal data, withdraw consent, or object to processing. Contacts of a business using Sospark can ask that business, or us, and we will help. Contact [email protected].

Children

Sospark is a business tool and is not directed at children.

Changes

We will update this page when our practices change and tell customers about significant changes by email or in the dashboard.

Privacy · Terms · Data deletion · Updated 1 November 2026