This policy applies to users of the DemandSpark website and platform (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy. We are committed to UK GDPR and GDPR compliance and to protecting your data rights.
1. Introduction
FluentForward Limited ("FluentForward", "we", "us", or "our") operates DemandSpark. We are committed to protecting the privacy and security of your personal information. This Privacy Policy describes:
- What information we collect and why
- How we use, store, and protect that information
- Your rights regarding your personal data
- How to contact us with privacy-related questions
This policy applies to personal data processed through our marketing website (demandspark.ai) and our software platform, including DemandSpark Studio (studio.demandspark.ai) and related Sparks, embeds, and integrations (together, the "Service").
2. Data Controller
FluentForward Limited is the data controller responsible for your personal information as an account holder, website visitor, or marketing contact. Our details are:
- Company: FluentForward Limited
- Company number: 07965202
- Registered office: North View, Farrington Road, Paulton, Bristol, BS39 7LP, United Kingdom
- Email: privacy@demandspark.ai
Important: When you use DemandSpark to run Sparks for your own prospects and customers, you remain the data controller for that Customer Data. We act as your data processor and process it only on your instructions and under applicable data processing terms. See section 3.2.
For data protection queries, contact us at privacy@demandspark.ai.
3. What Data We Collect
We collect different types of information depending on how you interact with us.
3.1 Account & profile information
When you create a DemandSpark account or start a trial, we collect:
- Name and email address
- Company or organisation name
- Job title or role (if provided)
- Phone number (optional)
- Password (encrypted; never stored in plain text)
- Billing and subscription details where applicable
3.2 Customer Data (your prospects and leads)
When you use the Service, we process data you or your prospects provide through Sparks and related features, which may include:
- Prospect identity and contact details submitted during a Spark
- Conversation content, answers, assessments, and living results
- Scores, context summaries, tags, and recommended next actions
- Engagement history (revisits, interrogation, updates, content interactions)
- Data synced to or from connected CRMs and marketing tools (for example HubSpot, Salesforce, Pipedrive, ActiveCampaign, or Mailchimp)
You remain the data controller for all Customer Data. We process this data only on your instructions and in accordance with our data processing terms. We never sell Customer Data, and we never use Customer Data to train foundation or general-purpose AI models for other customers.
3.3 Usage information
We automatically collect information about how you use the Service:
- Features and pages accessed in Studio and on Sparks you manage
- Configuration and publish activity for Sparks
- Integration usage patterns
- Error logs and performance data
3.4 Technical information
We collect technical data necessary to provide and secure the Service:
- IP address and browser type
- Device information and operating system
- Referring website and navigation path
- Connection information and service logs
3.5 Marketing & communications
If you engage with our marketing or book a demo:
- Email addresses and details submitted for updates, trials, or demos
- Communication preferences
- Responses to surveys or feedback requests
- Scheduling details for demo calls
4. How We Collect Data
4.1 Information you provide
We collect data you directly provide when you:
- Create an account, start a trial, or update your profile
- Build, configure, or publish Sparks
- Connect CRM or marketing integrations
- Contact support or book a demo
- Complete forms on our website
4.2 Automated collection
We automatically collect data through cookies and similar technologies, server logs, application analytics, and APIs when you connect external systems.
4.3 Third-party sources
We may receive data from CRM and marketing platforms you authorise, payment processors (for billing), and scheduling tools used for demos.
5. How We Use Your Data
| Purpose | Data used |
|---|---|
| Provide the Service | Account information, Customer Data, usage information, technical data |
| Process payments | Billing information, payment details, subscription tier |
| Customer support | Account information, usage data, support communications |
| Improve the Service | Usage patterns, feature adoption, anonymised analytics |
| Security & fraud prevention | Technical data, access logs, authentication information |
| Communications | Email address, communication preferences, account status |
| Legal compliance | All data as required by law or legal process |
What we don't do
- Never sell your data — we do not sell, rent, or trade personal information to third parties
- Never use Customer Data to train general-purpose AI models for other customers
- No third-party advertising networks built on your DemandSpark data
6. Legal Basis for Processing (UK GDPR / GDPR)
We must have a lawful basis for processing personal data. We rely on the following:
6.1 Contract performance
Processing necessary to provide the Service you have subscribed to — including account management, Sparks, integrations, and support.
6.2 Legitimate interests
Processing necessary for our legitimate business interests, such as improving the Service, security and fraud prevention, understanding product usage, and internal operations — balanced against your rights and expectations.
6.3 Legal obligation
Processing required to comply with legal obligations, including tax and accounting requirements and lawful requests from authorities.
6.4 Consent
Where we rely on consent (for example certain marketing communications), you can withdraw it at any time.
8. Data Retention
8.1 Active subscriptions
We retain your personal data and Customer Data for as long as your account is active and you are using the Service.
8.2 After cancellation
- Grace period: after cancellation, you typically have 90 days to export Customer Data
- Permanent deletion: after the grace period, Customer Data is permanently deleted from active systems, subject to backups that expire on a rolling schedule
- Account information: basic account and billing records may be retained for up to 7 years for legal and accounting purposes
8.3 Legal requirements
Some records must be retained longer where required by law — for example financial records (typically 7 years under UK tax rules) and audit or security logs as needed for compliance.
9. Data Security
We implement technical and organisational measures appropriate to the risk, including:
- Encryption in transit (TLS) and encryption at rest for stored data
- Access controls, authentication, and least-privilege practices
- Network and application security controls
- Staff awareness of data protection obligations
- Incident response procedures
In the event of a personal data breach affecting your data, we will notify you and the relevant supervisory authority as required by law, take steps to contain and remedy the incident, and provide clear information about what happened and any steps you should take.
10. Your Data Protection Rights
Under UK GDPR and GDPR, you have the following rights (subject to legal limits):
- Access — request a copy of personal data we hold about you
- Rectification — correct inaccurate personal data
- Erasure — request deletion where applicable
- Restriction — limit how we use your data in certain circumstances
- Portability — receive Customer Data you provided in a structured, machine-readable format where applicable
- Objection — object to processing based on legitimate interests or for direct marketing
- Withdraw consent — where we rely on consent, withdraw it at any time
- Complain — lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority
To exercise these rights, contact privacy@demandspark.ai. We will respond within one month (extendable where permitted by law).
If you are a prospect who completed a Spark on behalf of one of our customers, please contact that organisation first — they are the controller of your Customer Data. We will assist them in responding to your request.
12. International Data Transfers
Your data is primarily processed in the UK and/or EEA. If we transfer personal data outside the UK/EEA, we ensure appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms required by UK GDPR / GDPR.
13. Children's Privacy
The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected such data in error, contact privacy@demandspark.ai and we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will update the "Last updated" date at the top of this page and, for material changes, provide additional notice (for example by email or a notice in the Service) where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the updated policy where permitted by law.
15. Contact Us
For privacy-related questions, concerns, or to exercise your data protection rights:
- Privacy / data protection: privacy@demandspark.ai
- General inquiries: hello@demandspark.ai
Postal address: FluentForward Limited, North View, Farrington Road, Paulton, Bristol, BS39 7LP, United Kingdom.
UK supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk — 0303 123 1113.