Privacy Policy

SupplySpark is a trade name. The service is run by its founders from Barcelona, Spain. A company is being formed to take it over; this page will name it as soon as it exists.

Operator

SupplySpark, run by its founders

Address

Barcelona, Spain

Website

https://supplyspark.co

Email

hello@supplyspark.co

For the purposes of the General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD), we are the controller of the personal data described in this policy. We have not appointed a data protection officer; write to hello@supplyspark.co for anything about your data. Dodo Payments, which bills our paid plans, is a separate controller for the payment data it collects (section 7).

This policy covers:

• visitors to supplyspark.co and to the SupplySpark app;
• people with a SupplySpark account, whether they use it as a buyer, as a supplier, or both;
• people who appear in a supplier profile, for example as a contact person, owner or director, whether or not they have ever used SupplySpark (Part 3);
• people who write to us, receive our emails, or use SupplySpark through Claude, ChatGPT or our API.

Information about a company as such (its legal name, address, registry number, products, capacity, certificates) is not personal data. This policy is about information that identifies a person: a name, a work email address with a name in it, a direct phone number, a LinkedIn profile, an IP address, or a record of what you did in the service. "The service" means everything described in the Terms of Service.

When you create an account we collect your email address and password (our authentication provider stores only a hash of it) or, if you sign in with Google or Microsoft, your name, email address and profile picture from that provider. We ask for your name. If you turn on two-factor authentication we store the secret needed to check your codes. We also record when and from where you sign in.

We use this to create and secure your account, sign you in, send you service messages, and tell a buyer account from a supplier account. Signing in with Google or Microsoft only gives us your basic profile; we do not read your mailbox, calendar or files.

Legal basis: performance of our contract with you (GDPR article 6(1)(b)), and our legitimate interest in keeping the service secure (article 6(1)(f)).

While you use the service we record what you do in it: searches and filters, results you click, profiles you open, contact details you reveal, messages you send to factories, saves, exports, shares, pages visited, and the page or site you came from (for example a Google search or an AI assistant). With it we record technical data: IP address, browser and device type, approximate country, and time.

We use this to run features that need it (your history, shortlists and recently viewed suppliers), to understand which searches and pages help buyers and to improve results, to detect abuse and rate-limit automated access, and to measure the service. Product analytics events are stored on our own systems; for signed-in users they are linked to the account. IP addresses are used to protect the service and kept in short-lived technical logs by us and our hosting providers.

Legal basis: contract for the features you use; legitimate interest in improving and securing the service. Google Analytics and Google Ads measurement run only with your consent (section 19).

As a buyer you can fill in a profile: name, role, company, website, location, what you sell, typical quantities, target markets and sourcing priorities. You can also create shortlists, saved searches, notes and comparisons, keep an outreach template, log which suppliers you contacted, and talk to the Spark assistant, which keeps a sourcing brief for each conversation.

We use this to personalise results and answers, to draft inquiries with your details, and to give you your work back when you return. Suppliers never see your profile. The emails you send to suppliers leave from your own mail program and contain what you chose to send.

Legal basis: contract.

If you claim or create a supplier profile we collect your details as the person managing it (name, email address, role, and whether your email domain matches the company website), the information you add to the profile, the colleagues you ask us to give access to, the requests you submit (claim, correction, removal, publication), the certificates, photos and documents you upload, and statistics about how buyers used the profile.

Profile content is published: it is visible to anyone, worldwide, and read by search engines and AI assistants. Certificates and documents you upload may be shown on the profile, so do not upload documents containing personal data you do not want public. The statistics we show you are aggregated and never identify a buyer.

Legal basis: contract; legitimate interest in checking that the person claiming a profile really represents the company (fraud prevention); and, for the published profile, the company's own decision to publish it.

Paid plans are billed by Dodo Payments as merchant of record. Dodo Payments collects your payment details (card, billing address, VAT number) on its checkout page and is the controller of that data under its own privacy policy. We receive and keep your name, email address, plan, status, billing period, amounts, invoice references, and events about the subscription (paid, failed, cancelled, resumed). We never see your full card number.

Legal basis: contract, and our legal obligation to keep accounting and tax records.

When you use the contact form, the claim, correction or removal forms, or write to us by email or WhatsApp, we keep your name, email address, company, message, attachments and our reply, so that we can answer you, act on the request, and keep a record of what was asked and done.

