Privacy Policy

---

Quick Reference

---

1. Who We Are and What This Covers

Fanbase Spark, LLC, a Georgia limited liability company and a wholly-owned subsidiary of Fanbase Social Media, Inc., with its principal place of business in Atlanta, Georgia ("Spark," "we," "us," "our"), is the controller of the personal information described in this Privacy Policy.

It does not cover:

• Fanbase, operated by Fanbase Social Media, Inc. and governed by the Fanbase Privacy Policy — though data flows between the two, as described in Section 5;
• Fanbase Creator Services, whose handling of payment data is described in the Creator Agreement and Creator Services Privacy Notice;
• third-party websites, apps, and services.

This Privacy Policy is incorporated into the Fanbase Spark Terms of Service. Our Subprocessor List at [URL] is incorporated by reference.

---

2. Key Terms

• Personal information (or "personal data") means information that identifies, relates to, describes, or could reasonably be linked with you or your household. For users in the EEA, UK, or Switzerland, "personal data" has the meaning given in the GDPR.
• Fanbase Family means Fanbase Social Media, Inc. and its subsidiaries and affiliates, including Fanbase Spark, LLC and Fanbase Creator Services, [LLC].
• FAN (Federated Access Network) means the shared identity, account, and earnings infrastructure connecting the Fanbase Family.

---

3. Information We Collect

3.1 Information You Give Us

Account and profile. Because Spark uses the Federated Access Network, your account is created and maintained jointly with Fanbase. This includes:

Content you create. Posts, replies, quotes, reposts, threads, long-form posts, media (images, video, GIFs), polls, lists, bookmarks, direct messages, [live audio], and associated metadata.

Payment information. Where you purchase subscriptions or paid features, or earn as a creator: transaction records, amounts, timestamps, subscription status, platform fee, net earnings, and payout status. We do not collect or store your full payment card number.

Communications with us. Support tickets, appeals, reports, and survey responses.

Contacts. If you enable contact sync, the names, phone numbers, and email addresses in your device address book, used to help you find people you know. You can turn this off and ask us to delete synced contacts.

3.2 Information We Collect Automatically

Device and technical. Device model, OS and version, unique device and advertising identifiers, carrier, language, time zone, browser type and version, IP address and derived approximate location, app version, crash logs, and diagnostic data.

Usage and activity. Posts you view and for how long, scroll depth, taps, searches and search history, accounts you follow, block, and mute, links you click, notification opens, and referral and campaign source.

Location. Approximate location from IP address, always. Precise location only with your permission, and only for features that need it.

Cookies and similar technologies. On the Spark website and in in-app browsers. See Section 12.

3.3 Information from Third Parties

• Other Fanbase Family products — see Section 5. This is a significant source: your Spark account, profile, safety history, and much of your identity data may originate on Fanbase.
• App stores (Apple, Google): purchase and subscription status, receipts, refund events.
• Payment processors: transaction status, payout status, verification status, chargebacks.
• Attribution and analytics providers: install source, campaign, deep-link data.
• Sign-in providers, if used.
• Trust and safety sources: fraud and abuse signals, sanctions and restricted-party screening, hash-matching results from CSAM and terrorist-content databases (e.g., NCMEC, [GIFCT]).
• Other users: information about you in their posts, reports about you, contacts they upload.
• Publicly available and commercial sources, where lawful.

3.4 Sensitive Information

We do not seek to collect sensitive personal information, but you may provide it — for example by posting about your health, religion, politics, sexual orientation, or union membership, or by providing a government ID for verification.

3.5 Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. If we learn we have, we will delete it and terminate the account. Contact [privacy@fanbase.app].

For users aged 13 to 17, we [apply the following additional protections: protected account by default, restricted DMs from non-followers, no precise location, limited advertising personalization].

---

4. How We Use Information

4.1 To Provide the Service

Create and maintain your account and federated FAN identity; display your profile and posts and deliver them to your audience; operate timelines, replies, search, trends, lists, DMs, and [live audio]; process subscriptions and paid features and calculate creator earnings; sync your account and settings across Fanbase Family products; provide support.

4.2 To Personalize

Rank and recommend posts, accounts, topics, and trends; personalize your timeline, search results, and notifications; remember your settings. You can influence personalization through in-app controls and, where offered, choose a chronological timeline.

4.3 For Safety, Security, and Integrity

Detect, investigate, and prevent spam, platform manipulation, fraud, abuse, harassment, impersonation, and security incidents; enforce our Terms and Community Guidelines; detect CSAM and other illegal content including through hash matching and report as required by law (including to NCMEC under 18 U.S.C. § 2258A); verify identity and age; protect the rights, property, and safety of Spark, our users, and the public.

