Legal
Privacy Policy
How Spark: Learning Adventures collects, uses and protects personal information under POPIA. Built in South Africa, hosted in South Africa, no advertising — ever.
1. Who we are
Spark: Learning Adventures is operated as a sole proprietorship based in South Africa. We are the Responsible Party under POPIA for all personal information processed through the Spark platform at sparkwli.online.
We operate two products:
- Spark Home (consumer) at app.sparkwli.online
- Spark School (B2B) at school.sparkwli.online
2. What we collect
Parent account data
- Email address — account creation, login, password reset, weekly digest
- Password (bcrypt hashed) — we never store plain text passwords
- 4-digit parent PIN (bcrypt hashed) — required to exit game sessions or change parental controls
- Consent record — POPIA requires we record explicit consent to process child data
- Subscription plan and status — to determine feature access
Child profile data
- First name or nickname — personalises the in-game experience
- Grade (1–4) — determines which CAPS content is served
- Avatar selection — stores the child's Sparky outfit and accessories
- Daily time limit setting — enforces parent-set screen time
- Grade lock setting — prevents access above the child's grade if enabled
- Timer preference — whether timers are on or off in game sessions
Game and learning data
- Game sessions (game, tier, accuracy, stars, duration, timestamp) — powers the DDA engine and parent dashboard
- CAPS topic progress per game and grade — shows which topics are practised and mastered
- Daily streak and longest streak — drives the streak feature
- Badges earned — badge collection visible on child profile
- XP and level — powers Sparky's evolution and province unlocks
- Quest progress — daily, weekly and term quest tracking
- Wardrobe items owned and equipped — avatar customisation earned through gameplay
We do NOT collect: surname, ID number, phone number, home address, school name (Spark Home), photos, or biometric data.
3. Children's data
Spark is built for children aged 6–10 (Grades 1–4).
Parental consent is required. A parent or guardian must create an account and give explicit consent before a child profile can be created. Children cannot register themselves. The consent record is stored and timestamped.
Children cannot: create their own account, change parental controls, make purchases, communicate with other users, or exit a game session without the parent PIN.
4. How we use your data
- Running the platform and serving CAPS-aligned content (basis: contract performance)
- Dynamic Difficulty Adjustment — adjusting game difficulty to target 70% accuracy (basis: contract performance / legitimate interest)
- Parent dashboard — showing CAPS progress, sessions, achievements (basis: contract performance)
- Weekly parent email digest (basis: consent — opt-out available)
- Processing PayFast subscription payments (basis: contract performance)
- Sending invite and password reset emails (basis: contract performance)
- Platform analytics via Google Analytics 4 — anonymised only (basis: legitimate interest)
6. Where your data lives
All personal data is stored on a VPS hosted by domains.co.za in South Africa (server IP 154.66.196.87). PostgreSQL 16 database on the same server. No personal data leaves South Africa. The only exception is Google Analytics which receives anonymised event data with no names, emails, or child identifiers.
8. Payments
Subscriptions processed by PayFast (South African payment gateway). Card details entered on PayFast's secure page — Spark never sees them. PayFast is PCI DSS compliant.
Spark stores only: subscription status, plan ID, PayFast payment reference.
Plans
- Spark Plus Monthly: R49/month recurring
- Spark Plus Annual: R349/year recurring
- Family Plan: R499/year, up to 3 child profiles, recurring
Cancellation stops future billing. No refunds for partial periods except where required by South African consumer protection law.
9. Spark School
When a school licences Spark, the school is the Responsible Party under POPIA. Spark acts as the Operator. A Data Processing Agreement (DPA) is signed with every school before go-live.
School administrators upload learner lists via CSV — first name and grade only. Teachers can see only learners in their assigned class. Class leaderboards are opt-in per teacher and show first names only. No leaderboard data is shared across classes or schools.
School administrators can download or delete all school data from the admin portal at any time.
10. How long we keep data
- Parent account and child profiles: until deletion requested, or 2 years after last login
- Game sessions and learning progress: deleted with the account
- Subscription records: 5 years after subscription ends
- Audit logs: 12 months
- School learner data: until licence ends or school requests deletion
- Email invite logs: 90 days
Deleted data is removed from the live database immediately. Backups are rotated within 30 days.
11. Your rights under POPIA
- Access: request a copy of all data held about you and your child
- Correct: update inaccurate information from your parent dashboard
- Delete: request deletion of account and all associated data
- Object: opt out of processing beyond running the platform
- Portability: request child learning data as a CSV export
- Complain: lodge a complaint with the Information Regulator at inforegulator.org.za | inforeg@justice.gov.za | 010 023 5207
To exercise rights: privacy@sparkwli.online
Response within 30 days as required by POPIA.
Parents can delete their account and all child data directly from the parent dashboard — instant and permanent.
12. Contact
Spark: Learning Adventures
South Africa
privacy@sparkwli.online
Information Regulator of South Africa:
inforegulator.org.za | inforeg@justice.gov.za | 010 023 5207
Effective date: 1 May 2026 · Version 1.0