Privacy Policy

Last updated: 14 July 2026

This policy explains how SocialSpark processes personal information in terms of the Protection of Personal Information Act, 4 of 2013 ("POPIA"). The responsible party is [your registered business name], South Africa. Information Officer contact: jean@aopay.io.

1. What we collect

• Account information: email address, password (stored only as a salted cryptographic hash), business name and business type.
• Content you upload: product photos, notes and prompts, and the captions and videos generated from them, saved to your history at your request.
• Usage information: counts of generations for enforcing plan limits.
• Billing information: your subscription plan and PayFast payment references. We never receive or store your card number. Payments are processed on PayFast's secure hosted page.

2. Why we process it

• To provide the service: generating captions, ideas and video ads from your content.
• To operate your account, enforce plan limits and process subscription billing.
• To communicate service and billing notices.
• We do not sell personal information, and we do not send marketing without consent.

3. Content generation and cross-border transfers (POPIA s72)

To generate content, your photos, notes and business details are transmitted to our content-generation providers, whose servers are located outside South Africa (primarily the United States):

• Anthropic (caption and idea generation): API inputs are not used to train Anthropic's models by default.
• fal.ai (video generation): photos are processed to render your video.

These providers are bound by contractual terms that provide an adequate level of protection as contemplated in section 72(1)(a) of POPIA. By using the generation features you consent to this transfer.

4. Photos of people

Product photos can incidentally include identifiable people. You are responsible for obtaining the consent of anyone appearing in photos you upload. Do not upload photos of children.

5. Cookies

We use one essential session cookie to keep you signed in. We do not use advertising or tracking cookies.

6. Retention and deletion

• Saved posts and videos are kept until you delete them or your account.
• You can delete individual posts/videos at any time, and you can delete your entire account on the Plan & billing page. This permanently erases your account, content, history and subscription records, and cancels any active subscription.
• Billing records may be retained where tax law requires.

7. Security

Traffic is encrypted in transit (HTTPS), passwords are stored as salted scrypt hashes, and data is hosted on access-controlled infrastructure in Frankfurt, Germany. No system is perfectly secure; we will notify you and the Information Regulator of any breach as required by POPIA section 22.

8. Your rights

You may request access to, correction of, or deletion of your personal information at jean@aopay.io. You may also lodge a complaint with the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za.

9. Changes

We will announce material changes to this policy by email or in-app notice. See also our Terms & Conditions.