Privacy, in plain language.

Who is responsible

Mohammad Tahir, trading as GameSpark Studio, is the data controller in the United Kingdom. Correspondence may be sent to 5 Brayford Square, London E1 0SG. GameSpark Studio is recorded as an other name on ICO registration ZC217525. For privacy questions or requests, email support@gamesparkstudio.co.uk.

Information the service may use

• Device-local information: game packs, preferences, scores, recent games and local recovery copies stored in your browser.
• Account information: authenticated user identifiers and email addresses used to protect owner-only or paid-access features.
• Order and access information: the selected plan, provider order reference, payment state, entitlement state and relevant timestamps. GameSpark does not intend to store full card details.
• Live-event information: room codes, player display names, team choices, responses, scores and host commands.
• Invited contributions: names, prompts, answers and permission confirmations submitted through a private CrowdSpark link.
• Client briefs: optional contact details and event information submitted through a private host-created link.
• Demo enquiries: the contact, organisation, event and message details you choose to submit, plus the campaign labels in the link you used.
• Aggregate funnel counts: daily totals for a demo-page view, first form interaction and saved enquiry, grouped by broad campaign labels and audience type. These counters do not store an IP address, cookie ID, device ID, full referrer or visitor profile.
• Support information: the content and contact details you choose to include in a support email.

Why it is used

Information is used to provide the feature requested, protect access, recover an interrupted event, respond to an enquiry or support request, measure whether the demo route works in aggregate, prevent misuse and maintain the service. The legal bases include steps requested before or performance of a contract with an adult purchaser and proportionate legitimate interests in operating, securing and improving the service. The demo checkbox permits GameSpark to use the submitted details to answer that specific request; it does not place the person on a general marketing list. A form’s content-use confirmation is not parental authorisation for a child under 13.

Where it is kept and who supports the service

Some information stays only on the device. Server features use managed hosting, authentication and database infrastructure. Stripe processes checkout and payment information; GameSpark stores only the order, plan, payment status, provider references, signed-in account link and relevant consent timestamps needed for fulfilment, support, refunds and records. GameSpark does not store full card details. Demo enquiries and aggregate funnel counts use GameSpark’s own hosted database and are visible only in the protected Owner Studio. No third-party advertising or behavioural-marketing analytics service is configured. Processor contracts and international-transfer safeguards are kept under review. Information is not sold.

How long it is kept

• Live-room access expires after about eight hours.
• Arcade event checkpoints expire after 48 hours.
• CrowdSpark collection links expire after seven days.
• Client-brief links expire after ten days.
• Demo enquiries expire after 12 months unless the information is required for a resulting customer relationship, dispute or legal record. Aggregate funnel counts do not contain contact details.
• Owner snapshots remain until the owner deletes them, subject to the product’s ten-copy limit.
• Device-local information remains until it is deleted in GameSpark or cleared from the browser.
• General support cases are scheduled for deletion or anonymisation 24 months after closure, with unnecessary child information removed earlier.
• Routine security records controlled by GameSpark are scheduled for 90 days; a documented incident case may be kept for 12 months after closure unless a narrower legal or safeguarding hold applies.
• Accounting records are kept for at least five years after the 31 January tax-return deadline for the relevant tax year.
• An owner-only central cleanup removes expired live-room, checkpoint, CrowdSpark, SparkBrief and demo-enquiry records while recording counts and timestamps rather than participant content.

Your choices and rights

You may ask for access, correction, deletion, restriction or a copy of relevant personal information, or object to particular use. Where use depends on consent, consent can be withdrawn. Rights depend on the circumstances and legal basis. Contact support first; you may also complain to the UK Information Commissioner’s Office.

Children and group play

GameSpark is treated as likely to be accessed by children. The Children’s Code protections therefore apply to everyone rather than asking participants for dates of birth or identity documents. An adult must control the host account, private links and any purchase. Children aged 0–5 should take part only beside an adult; ages 6–12 need adult help and supervision; ages 13–17 receive the same high-privacy defaults and plain explanations. Use a first name or nickname, avoid private or sensitive details, and skip any prompt you do not want to answer. Ask the adult host, read the Safe Play guidance or email support if you need help.

Security, cookies and changes

GameSpark uses access controls, short-lived private links, bounded inputs and recovery safeguards. Essential authentication or session technologies may be provided by the hosting service. The demo funnel uses first-party, cookieless aggregate counters and does not identify a visitor. There are no advertising cookies or third-party behavioural-marketing analytics. No solely automated decision produces legal or similarly significant effects. This notice is reviewed before any material new data use starts.

Product usage counters

We also count birthday-page loads, the first free birthday sample created per loaded page, and the first successful checkout response per loaded page across all plans. These are daily event totals, not unique visitors or confirmed payments. Only the event type, fixed page path and aggregate date/count information are recorded; names, game content, email addresses, full URLs, referrers and visitor identifiers are not sent with these events. We do not link the counters to individual orders or social accounts. Signed-in owner activity, local previews and browser Do Not Track or Global Privacy Control signals are excluded. You can exclude this tab from product measurement; this stores only an exclusion preference for the tab’s session, not a tracking identifier.