Messages to factories. When you send a message to a supplier through the message form on its profile, we store the message with your name, email address, company and country, the product, quantity and destination you entered, the time, and a technical reference to the page you sent it from. We send it to the supplier by email and show it to the people who manage the supplier's profile in their portal, so that they can reply to you directly; from then on the supplier is the controller of its copy. If you saw that supplier as a Priority result shortly before, we record that the message followed the placement, so that the supplier's report can count it; the report shows counts and never names you. Messages are kept for 13 months, then deleted or reduced to counts.

Legal basis: contract, and legitimate interest in handling requests and keeping records of them.

Service emails. We send emails about your account and security, receipts and billing, the status of claims and requests, Priority placement (live, renewal reminder, renewed, payment failed, ended, a place opened on a waitlist), messages buyers send through the message form, and, to the people who manage a claimed profile, a weekly report of what buyers did with it. You cannot opt out of essential account emails while you have an account. Tell us if you want the weekly summary to stop.

Marketing emails. We may email people who work at companies listed on SupplySpark about claiming the company's profile and about Sponsored placement, and account holders about new features. Every marketing email says who we are and has a link to opt out; opting out is free and immediate, and we keep your address on a list of people not to contact so that it stays that way.

Legal basis for marketing: our legitimate interest in promoting SupplySpark to businesses in the sector (article 6(1)(f)) and, where the law of your country requires it, your consent. Service and marketing emails are sent through email service providers acting on our instructions (section 15).

When you use the Spark assistant, ask it to draft an email, or use SupplySpark from inside Claude or ChatGPT, your request, the relevant supplier data and, for drafts, your buyer profile are sent to the AI model provider we use at that moment (currently OpenAI models, accessed through Lovable's AI gateway) to produce the answer. Those providers process the data to return the answer to us and, under the terms of the API services we use, do not use it to train their models.

When you use SupplySpark from inside Claude or ChatGPT, the assistant itself is run by Anthropic or OpenAI under their own terms and privacy policies. We receive the search it performs on your behalf, not your conversation.

Legal basis: contract.

You can use most of SupplySpark without an account. Until you accept analytics on the cookie card, we count visits with a visitor key computed from your IP address and browser type together with a secret and the current date: it changes every day, cannot be turned back into you, and is not a cookie. If you accept analytics, a random first-party cookie (ss_vid) remembers your browser for 13 months so that we can count returning buyers and tell sponsoring suppliers how many different buyers saw them, never who. Each browser tab also carries a random session id in its own storage for the length of your visit; it is needed to show, measure and audit the Sponsored listings on a page and is not a cookie. Every event records which of the two kinds of id it carried. We keep short technical logs with IP addresses for security and rate limiting.

Google Analytics and Google Ads measurement run only if you accept them (section 19).

SupplySpark is a directory built from public information. We collect what a company publishes about itself and what public records say about it, and put the result into one profile per company, with the source shown next to each fact. Companies are listed without signing up. A plain-English version of this part, with the ways to fix, claim or remove a listing, is at supplyspark.co/your-listing.

Most of a profile is company information. Some of it can be personal data: the name and job title of a contact person, a work email address such as name@company.com, a direct phone or WhatsApp number, a LinkedIn profile, or the name of an owner or director found in a business registry, a certificate or a customs record.

If that is you, this section is our notice to you under article 14 of the GDPR. Because contacting each person individually across tens of thousands of profiles would take disproportionate effort, we publish the notice here, as article 14(5)(b) allows, and we link to it in the emails we send to listed companies.

What we process. Your name, job title and role at the company; business contact details (work email, phone, WhatsApp, LinkedIn) as published by the company or by a directory; and your name where it appears in a registry, certificate or customs record as the company's representative.

Why. So that buyers can identify and contact the company, which is the purpose of a supplier directory; to verify companies; and to contact the company about its profile and our services. We do not use this information for anything unrelated to the company's business, and we do not build profiles of you as a person.

Legal basis. Our legitimate interest, and that of buyers, in a working B2B sourcing directory (article 6(1)(f)). We limit ourselves to professional contact information that the company or a public source has already made available for business contact, we do not process sensitive data, and we honour objections (section 14). In countries with their own rules, such as Turkey (KVKK) and China (PIPL), we apply additional filters, for example removing personal email addresses where the law requires it.

• company websites and online shops;
• official business and trade registries;
• membership lists of trade associations and chambers of commerce;
• the registries of certification bodies and sustainability standards;
• exhibitor lists of trade fairs;
• customs and shipment records, and the services that publish them;
• press, and public professional and social profiles;
• information the company itself submits when it claims its profile;
• AI tools that read those sources and summarise them for us.

