Privacy Policy

Certainly Stuff Ltd, trading as Wildfire is the data controller for personal data processed through Spark. We connect brands with gaming and entertainment community publishers to deliver campaign activations.

Contact: privacy@getwildfire.gg

Account data (all users)

• Name, email address
• Password (hashed, never stored in plain text, managed by Auth0)
• Role assignment (Wildfire Admin, Brand Admin, Community Manager)
• Organisation membership
• Login timestamps and session data

Brand Admin data

• Brand name and logo
• Campaign performance metrics (impressions, clicks, engagement)
• Content assets submitted for campaigns
• Communication history within Spark (chat messages)

Community Manager data

• Community name, platform, and links
• Audience size and geographic distribution (aggregated, not individual member data)
• Content categories and subcategories
• Manager contact details (name, email, phone)
• Earnings and deal information
• Post submissions, URLs, screenshots
• Campaign metrics submitted

What we do NOT collect

• Individual community member personal data
• Discord server member lists or private messages
• Social media passwords or login credentials
• Full payment card details (handled by payment providers such as Stripe and not stored in Spark)

We use your personal data to:

• Provide and operate the Spark platform
• Match communities with relevant brand campaigns
• Process campaign payments and earnings
• Send notifications about campaign activity (in-app, email, SMS, based on your preferences)
• Generate campaign performance reports
• Ensure platform security and prevent fraud
• Comply with legal obligations

We never sell your personal data to third parties.

We share your data only with:

• Auth0 - Authentication and identity management
• Stripe - Payment processing (Brand Admins and Community Managers)
• PayPal - Payout processing when selected for a community
• Xero - Invoice and accounts receivable syncing
• Dub - Link tracking and click analytics
• Vercel - Platform hosting and deployment
• AWS - Backend application and database infrastructure
• PostgreSQL - Database hosting (encrypted at rest)

We do not share your data with advertisers, data brokers, or any other third parties for marketing purposes.

• Active accounts: Data retained while your account is active
• Deleted accounts: Personal data deleted within 30 days of account deletion request. Anonymised campaign metrics may be retained for reporting.
• Campaign data: Retained for the duration of the campaign plus 12 months for reporting and compliance
• Chat messages: Retained for 24 months, then archived

Under GDPR (EU/UK) and CCPA (California), you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format (JSON/CSV)
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent

To exercise any of these rights, email privacy@getwildfire.gg or use the "Delete Account" / "Export Data" controls in your Spark profile.

We will respond to your request within 30 days.

We protect your data with:

• Encryption in transit: All data transmitted over HTTPS/TLS
• Encryption at rest: Database storage encrypted
• Authentication: Managed by Auth0 with industry-standard security
• Role-based access control: Three-tier permission system ensures users only see data relevant to their role
• Cross-tenant isolation: Brand Admins cannot see other brands' data; Community Managers cannot see other communities' data
• Financial data protection: Campaign budgets, CPM rates, and management fees are hidden from Brand Admin users
• Audit logging: Security-relevant actions are tracked

Your data may be processed in:

• United Kingdom (primary)
• United Kingdom / European Economic Area (core application and database infrastructure)
• United States (Auth0, Vercel, Stripe, PayPal, and other enabled service providers)

Where data is transferred outside the UK/EU, we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent).

Spark uses essential cookies only:

• Authentication cookies: To keep you logged in (Auth0 session)
• Preference cookies: To remember your notification settings

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

Spark is a business platform not intended for use by anyone under 18. We do not knowingly collect data from minors.

If you are a California resident, you have additional rights:

• Right to know: What personal data we collect and how we use it
• Right to delete: Request deletion of your personal data
• Right to opt-out of sale: We do not sell personal data
• Non-discrimination: We will not discriminate against you for exercising your rights

In the event of a data breach affecting your personal data, we will:

• Notify the relevant supervisory authority within 72 hours
• Notify affected users without undue delay
• Document the breach and actions taken

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of Spark after changes constitutes acceptance.

For privacy-related questions or to exercise your rights:

Email: privacy@getwildfire.gg
Address: Certainly Stuff Ltd, trading as Wildfire, Old Pockford Vann Lane, Chiddingfold, Surrey, GU8 4XU

For complaints, you may also contact:

• UK: Information Commissioner's Office (ICO) - ico.org.uk
• EU: Your local Data Protection Authority
• US/California: California Attorney General - oag.ca.gov