Privacy Policy
Last updated: 2 September 2026
Who we are
SparkPlay AI is operated by BXP Ltd, a company registered in England and Wales (company number 15126467), registered office 124 City Road, London EC1V 2NX, United Kingdom ("we", "us", "our").
We provide an analytics assistant that helps TikTok Shop sellers understand their own shop performance.
For privacy questions or to exercise your rights, contact privacy@sparkplayai.com.
The personal data we process
If you use the SparkPlay AI application (as an invited user of a customer's workspace), we process:
- your email address and name;
- your access permissions and the shops/agents assigned to you;
- sign-in codes (kept only for a few minutes);
- the content of your conversations with the assistant and reports generated for you;
- activity timestamps (last sign-in, last active).
If your business connects a TikTok Shop to SparkPlay AI, we process that shop's order, return, product, and analytics data on the instruction of that business. This can include a tokenised identifier derived from a buyer's email address — we do not store buyers' email addresses; they are converted to a non-reversible token at the point of collection and used only to count distinct buyers.
If you contact us (for example through an enquiry form or by email), we process the details you provide and our correspondence with you.
We do not use third-party analytics, advertising, or tracking technologies on the application, and we do not sell personal data.
Why we process it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the application to invited users of our customers | Performance of a contract / our legitimate interest in operating the service our customer has bought |
| Processing connected-shop data | We act as a processor on our customer's instructions; the customer is the controller and sets the lawful basis |
| Responding to enquiries | Our legitimate interest in answering you / taking steps to enter a contract |
| Security, fraud prevention, and meeting legal obligations | Legitimate interest / legal obligation |
Who we share it with
We use Microsoft Azure to host and process all data (compute, databases, key management, email delivery, and AI inference — all within UK/EEA regions), and GitHub for source control and deployment (no customer data). AI inference runs within our Azure tenant and is not used to train third-party models.
We do not otherwise share your personal data, except where required by law or to protect our rights.
Where your data is held
All data is stored and processed in the United Kingdom and the European Economic Area. We do not transfer personal data outside the UK/EEA.
How long we keep it
We keep personal data only as long as needed for the purpose it was collected for and to meet legal requirements. In summary: sign-in codes for minutes; sessions for up to 7 days; user accounts and conversation history for the life of the customer relationship; connected-shop data while the shop is connected. When a customer relationship ends, we delete the customer's data. Full detail is in our internal retention policy, available to customers on request.
Your rights
Subject to UK/EU GDPR, you have the right to access, correct, delete, or restrict our processing of your personal data, to object to processing, and to data portability. Where we process data as a processor for a business customer, we will pass your request to that customer or assist them in responding.
To exercise a right, email privacy@sparkplayai.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Cookies
The application uses a single strictly-necessary cookie to keep you signed in. We do not use analytics, advertising, or tracking cookies, so no cookie consent banner is shown.
Changes
We may update this policy. Material changes will be notified to customers. The "last updated" date above shows the current version.
Contact
BXP Ltd, 124 City Road, London EC1V 2NX, United Kingdom — privacy@sparkplayai.com