SocialSparks Studio – Privacy Policy

SocialSparks Studio (“SocialSparks”, “we”, “us”, “our”) is a digital services business founded and operated by Madison Bailey, based in South Africa. We provide Google review and reputation management, website development, and social media management to businesses in the United States, the United Kingdom, Canada and South Africa.

• Business name: SocialSparks Studio
• Privacy contact: contact@socialsparksstudio.com
• Information Officer (South Africa): Madison Bailey

This policy explains what personal information we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to our website, our consultations and free audits, and all services we provide.

We act in two different roles, and the rules differ for each.

As a controller (responsible party). For information about our own prospects, clients, website visitors and business contacts, we decide how and why the information is used.

As a processor (operator / service provider). When we run review requests, schedule posts, or manage websites for a client, we handle personal information about that client’s customers, followers and website visitors on the client’s instructions. In that case the client is the controller, and we process the information only to deliver the services. If you are a customer of one of our clients and want to exercise your rights, please contact that business first. You may also contact us and we will pass your request on.

3.1 From you directly

• Contact details: name, business name, email address, phone number, website and social media handles.
• Business details: services offered, brand preferences, goals, target audience, logins or access you grant us (for example to Google Business Profile, social accounts, domains or hosting).
• Content you supply: raw video footage, photos, logos, text, testimonials and other brand material.
• Consultation information: what you tell us in meetings and forms, and recordings or notes where you agree to them.
• Billing information: invoice details, payment references and your country. We do not store full card numbers. Payments are handled by the providers in section 6.
• Communications: emails, messages and support requests.

3.2 From public sources

Before or after you contact us, we may review publicly available information about your business to prepare a free audit or to identify prospective clients. Sources include Google Search, Google Maps and Google Business Profiles, Yelp, Trustpilot, B2B lead-finder tools, and public Instagram, Facebook, TikTok and YouTube pages. This may include business names, addresses, business phone numbers and emails, review text, star ratings, reviewer display names, and public posts. We use this information only for audits, outreach to businesses, and delivering the services you request.

3.3 About our clients’ customers

When a client authorises us to send review requests, we process the names and contact details (email and/or phone) of that client’s customers, along with the date of service and whether they responded, opted out, or left a review. We receive this from the client or from the client’s GoHighLevel account.

3.4 Automatically

• Our website and client websites we build may collect IP address, device and browser type, pages viewed and referral source through cookies and similar technologies (see section 9).
• Our business platforms log activity such as email opens, link clicks and form submissions.

3.5 Sensitive information

We do not seek sensitive personal information (such as health, financial account, government ID or children’s data). Please do not send it to us. If it appears in material you give us, tell us and we will handle it appropriately or delete it.

We do not sell personal information, and we do not use it to make decisions with legal or similarly significant effects through solely automated means.

We send review requests only for clients who have confirmed that their customers have agreed to be contacted, or where the law otherwise allows it. Every review request includes a simple way to opt out, and we honour opt-outs promptly across our systems. Clients are responsible for having a lawful basis and any required consent to share their customers’ details with us.

We send review requests to all eligible customers in the same way. We do not filter, hide or discourage negative feedback, we do not offer incentives in exchange for positive reviews, and we do not write or post fake reviews. We follow the review policies of Google, Trustpilot and Yelp.

Text messages and emails are sent in line with applicable rules, including the TCPA and CAN-SPAM (US), CASL (Canada), PECR and UK GDPR (UK), and POPIA and the Consumer Protection Act (South Africa). You can reply STOP to a text or use the unsubscribe link in an email at any time.

We share information only with service providers and others needed to run our business, under appropriate confidentiality and data protection terms where available. These include:

• GoHighLevel – CRM, scheduling, email and SMS, review requests, social post scheduling, funnels and some domains.
• Lovable – website building and, after launch, hosting.
• GitHub and Vercel – code storage and temporary website hosting during development.
• Namecheap – domain registration.
• Loom – screen-recorded audit videos, which are also emailed to you.
• Canva – editing images and video for social media.
• Social platforms (Instagram, Facebook, TikTok, YouTube) and Google – publishing your content and managing your review profiles with the access you grant.
• Trustpilot – where we register our own business profile, and where you ask us to help with your profile.
• Payment providers – PayPal, Payoneer, Wise, and our bank (FNB, South Africa) – processing payments in US dollars.
• Professional advisers – accountants, lawyers and insurers.
• Authorities – where the law requires, or to protect rights, safety and property.
• Business transfers – if we sell or restructure the business, information may transfer to the new owner, who must honour this policy.

Our team. Madison Bailey and Charlain Bailey handles initial onboarding and set-up personally. As we grow, remote team members who work for us on a part-time or contract basis may manage ongoing work for the clients assigned to them, and so may access client and customer information needed for that work. They are bound by confidentiality and data protection obligations, are given access only to their assigned clients’ accounts, and are supervised by us, including by an operations lead once appointed. They may be located in other countries, so section 7 applies to their access. We remain responsible for how they handle personal information.

Client websites and social posts are public by design. Anything you ask us to publish may be seen by anyone.

We are based in South Africa, and our providers operate in the United States and other countries. Your information is therefore transferred and stored outside the country where you live. Where required, we rely on safeguards such as the EU/UK Standard Contractual Clauses and the UK International Data Transfer Addendum, the UK extension to the EU–US Data Privacy Framework where a provider is certified, or your consent. South Africa has its own comprehensive data protection law (POPIA), which also requires adequate protection for transfers. You can ask us for details of the safeguards we use.

• Client project files and account information: for the life of the engagement and up to 12 months afterwards, unless you ask us to delete earlier.
• Invoices and payment records: 3–5 years, to meet tax and accounting requirements.
• Enquiries and prospect details: up to 12 months from last contact.
• Review-request contact data: only as long as needed to run the campaign, and no longer than 12 months after the last request, unless the client instructs otherwise. Opt-out records are kept permanently so we do not contact you again.
• Audit videos: 12 months, unless you become a client.

When information is no longer needed, we delete or anonymise it. When an engagement ends, we will return or delete client access credentials and materials on request.

Our website and the websites we build may use cookies and similar technologies for essential functions, analytics, and (if you choose to enable them) marketing. Where the law requires, we ask for consent before setting non-essential cookies, and you can change your choice at any time through the cookie banner or your browser settings. Client websites carry the client’s own cookie and privacy notices, which the client is responsible for approving.

We use reasonable technical and organisational measures, including access controls, two-factor authentication where available, encrypted connections, and limiting access to those who need it. No system is completely secure. If a breach affects your personal information, we will notify you and the relevant regulator within the time the law requires (for example, 72 hours to the regulator under GDPR and UK GDPR, and as soon as reasonably possible under POPIA).

Depending on where you live, you may have the right to:

• know what information we hold about you and get a copy;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing, including direct marketing;
• receive your information in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• opt out of the sale or sharing of personal information and of targeted advertising (we do neither);
• not be discriminated against for exercising your rights;
• complain to a regulator.

To use any of these rights, email contact@socialsparksstudio.com. We will verify your identity and respond within the time the law allows (generally one month, or 45 days in some US states).

Regulators you may contact

• UK: Information Commissioner’s Office (ico.org.uk)
• EU/EEA: your local data protection authority
• Canada: Office of the Privacy Commissioner of Canada and your provincial regulator
• South Africa: Information Regulator (inforegulator.org.za)
• US: your state attorney general (for example, California Privacy Protection Agency)

Region notes

• California and other US states: we do not sell or share personal information for cross-context behavioural advertising. We collect the categories listed in section 3 and disclose them to the categories of recipients in section 6 for business purposes.
• EU/UK: see sections 4 and 7 for legal bases and transfers.
• Canada: we handle information in line with PIPEDA and, where applicable, Quebec’s Law 25 and Alberta and British Columbia privacy laws.
• South Africa: we process personal information in line with POPIA and our Information Officer is registered, or will be registered, with the Information Regulator.

We show completed work and link to client websites only with the client’s written permission, which can be withdrawn at any time by emailing us. We will remove the work from our materials within a reasonable time, though we cannot recall copies already shared or cached elsewhere.

Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect information from children. If you believe we have, contact us and we will delete it.

Our materials and audits may link to third-party websites and platforms. We are not responsible for their privacy practices. Please read their policies.

We may update this policy from time to time. We will post the new version with a new date and, for material changes, notify you by email or on our website.

SocialSparks Studio
Attention: Madison Bailey, Information Officer
Email: contact@socialsparksstudio.com