Privacy Policy

Sparkleflo (“Sparkleflo”, “we”, “us”) is an AI marketing platform for jewellery retailers, operated by [[Starla Jewels LLP]], [[Metro Pillar C1618, as Kathiawar Stores, Same side, 8, Rd Number 36, Jawahar Colony, Jubilee Hills G1, 36 Pinnacle, Hyderabad, Telangana 500033]]. This policy explains what personal data we process when you use sparkleflo.com and the Sparkleflo studio, why, and the choices you have.

Sparkleflo is used by businesses (“organisations”). For the product, catalog and marketing content an organisation uploads, that organisation decides what is processed and we act on its instructions as its processor. For account, sign-in, billing and security data we act as the controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).

• Account details — your name, work email address and role in your organisation. If you sign in with Google we receive your name, email address and Google account identifier; we do not receive your Google password or access to your Google data.
• Password — if you sign in with email and password, we store only a salted one-way hash (scrypt), never the password itself.
• Organisation and billing details — organisation name, country, legal name, registered address, tax registration (GSTIN or the equivalent in your country), subscription tier, invoices and token-pack purchases. Card and bank details are entered with our payment providers and are not stored by Sparkleflo.
• Content you upload or connect — product photos, catalog data (SKUs, specifications, prices), brand kit, and captions and images generated from them. Catalog data may also arrive from systems your organisation connects, such as Shopify or its own ERP/POS.
• Security and audit records — sign-in rate-limit counters (stored as a one-way hash of IP address and email), and an audit log of team changes, organisation administration and support-access sessions.
• Performance data — campaign metrics and store footfall events your organisation sends to Sparkleflo.

Model personas in Sparkleflo are fictional, AI-generated composite people. Sparkleflo is not designed to process photographs of real individuals as models, and organisations must not upload them for that purpose.

• To create and secure your account, sign you in and enforce your organisation’s roles and permissions.
• To generate, check, store and publish the marketing images, videos and captions your organisation requests.
• To bill your organisation, meter token usage and issue invoices.
• To prevent abuse (for example, limiting repeated failed sign-ins) and to investigate security incidents.
• To provide support. Sparkleflo staff can enter an organisation’s workspace only through a time-limited support session that records a reason and is visible in that organisation’s audit log.

We do not sell personal data, and we do not use your organisation’s content to advertise to anyone else.

We use the following categories of providers, only to run the service:

• Hosting and storage — application hosting (Vercel), database (Neon Postgres) and media storage (Amazon Web Services S3).
• Sign-in — Google, when you choose “Continue with Google”.
• AI generation and checking — product photos and prompts are sent to the AI provider selected for each render and to the visual fidelity check. Depending on your organisation’s settings these include Anthropic, Google (Gemini), OpenAI, Pollinations, Replicate and Stability AI. Where your organisation supplies its own API key for a provider, that provider processes the data under your organisation’s own account.
• Payments — Razorpay and Stripe, for subscription and token-pack payments.
• Publishing destinations — the channels and catalog systems your organisation connects and approves publishing to.

Some of these providers process data outside your country, including in the United States. We rely on their contractual and security commitments for those transfers. We may also disclose data where required by law.

We use only the cookies needed to run the service: a signed, HTTP-only session cookie that keeps you signed in (up to 14 days), and a short-lived cookie (up to 15 minutes) used only while completing a Google sign-in. We do not use advertising or cross-site tracking cookies.

Account and content data are kept while your organisation’s subscription is active. An organisation admin can delete products, runs and generated assets at any time, and can disable user accounts. Invoices and tax records are kept for as long as the law requires. After an organisation closes its account we delete or anonymise its data within [[90 days]], except where we must keep it by law.

Data is encrypted in transit (HTTPS). Each organisation’s data is stored in its own partitioned space, access inside an organisation is limited by role, and passwords are stored only as salted hashes. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

Depending on where you live, you can ask to access, correct or delete your personal data, withdraw consent, or nominate someone to act for you. Because most Sparkleflo data belongs to your organisation, please first ask your organisation admin; you can also contact us directly. You may complain to your data protection authority (in India, the Data Protection Board of India).

Privacy questions and grievances: [[Sashi Somavarapu]], [[info@starlajewels.com]]. We aim to respond within [[15 days]].

We will post any changes to this policy on this page and update the date above. See also our Terms of Service.