Privacy Policy
Last updated:
How we process personal data when you use our website, customer portal, site assistant, support channels and Telegram bot, in line with the General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is SOHO ICT B.V., trading as SparkHost, Keizersgracht 555, 1017 DR Amsterdam, the Netherlands, KvK 85808512. Questions or requests about your personal data: support@sparkhost.ai. SparkHost serves business customers; the personal data we process is mainly that of contact persons at those businesses and of website visitors.
This policy does not cover data that you store on your own dedicated machine: for that data you are the controller and we act as processor under our Data Processing Agreement.
2. Where your data is: EU / the Netherlands
Data location: EU / the Netherlands. Our machines are hosted in the Iron Mountain data centre in Amsterdam, the Netherlands (EU). Our website, customer database and the AI model behind our site assistant run on our own servers in the Netherlands; our self-hosted mail server runs at LeaseWeb in Amsterdam (NL). The only recipients outside the EU are those named in section 5 (Stripe may transfer payment data, Telegram only if you choose to link it).
3. What we process, why, and on which legal basis
- Account and sign-in — email address, name, company, KvK number, VAT ID, one-time sign-in codes (stored hashed), session cookie, IP address and browser of active sessions. Purpose: giving you access to the portal. Basis: performance of a contract (art. 6(1)(b) GDPR).
- Orders, billing and tax — company and billing details, VAT ID, invoices, subscription and payment status. Card and bank details are entered at Stripe and never reach us. Purpose: selling and invoicing the Service. Basis: contract (art. 6(1)(b)) and legal obligation to keep financial records (art. 6(1)(c)).
- Provisioning and access — SSH public keys, the machines assigned to you, hostnames and access details. Purpose: delivering the Service. Basis: contract.
- Support — tickets, messages, contact-form submissions and email correspondence. Purpose: answering questions and solving problems. Basis: contract, or our legitimate interest in answering enquiries from prospective customers (art. 6(1)(f)).
- Site assistant (chatbot) — your questions, the answers, your IP address (for rate limiting) and, if you are signed in, your account. Purpose: answering questions about SparkHost and handing conversations to a human when you ask. Basis: legitimate interest. Please don't enter sensitive personal data in the chat. We do not use your conversations to train AI models.
- Telegram — if you link Telegram: your Telegram chat ID, username and the messages you exchange with our bot. Purpose: notifications and support via Telegram. Basis: contract; you can unlink at any time in the portal.
- Waitlist — your email address and the platform, number of units and plan you're interested in. Purpose: telling you when units are available. Basis: consent (art. 6(1)(a)); you can withdraw it at any time by emailing us.
- Security and abuse prevention — IP addresses, rate-limit counters and an audit log of staff actions. Purpose: protecting our systems and customers. Basis: legitimate interest.
We send transactional emails (sign-in codes, order, machine and ticket notifications). We don't send marketing newsletters without your consent and we don't sell personal data. We don't use automated decision-making or profiling with legal or similarly significant effects.
4. Cookies and similar technology
We use one strictly necessary, http-only session cookie when you sign in. The site assistant keeps the current conversation in your browser's session storage until you close the tab. We use no analytics, advertising or tracking cookies, so no cookie consent is needed.
5. Processors and other recipients
- Stripe (Stripe Payments Europe, Ltd., Ireland) — payments, invoices, tax IDs and the billing portal. Stripe may transfer data outside the EEA using the safeguards described in its own privacy policy.
- Our mail server — transactional and support email runs on a mail server we operate ourselves (self-hosted), not on a third-party email service. The server is hosted by LeaseWeb Netherlands B.V. in Amsterdam (NL), which acts as infrastructure provider (sub-processor); the email data stays in the EU.
- Telegram — only if you link your account. Messages sent through Telegram are also processed by Telegram under its own privacy policy, outside the EU.
- The AI model behind the site assistant — self-hosted by us on our own hardware in the Netherlands; your conversations are not sent to an external AI provider.
- Iron Mountain — the data centre in Amsterdam that houses our hardware (physical housing, power and connectivity; no access to the data on it).
We share data with authorities only when the law requires us to.
6. How long we keep data
- Account and profile data: as long as you have an account; deleted on request when no longer needed for a running contract or a legal obligation.
- Invoices and financial records: 7 years, the Dutch statutory retention period.
- Support tickets: as long as you have an account, and deleted on request afterwards unless needed for a dispute.
- Site assistant conversations: 12 months, then automatically deleted (conversations turned into a ticket follow the ticket).
- Waitlist sign-ups: until you ask us to remove you, and at most 24 months.
- Sign-in codes and links: deleted 1 day after they expire; sessions: deleted after they expire (30 days at most).
- Audit log of staff actions: 24 months.
7. Security
All traffic is encrypted (HTTPS). Sign-in tokens and codes are stored only as hashes, access to customer data is limited to the staff who need it, staff actions are logged, and our systems are kept up to date.
8. Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability and to withdraw consent at any time. Email support@sparkhost.ai; we reply within one month. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Changes
We update this policy when our processing changes; the date at the top shows the latest version. Material changes are announced to customers by email.