Privacy Policy

Last updated: April 28, 2026

LumaSoft, LLC ("SparkWallet," "we," "us," or "our") operates the SparkWallet platform, including the website at sparkwallet.io and all related services, applications, and tools (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use our Services. By using the Services, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Services.

1. Information We Collect

1.1 Information You Provide Directly

• Account & Profile Data: Name, email address, phone number, date of birth, and any other information you provide when creating or updating your SparkWallet account.
• Identity Verification Data: Government-issued identification documents, photographs, and other information required to verify your identity in compliance with applicable laws and regulations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements.
• Financial & Transaction Data: Payment method details, transaction history, gift card purchases, virtual card activity, Bitcoin and Lightning Network addresses and balances, wallet deposits, and "Sparks Back" rewards balances.
• Communications Data: Messages, support tickets, feedback, and any other content you send to us or through our Services.
• Subscription Data: Information related to your subscription or membership status, billing cycle, and plan details processed through our subscription platform.

1.2 Information Collected Automatically

• Device & Browser Data: IP address, browser type and version, operating system, device identifiers, screen resolution, language preferences, and referring URLs.
• Usage Data: Pages visited, features used, click patterns, session duration, navigation paths, and interactions with our Services.
• Location Data: Approximate geographic location derived from your IP address.
• Log Data: Server logs recording access times, error logs, and system activity associated with your use of the Services.

1.3 Cookies and Tracking Technologies

We use cookies, pixels, web beacons, and similar tracking technologies to collect information about your interactions with our Services. These include:

• Essential Cookies: Session and authentication cookies (e.g., spark_wallet_access, spark_mfa_session) required for the Services to function properly, including login, security, and multi-factor authentication.
• Analytics Cookies: Cookies used by Vercel Analytics to measure site performance and usage patterns.
• Behavioral Analytics: Microsoft Clarity session recordings and heatmaps to understand how users interact with the Services. Clarity may record mouse movements, clicks, and scrolling behavior. Sensitive input fields are masked.
• Advertising & Conversion Cookies: Meta (Facebook) Pixel cookies (_fbp, _fbc) used to measure the effectiveness of advertising campaigns, deliver targeted advertisements, and track conversions via the Meta Conversions API. Hashed user data (such as email or phone number) may be transmitted to Meta for matching purposes.

You can manage cookie preferences through your browser settings. Disabling certain cookies may limit your ability to use some features of the Services. Please note that we honor Do Not Track (DNT) signals where technically feasible.

1.4 Information from Third Parties

We may receive information about you from third-party identity verification providers, payment processors, subscription management platforms, analytics services, advertising networks, and publicly available sources, which we combine with other data we hold about you.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Operate the Services: Process transactions, manage accounts, facilitate gift card purchases, virtual card issuance, Bitcoin/Lightning operations, and the "Sparks Back" rewards program.
• Identity Verification & Compliance: Verify your identity, comply with KYC/AML obligations, and satisfy legal and regulatory requirements.
• Security & Fraud Prevention: Detect, prevent, and investigate fraud, unauthorized access, and other illegal or harmful activities.
• Communications: Send transactional messages (confirmations, invoices, security alerts), respond to support requests, and deliver service-related announcements.
• Personalization & Improvement: Analyze usage patterns, conduct research, and improve the functionality, reliability, and user experience of the Services.
• Marketing & Advertising: With your consent where required, send promotional communications about SparkWallet products, features, and offers; measure advertising effectiveness; and deliver interest-based advertisements through platforms such as Meta.
• Subscription Management: Process subscription payments, manage membership tiers, and handle billing-related communications.
• Legal Obligations: Comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: We share data with trusted third-party vendors who perform services on our behalf, including cloud infrastructure (Google Firebase/Google Cloud), subscription processing (Whop), analytics (Vercel, Microsoft Clarity), advertising measurement (Meta), video hosting (Wistia), scheduling (Cal.com), and identity verification providers. These parties are contractually obligated to use your data only for the purposes we specify and to maintain appropriate security measures.
• Legal Compliance: We may disclose information if required to do so by law, regulation, subpoena, court order, or governmental request, or when we believe disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
• Business Transfers: In connection with any merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your information may be transferred as part of such a transaction as permitted by law and/or contract.
• Fraud Prevention: We may share information with law enforcement agencies, governmental authorities, or other third parties to detect and prevent fraud or other illegal activities.
• With Your Consent: We may share your information for other purposes with your express consent.

4. Data Retention

We retain your personal information for as long as your account is active, or as needed to provide you with the Services, comply with our legal obligations (including tax, accounting, and financial regulatory requirements), resolve disputes, and enforce our agreements. Transaction records and financial data may be retained for a minimum of seven (7) years or longer as required by applicable law. When your information is no longer needed, we will securely delete or anonymize it.

5. Data Security

We implement industry-standard technical, administrative, and physical safeguards designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL) and at rest, access controls, multi-factor authentication, regular security assessments, and secure infrastructure hosted on enterprise-grade cloud platforms. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

6. Your Rights and Choices

6.1 Account Information

You may update, correct, or delete your account information at any time by logging into your account or contacting us at support@sparkwallet.io. Please note that we may retain certain information as required by law or for legitimate business purposes, even after you request deletion.

6.2 Marketing Communications

You may opt out of receiving promotional communications by following the unsubscribe instructions in any marketing email or by contacting us. Even if you opt out of marketing emails, we will still send you transactional and service-related communications.

6.3 Cookies

Most web browsers are set to accept cookies by default. You can adjust your browser settings to remove or reject cookies. Please note that removing or rejecting cookies may affect the availability and functionality of the Services.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected the information, the business or commercial purposes for collecting or selling the information, and the categories of third parties with whom we share the information.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We may share personal information with advertising partners (e.g., Meta) for cross-context behavioral advertising. You have the right to opt out of this sharing.
• Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information, you may request that we limit its use to what is necessary to provide the Services.
• Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, contact us at support@sparkwallet.io. We will verify your identity before processing your request. An authorized agent may submit a request on your behalf with proper written authorization.

8. International Users and Data Transfers

The Services are operated from the United States. If you are accessing the Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate. By using the Services, you consent to the transfer of your information to the United States and other countries that may not have the same data protection laws as your jurisdiction. We take steps to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it, including through the use of standard contractual clauses and other appropriate safeguards.

9. European Economic Area (EEA) and UK Users

If you are located in the EEA or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR, including:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: Request that we limit the processing of your personal data.
• Right to Data Portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to our processing of your personal data for direct marketing purposes or based on legitimate interests.
• Right to Withdraw Consent: Where we rely on consent to process your data, you may withdraw that consent at any time.

Our legal bases for processing personal data include: performance of a contract (providing the Services), compliance with legal obligations, your consent, and our legitimate interests (such as fraud prevention and service improvement). To exercise your rights or lodge a complaint, contact us at support@sparkwallet.io. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe we have inadvertently collected information from a child under 18, please contact us at support@sparkwallet.io.

11. Third-Party Links and Services

The Services may contain links to third-party websites, applications, or services that are not owned or controlled by SparkWallet. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Services. We are not responsible for the privacy practices or content of such third parties.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on the Services with a new "Last updated" date and, where required by law, by providing additional notice (such as email notification). Your continued use of the Services after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: