Sparkostory
← Back to Sparkostory

Privacy Policy

What We Collect

  • Your email address (for account access and book delivery)
  • Your child's first name, date of birth, city, and pronoun (to personalise the story)
  • A photo of your child (to generate the character illustration)
  • Payment information (processed by Stripe — we never see or store your card details)

Analytics & Cookies

Strictly necessary

  • sparko_vid (first-party, 1 year) — a random UUID we assign each browser so we can debug issues and stitch funnel steps together. Contains no personal data.
  • sparko_consent (first-party, 6 months) — records your cookie choice on this site.
  • sparkostory_session / sparkostory_user (first-party) — login and cart session.

Optional (set only after you tap “Accept”)

  • Google Analytics 4 — measures traffic sources and conversions. IP anonymized; no ad personalization. Provider: Google LLC. See policies.google.com/privacy.
  • PostHog (EU region) — product usage and session replay. All form inputs are masked in replay — we never see what you type. Data hosted in the EU. Provider: PostHog Inc. See posthog.com/privacy.

Your choices

You can change your choice anytime by clearing cookies for this site. Rejecting optional cookies disables PostHog and GA4 immediately; the strictly-necessary cookies above remain.

Children

Sparkostory is purchased by adults for children. We do not knowingly collect personal data from children. The child's name and date of birth supplied in the story form are used only to generate the book; they are not used for advertising profiling.

How We Use It

  • Your child's photo is used only to generate the AI illustration in your book. It is not shared with any third party and is not used to train AI models.
  • Your email is used to send your book and (if you opt in) occasional updates.
  • We do not sell your personal data.

How We Store It

  • Photos and generated images are stored on Google Cloud Storage (GCS), hosted in the asia-southeast1 region (Singapore).
  • Data is retained for 12 months after your last order, then deleted.
  • Stripe processes all payments. See Stripe's privacy policy at stripe.com/privacy.

Your Rights (PDPA)

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Withdraw consent and request deletion

To exercise these rights, email: [email protected]

Contact

Questions about privacy? Email [email protected].
Last updated: March 2026.