Where we can, the profile shows the source next to the data it came from.

Use "Fix or remove a listing" at supplyspark.co/for-suppliers/claim (no account needed) or write to hello@supplyspark.co. We confirm by email.

• Correct. Tell us what is wrong about you and we fix it.
• Remove your details. Ask us to take your name, direct email address or phone number off a profile, or to stop using them, and we do it at once, without asking why. This is your right to object under article 21 of the GDPR, and we always honour it.
• Stop emails. Use the opt-out link in any email or reply "stop". We stop at once and keep your address only on a do-not-contact list.
• Remove the company. A company is not a person and has no GDPR rights, but it can still ask. We remove a listing when the company has closed or been sold, when it cannot be made accurate, or when the law requires it, and we consider every other request on its merits, normally within five working days (Terms, section on listings).

Removing a person's details never requires removing the company's listing, and the other way round: we can do one without the other.

We do not sell personal data. We share it with providers that process it on our instructions, with the exceptions noted below where a provider is a controller in its own right.

We also share data:

• with buyers, when you publish a supplier profile: it is public;
• with our professional advisers, and with a successor: if SupplySpark is incorporated, transferred or sold, the data moves to the new company under this policy;
• with authorities and courts when the law requires it, and to protect our rights, our users or the public.

Our database and search index are hosted in Ireland. Some providers process data in the United States or elsewhere. Where that happens we rely on the European Commission's adequacy decisions, including the EU-US Data Privacy Framework for certified providers, or on its Standard Contractual Clauses, with additional measures where needed. Public supplier profiles are visible worldwide by design.

Account data

For as long as your account exists. When you delete it in Account settings, your account, buyer profile, shortlists, saved searches, recently viewed suppliers and assistant conversations are deleted with it.

Billing records

For as long as tax and commercial law require, up to six years in Spain, even after you delete your account. The link to your account is removed.

Usage and analytics events

13 months of raw events, then deleted; daily totals that identify no one are kept. Events from automated traffic are deleted after 30 days.

Messages sent to factories through the message form

13 months, then deleted or reduced to counts. The supplier keeps its own copy under its own rules.

Forms, requests and support messages

Up to three years after the last exchange.

Supplier profile data

For as long as the company is listed. Personal details of an individual are removed on request.

Technical logs with IP addresses

A limited time, measured in weeks, unless needed for a security investigation.

Marketing opt-outs

Indefinitely, so that we do not email you again.

Connections are encrypted (TLS). Passwords are stored only as hashes. Staff with administrative access use two-factor authentication, and access is limited to the people who need it; our team and interns work under confidentiality obligations. Our providers hold recognised security certifications, and the database is backed up. If a breach affects your data we will inform you and the supervisory authority as the GDPR requires.

No system is perfectly secure. If you find a security issue, please write to hello@supplyspark.co.

Necessary cookies keep you signed in, remember your choices and store your cookie decision; they are always on because the service does not work without them. Google Analytics and Google Ads measurement are optional and run only after you accept them. Nothing from Google loads before that, and you can change your decision at any time with the button below or the "Cookie settings" link in the footer. We ask again every six months.

Without your consent our own product analytics set no cookie (section 11). Google runs in Consent Mode: it is told that analytics and advertising storage are denied until you say otherwise.

Under the GDPR you can:

• ask for a copy of the personal data we hold about you (access);
• have it corrected (rectification) or, in the cases the law provides, deleted (erasure);
• ask us to restrict how we use it, or receive it in a portable format;
• object to processing based on our legitimate interests, including your appearance in a supplier profile, and object to direct marketing at any time, which we always honour;
• withdraw consent you have given, for example for Google Analytics, without affecting what was done before.

You can do a lot yourself: edit or delete your account in Account settings, edit your buyer profile, manage a supplier profile in the portal, and change cookie settings here. For everything else, write to hello@supplyspark.co. We may ask you to confirm your identity. We answer within one month; if a request is complex we tell you and may take up to two more.

We do not make decisions with legal or similarly significant effects about you by automated means alone. Automated checks, such as matching your email domain to a company website, speed up supplier claims; when they fail, a person reviews the request.

SupplySpark is for businesses and their staff, and not for anyone under 18. We do not knowingly collect data from children; if you think we have, write to us and we will delete it.

We update this policy when the service or the law changes. For changes that matter to you we give notice by email or in the service before they take effect. The date at the top tells you when the current version started to apply.

Questions and requests about your personal data: hello@supplyspark.co. Postal address: see section 1.

If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or to the data protection authority of the EU country where you live or work.