Privacy policy · Social Creator Club

1.Who is responsible for your data

Social Spark Marketing LTD (company number 16667527), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, trading as Social Creator Club, is the data controller. Contact us about anything on this page at hello@thesocialspark.co.uk.

We are not required to appoint a Data Protection Officer, and have not. Your questions go to a real person at the address above.

2.What we collect and why

Data	Why	Lawful basis	How long
Email address and name (free guide)	To send you the guide and, if you agreed, occasional creator tips	Contract (sending what you asked for); consent (marketing)	Until you unsubscribe, then a suppression record indefinitely so we do not email you again
Account details — email, password (hashed by Firebase), age confirmation	To create and secure your creator account	Contract	While your account is open, then 12 months
Profile — name, location, niches, rates, availability, equipment, social handles	To show brands who you are and match you to briefs	Contract	While your account is open
Portfolio and submitted work (images, video)	To evidence your work to brands and to deliver booked jobs	Contract	While on your profile; delivered job assets per the job’s retention period
Purchase records — course, amount, Stripe reference, progress	To give you access, issue receipts, handle refunds and meet tax obligations	Contract; legal obligation	6 years (HMRC record-keeping)
Payout account status (Stripe connected-account id only)	To pay you for booked work	Contract	While your account is open, then 6 years for financial records
Community posts, comments and reports	To run the community and keep it safe	Contract; legitimate interests (safety and moderation)	While posted; moderation records 2 years
Email delivery records (subject, status, timestamps)	To prove what we sent you and retry failed deliveries	Legitimate interests (service reliability and audit)	2 years

We do not collect special-category data, we do not knowingly collect data about anyone under 18, and we do not do automated decision-making that produces legal effects for you.

3.Payment data

We never see your card number. Payments and payouts run through Stripe, which is the controller of your payment data and holds it under its own privacy policy. We store only a reference to the transaction and, for payouts, the identifier of your connected Stripe account.

4.Who we share it with

We share data only with the suppliers that run the service, and only for that purpose:

Google (Firebase) — authentication and database. Data held in the EU/UK region.
Cloudflare — hosting, media storage (R2) and network security.
Stripe — payments and creator payouts.
Resend — transactional and marketing email delivery.
Brands who book you — your profile, portfolio and the work you deliver. Your contact details are not released to a brand before a booking.
Social Spark Portal — our own staff system. Booking and delivery data is synced to it so jobs can be run and paid.

Some suppliers process data outside the UK. Where they do, transfers are covered by UK adequacy regulations or by the International Data Transfer Addendum to the EU Standard Contractual Clauses.

We do not sell your data, and we do not share it with advertising networks.

5.Analytics and cookies

We use privacy-conscious product analytics to understand which pages are useful and where people get stuck. We deliberately do not put personal data — names, email addresses, profile content — into analytics payloads.

What is set, and how to refuse it, is in our cookie notice.

6.Your rights

Under UK GDPR you can ask us to:

give you a copy of your data (access);
correct anything wrong (rectification);
delete it (erasure), where we do not need it for a legal reason such as tax records;
restrict or object to how we use it;
send it to you or another service in a portable format;
withdraw consent to marketing — instantly, using the unsubscribe link in any email.

Email hello@thesocialspark.co.uk and we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.

7.How we protect it

Traffic is encrypted in transit. Passwords are hashed by Firebase Authentication and are never visible to us. Your uploaded media sits in private storage and is served only through short-lived signed links — there are no public URLs to your portfolio. Access to production data is limited to staff who need it.

If a breach ever affects your rights we will tell the ICO within 72 hours and tell you without undue delay.

8.Changes to this policy

We will update this page when what we do changes, and update the version and date at the top. If a change materially affects you, we will tell you directly rather than relying on you re-reading this page.