Legal
Privacy Policy
What you dictate never reaches us. We only handle the little we need to let you sign in and keep your access working.
What this policy covers
This policy explains what personal data is processed when you use Spark, the dictation app for macOS, and the Spark pages of this website (everything under francesco-dipietro.com/spark/): what the data is, why it's used, who else handles it, how long it's kept, and your rights under the EU General Data Protection Regulation (GDPR).
The technical details are on the security and privacy page.
Who is responsible
Spark is made by Francesco Di Pietro, a sole proprietorship registered in Poland. We are the controller of the personal data described in this policy.
For anything about your data, email spark-desk@mail.grokbot.com. We reply within one month.
What stays on your Mac
Spark does its work on your Mac. The following never leaves it, and we have no access to any of it:
- Your voice. For dictation, Spark records only while you hold the shortcut. The audio is processed in memory by the speech model on your Mac and then discarded. It is never stored or uploaded.
- Your meetings. When you start a meeting, Spark records your microphone and the call until you stop it, and stores the recording on your Mac. The transcript, the speaker labels and the summary are made on your Mac too. You can delete a meeting's audio, or the whole meeting, at any time. None of it is uploaded.
- Voice fingerprints. When you name a speaker, Spark keeps a description of that voice on your Mac to recognize them in later meetings. It is deleted when you delete the person in Spark.
- Your transcripts. The text goes into the app you're typing in, and the most recent 100 dictations are kept in Spark's history on your Mac. You can delete one or all of them at any time.
- Your settings, and the sign-in session, access pass and random device identifier that Spark keeps in your Mac's Keychain.
Spark has no analytics, no telemetry and no crash reporting of its own.
What we process to give you access
Spark only works for people who have been invited, so it needs a small licensing service. This is all the personal data it handles:
| Data | Where it comes from | Why |
|---|---|---|
| Your email address | Your organization, when it invites you, and you, when you sign in | To send you sign-in codes and recognize you |
| Your organization, its plan, and your role (admin or member) | Your organization | To know which subscription and seat your access belongs to |
| For each Mac you sign in on: a random identifier created by Spark, the Mac's name, and when it was first and last seen | The Spark app | To apply the limit on Macs per person, and so you can tell your Macs apart when you reach it |
| Your sign-in account (email address, when it was created and last used) and technical logs, including IP addresses | The sign-in service, when you sign in or Spark renews your access | To run sign-in securely and prevent abuse |
| Billing contacts and invoices, for organizations that buy Spark | The organization | To invoice and to keep the accounting records the law requires |
| What you write when you email us | You | To reply to you |
Legal bases
- Providing Spark. When you are our customer, processing is needed to perform our contract with you (Art. 6(1)(b) GDPR). When your organization is the customer, it rests on our legitimate interest, and your organization's, in providing the service it bought for you (Art. 6(1)(f)).
- Security and abuse prevention, including sign-in logs and the limit on Macs: our legitimate interest in protecting Spark and our customers (Art. 6(1)(f)).
- Invoices and accounting: our legal obligations under Polish tax and accounting law (Art. 6(1)(c)).
- Replying to your emails: our legitimate interest in answering you, or steps you ask for before a contract (Art. 6(1)(f) and (b)).
You need to give your email address to sign in. Without it, Spark can't confirm your access and won't record.
How long we keep it
- A Mac's record is deleted when you sign out on that Mac, or when you're removed from your organization.
- Your membership (email, organization, role) is kept while you're a member. It is deleted when your organization removes you, or within 90 days after your organization's subscription ends and isn't renewed.
- Your sign-in account is deleted within 30 days after your membership is.
- Technical logs are kept for a few days by our sign-in provider and then deleted automatically.
- Invoices and accounting records are kept as long as Polish tax and accounting law requires, generally five years from the end of the year in which the related tax was due.
- Emails are kept as long as needed to handle your request, and for up to two years after our last exchange, unless they are part of a contract or an invoice.
Who else handles it
We use a few service providers. They process data only to provide their service to us:
- Supabase runs the sign-in and licensing service. Its data is stored in the EU.
- Resend delivers the emails with sign-in codes. It receives your email address and the code.
- Dynu hosts the server for this website, Spark's update feed and Spark downloads.
- Grokbot hosts the spark-desk@mail.grokbot.com mailbox.
Supabase, Resend and Dynu are US companies. Where they or their sub-processors access data from outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses in their data processing agreements, or by the EU-US Data Privacy Framework where the recipient is certified.
Model downloads. When you download a speech model, your Mac fetches it directly from Hugging Face, which sees your IP address like any website you download from. We don't send Hugging Face anything about you. Hugging Face handles that request under its own privacy policy.
Updates. About once a day, Spark asks our update feed whether there's a new version, and it downloads updates from our server. The request includes Spark's version. No system profile is sent.
We don't sell personal data, and we don't share it for advertising.
This website
- The Spark pages set no cookies, use no analytics and no third-party trackers, and load no fonts, scripts or images from other domains.
- Like any web server, ours logs requests: the IP address, the time, the page or file requested and the browser's user agent. We use these logs only to run and secure the site, keep them only as long as that needs, and delete them regularly.
- If you email us, we use your message and address to reply.
Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and get a copy of it;
- have it corrected if it's wrong;
- have it erased;
- restrict how we use it;
- receive it in a portable format;
- object to processing based on our legitimate interests.
To use any of these rights, email spark-desk@mail.grokbot.com. If your organization invited you, you can also ask your Spark admin, who can remove you from Spark.
You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also go to the authority where you live or work.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Children
Spark is made for work and isn't intended for children under 16.
Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use your data in a significant way, we tell the admins of customer organizations by email before it takes effect.