At SparkleCharge (sparklecharge.org), operated by Lead Engineer & Architect Abdulsamad Usman, privacy and defensive data stewardship are foundational to our engineering practice. This Privacy Policy explains in clear, transparent terms what data we collect, why we collect it, where and how it is stored, and how you can exercise your privacy rights.
1. What Data We Collect
We collect only the information necessary to deliver software engineering services, operate the SparkleCharge Client Portal, and protect our infrastructure:
- Identity & Contact Data: Your full name, email address, phone number (optional), company or organization name, and job title when you submit our Contact form, Hire Me / Project Inquiry form, or register for the Client Portal.
- Project & Contractual Data: Project scopes, technical requirements, budgets, target timelines, proposals, milestone updates, invoices, payment proof submissions, and official receipts associated with your engagements.
- Client Portal Activity: Login timestamps, session identifiers, password reset tokens, project request submissions, direct messages exchanged with our team, notification read states, and file download logs within the Client Portal.
- Technical & Security Telemetry: IP address (hashed for privacy in public analytics and consent logs), browser user-agent string, device type (desktop, mobile, tablet), referrer URL, pages visited, time spent on pages, and security audit logs (such as failed login attempts or rate-limit triggers).
- Blog & Community Interactions: Name, email address, comment text, and optional website URL when you submit a comment on the SparkleCharge Engineering Blog, or your email address if you opt into our newsletter.
2. Why We Collect Your Data (Legal Bases & Purposes)
We process personal data strictly for legitimate, clearly defined purposes:
- Service Delivery & Contract Performance: Creating and managing your Client Portal account, tracking project milestones, sharing deliverables, issuing invoices, verifying payment proofs, and generating verifiable receipts.
- Direct Communication: Responding to contact messages and project inquiries, sending transactional notifications (such as project updates, new file alerts, invoice notices, and password resets), and providing technical support.
- Infrastructure Security & Fraud Prevention: Protecting SparkleCharge and our clients against unauthorized access, brute-force authentication attacks, Cross-Site Request Forgery (CSRF), SQL injection, and abuse of live demo sandboxes.
- Legal, Tax & Accounting Compliance: Maintaining accurate financial records, invoices, receipts, and audit trails as required by applicable commercial and tax laws.
- Site Improvement (With Consent): Understanding aggregate page performance and visitor navigation patterns via our first-party, self-hosted analytics engine when optional analytics cookies are enabled.
3. Where Your Data Is Stored & Security Architecture
- Self-Hosted Server Infrastructure: All primary application databases, client portal records, messages, and first-party analytics logs are stored directly on SparkleCharge's hardened, self-hosted server infrastructure.
- No Third-Party Analytics by Default: SparkleCharge does not load Google Analytics, Meta Pixel, or third-party behavioral advertising trackers by default. Traffic telemetry is processed in-house on our own database.
- Defense-in-Depth Controls: All database queries use strict PDO prepared statements; passwords are hashed using modern cryptographic algorithms (
bcrypt/Argon2); sensitive API credentials are encrypted using AES-256-CBC; and all transport occurs over TLS/HTTPS.
4. Data Retention Periods
We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:
- Client Portal & Project Records: Retained for the duration of our active business relationship plus up to 7 years for contractual, tax, and financial audit compliance, unless you request earlier deletion of non-mandatory records.
- Contact & Project Inquiries (Non-Client): Retained for up to 24 months from the last interaction to allow follow-up on prospective engagements.
- Security & Audit Logs: Retained for 12 months to support incident forensics and security monitoring.
- First-Party Traffic & Visitor Consent Logs: Anonymized/hashed traffic logs and cookie consent records (`visitor_consents`) are retained for 12 months.
5. Cookies & Consent Preferences
We use essential cookies to keep the site running (such as session authentication, CSRF security tokens, and your `sparkle_consent` privacy preference cookie) and optional cookies (first-party analytics and marketing preferences) only according to your choices. Your consent choice is stored for 12 months and can be modified at any time via the Cookie Settings panel or our dedicated Cookie Policy.
6. Third-Party Services & Subprocessors
We do not sell, rent, or trade your personal data. We rely only on a minimal set of trusted infrastructure providers where strictly necessary:
- Cloudflare: Provides DNS resolution, DDoS mitigation, Web Application Firewall (WAF) protection, and edge TLS termination to keep sparklecharge.org secure and performant.
- Self-Hosted Email Delivery (`mail.sparklecharge.org`): Outbound transactional and notification emails are dispatched directly through our own authenticated mail server using SPF, DKIM, and DMARC—not third-party marketing relays.
- Google Drive (Client File Sharing): When delivering large project assets, source archives, or design deliverables through the Client Portal, files may be shared via restricted, access-controlled Google Drive links assigned specifically to your project.
7. Your Privacy Rights (Access, Correction, Deletion & Export)
Regardless of your location, SparkleCharge extends comprehensive data subject rights to all users and clients:
- Right of Access & Data Export (Portability): Request a complete copy of the personal and project data we hold about you in a structured, machine-readable format.
- Right to Rectification (Correction): Update inaccurate or incomplete profile details directly in your Client Portal or by contacting us.
- Right to Erasure (Deletion): Request permanent deletion of your personal data and account records, subject only to mandatory legal/financial retention obligations.
- Right to Withdraw Consent & Restrict Processing: Opt out of non-essential cookies, newsletters, or optional email categories at any time using the one-click Preferences or Unsubscribe links in our emails.
8. International Privacy Compliance (GDPR, CCPA/CPRA & LGPD)
- GDPR & UK GDPR (European Economic Area & United Kingdom): SparkleCharge acts as the Data Controller for personal data collected through this website. Processing is conducted under GDPR Article 6(1)(b) (performance of a contract), Article 6(1)(c) (legal obligation), Article 6(1)(f) (legitimate security interests), and Article 6(1)(a) (explicit consent for optional cookies/newsletters).
- CCPA / CPRA (California Residents): We do not "sell" or "share" personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act and California Privacy Rights Act. California residents have the right to know, delete, correct, and limit the use of sensitive personal information without discrimination.
- LGPD (Brazil — Lei Geral de Proteção de Dados): In accordance with Law No. 13.709/2018 (LGPD), Brazilian users have the right to confirmation of processing, access, correction, anonymization, portability, and revocation of consent.
9. Contact for Privacy Requests
To exercise any of your privacy rights, submit a data access/deletion request, or ask questions about our privacy practices, please contact our Data Protection Lead:
- Email: [email protected]
- Data Controller: SparkleCharge (Abdulsamad Usman)
- Response Timeframe: All verified privacy requests are acknowledged within 72 hours and fulfilled within 30 days.