Privacy Policy — Spark Studio Social

Last updated: 21 October 2026.

Application: Spark Studio Social · Meta App ID 1217356887647390
Operator: Salman Ameen Alabd, operating as Spark Studio, currently located in Malaysia. Privacy contact: sparkdesignone@gmail.com — monitored for privacy and deletion requests.

1. What this policy covers

This policy covers Spark Studio Social, Spark Studio’s privately operated social-media management tool using a self-hosted Postiz installation. It is intended for authorized studio staff and client account administrators to prepare, schedule, publish and review content for accounts they are authorized to manage. It is not a public social network.

This notice does not cover every Spark Studio activity or unrelated client databases, mailing lists or advertising-audience uploads. Those activities require their own appropriate notices and permissions. Social networks and service providers also apply their own privacy notices to their services.

2. Information we process

Depending on the connected services, permissions granted and features actually used, information may include:

• Administrator and account information: administrator name and contact email; platform user identifiers, names and an email address if made available under an authorized permission; Page and professional-account identifiers, usernames, profile information and account-management roles.
• Publishing content and instructions: draft and published captions, images, audio or video supplied for publication, selected channels, scheduling instructions, publication identifiers and status or error information.
• Performance and interactions: engagement and performance information made available by a platform. If a comment-management feature is enabled and authorized, relevant comments, replies and associated public account identifiers may also be processed. Private-message access is not part of the tool’s stated current purpose.
• Authorization and operation: platform access tokens, permission and expiry information, local application account information, and limited technical or security logs necessary to operate the tool. Platform passwords are not requested through the tool; platform authorization takes place through the platform’s own sign-in flow.
• Support and privacy requests: the contact details, account identifiers and correspondence needed to answer an inquiry, verify a request and record its outcome.

We do not need passwords, one-time codes, access tokens, payment-card details or identity documents in a privacy-request email. Please do not send them.

3. Why we use information

We use information to authenticate authorized administrators; identify accounts they may manage; carry out their content and scheduling instructions; report publication results and available performance information; troubleshoot errors; protect the tool; and respond to support, access, correction, disconnection and deletion requests.

We process client-account information for the client’s authorized service, not to build unrelated profiles of people or combine different clients’ audiences. We do not sell or rent personal information or use Meta Platform Data for unrelated advertising, data brokerage or training general-purpose AI models.

4. Who receives information

Access is limited to authorized Spark Studio personnel and client representatives who need it for the relevant service. Content and required account information are sent to the social network selected for an authorized publishing or management action.

The self-hosted Postiz software stores operational data on the studio-controlled system; self-hosting does not by itself mean that the Postiz vendor receives a copy of account data. If additional hosting, backup or support providers are introduced, they must be assessed and this notice updated where necessary.

Optional AI assistance: content generation is separate from platform authorization. We do not send platform access tokens, private platform messages or other non-public Meta Platform Data to external AI services. If an external AI provider is used for permitted content assistance, we will identify the provider and the content categories involved to the affected client before use. No client or platform data may be used for model training without a separately established lawful and platform-permitted basis.

We may disclose limited information where legally required or necessary to protect rights and security, subject to applicable law. Social networks, email providers and hosting providers handle the information they receive under their own terms and notices.

5. This public information website

The privacy and deletion pages are designed as static information pages. The pages themselves do not add analytics scripts, advertising pixels, embedded social widgets, web fonts, forms or application cookies. Email links open your email application; this website does not receive or store a submitted deletion-request form.

When these pages are served through Cloudflare Pages, the hosting provider may process technical information such as IP addresses and request or security data to deliver and protect the pages. See Cloudflare’s privacy policy for its processing. Sending an email also involves your email provider and the provider of our contact inbox.

The public information site is separate from the private Postiz dashboard. It does not provide public access to studio credentials, connected-account data or the management dashboard.

6. Storage, security and international processing

Application data is primarily stored in the studio-controlled, self-hosted installation. Access is restricted to authorized administrators. Platform credentials must be kept out of public websites and source repositories. We use access controls and reasonable security measures, but no system can guarantee absolute security.

Social networks, email services, the public-site host and any approved service providers may process information in countries other than your own. Their locations and applicable legal protections can differ. Where required, we will use appropriate safeguards for the relevant processing.

7. How long we keep information

We keep connected-account information and authorization data only for as long as needed for the authorized service and the permissions granted. Drafts, media and publication records are kept while needed for the relevant client’s work, subject to its instructions and valid deletion requests. Operational logs are retained only as needed for security, troubleshooting or an applicable legal obligation.

When a connection ends or a valid deletion request is completed, we remove associated information no longer needed for an authorized purpose, unless retention is required by law. Any retained exceptions must be limited and explained to the requester where permitted. If backup copies exist, deleted data must not be restored to active use and must expire under the documented backup-retention schedule. A documented retention and backup schedule must be approved and implemented before production use.

We may keep the minimum request record necessary to document how a privacy request was handled, not the deleted account dataset itself.

8. Your choices and requests

You can revoke the tool’s access through the relevant platform and request access, correction, disconnection or deletion by contacting the privacy inbox above. Depending on applicable law and your circumstances, you may also have rights to object to processing, restrict it, obtain a copy of information or complain to the relevant regulator. We may need proportionate information to confirm identity or authority over a client account.

See the Data Deletion Instructions page for the request steps and what deletion does and does not remove. Revoking platform access is not, by itself, proof that historical information held in the tool has been erased. Deleting information from our tool does not automatically remove posts already published on a social network or copies held independently by others.

Service targets: acknowledge requests within 7 calendar days and aim to complete verified requests within 30 calendar days, or sooner where applicable law requires. If clarification, a lawful exception or additional time is needed, we will explain the next step and expected timing rather than silently close the request.

9. Children

The tool is intended for authorized adult business administrators, not for use by children. If you believe information about a child has been supplied inappropriately, contact us so it can be reviewed and removed where appropriate.

10. Changes and contact

We will update this notice when our practices change and show the date it was last updated. Material changes affecting connected accounts will be communicated to the relevant administrators where appropriate.

Questions or requests: sparkdesignone@gmail.com — public privacy contact.