4.4 For Payments and Compliance

Process transactions, refunds, chargebacks, and payouts; prevent payment fraud and money laundering; meet tax, financial reporting, sanctions screening, and record-retention obligations; maintain the FAN transaction ledger.

4.5 To Communicate

Send service, security, transaction, and policy notices (not optional); send marketing messages (optional); respond to your inquiries, reports, and appeals.

4.6 For Artificial Intelligence and Machine Learning

Please read this section carefully.

(a) AI systems that operate the Service. We use AI models — our own and those of third-party providers acting on our behalf — to classify and moderate posts, replies, media, and [live audio] for safety violations; triage, route, and draft responses to support requests and appeals; detect spam, platform manipulation, and fraud; generate transcriptions, captions, translations, and alt text; and power search, trends, and recommendations.

(b) User-facing AI features. Where offered, we use AI to provide features you interact with directly — such as post drafting and editing assistance, summaries of conversations or trends, translation, and conversational assistance. Your inputs and the outputs are processed to provide the feature and may be reviewed for safety and quality.

(c) Training and improving models. As permitted by our Terms of Service, we use content and data on the Service — including your public posts and, where our Terms allow, other content and activity data — to develop, train, fine-tune, evaluate, and improve AI and machine learning models operated by Spark, the Fanbase Family, and, where our Terms permit, third parties.

Third-party AI providers. We use Anthropic (Claude) and may use other AI providers for (a) and (b). These providers act as our processors and are contractually restricted to processing data only on our instructions and for the purposes we specify.

Human review. Automated systems may be reviewed or overridden by trained human reviewers, particularly for enforcement decisions and appeals.

Automated decisions. We use automated processing in enforcement, monetization eligibility, and fraud prevention. Where a decision produces legal or similarly significant effects, you have the rights described in Section 11.4.

4.7 For Analytics and Research

We analyze usage to understand how the Service is used, measure feature performance, conduct A/B testing, and inform product decisions. We use aggregated and de-identified data for research and public reporting, and do not attempt to re-identify it.

4.8 For Advertising

We may show advertising and sponsored content and use your information to select and measure it, which in some jurisdictions constitutes cross-context behavioral advertising. See Sections 6 and 11.

---

5. Sharing Across the Fanbase Family (FAN)

5.1 What We Share and Why

Your data is shared across the Fanbase Family as an integral part of how the Service works. FAN gives you one account, one identity, and one earnings balance across Fanbase products. This sharing is not optional; it is how Spark is built.

What is not shared automatically. Your Spark posts are not automatically republished on Fanbase. Cross-posting happens only where you enable it or where a feature is expressly described as cross-platform.

Roles. Fanbase Spark, LLC and Fanbase Social Media, Inc. act as [joint controllers / independent controllers] for shared identity and safety data, and each acts as an independent controller for data generated on its own product. Fanbase Creator Services acts as [a controller / a processor] for payment and payout data.

5.2 If the Structure Changes

If Fanbase Spark, LLC is sold, spun out, or ceases to be affiliated with Fanbase Social Media, Inc., we will notify you and describe how your data will be handled.

---

6. How We Share Information Outside the Fanbase Family

6.1 Publicly — Spark Is Public by Default

Spark is a public conversation platform. Unless you protect your account, the following are public and visible to anyone with or without an account:

• your posts, replies, quotes, and reposts;
• your profile, handle, bio, banner, and join date;
• who you follow and who follows you;
• your likes and public lists.

Public content may be indexed by search engines, distributed through our APIs and partner integrations, embedded on other websites, displayed in third-party apps, and copied, archived, or scraped by third parties — including in ways we do not authorize and cannot prevent.

Protected accounts. If you protect your account, your posts are visible only to approved followers. Protection is not retroactive — anything posted while your account was public may already have been copied or distributed.

Direct messages are visible to the participants. DMs are not end-to-end encrypted. We can access DM content and do so for safety, legal, and support purposes.

Deleted content. Deleting a post removes it from the Service but does not retrieve copies others have made or remove it from third-party archives.

6.2 With Service Providers

We share personal information with vendors who process it on our behalf under written contracts limiting their use to our instructions. Our current subprocessors are listed at [URL] and include providers of: cloud hosting and storage · AI and machine learning services · monitoring and observability · mobile attribution and deep linking · customer support · app distribution and in-app purchase processing · payment processing and payouts · source control and engineering tooling · internal productivity and communications.

6.3 With Payment and Financial Partners

We share transaction and identity data with payment processors, banks, and tax reporting services as needed to process payments and payouts and to meet legal obligations.

6.4 For Legal Reasons and Safety

We may disclose information where we believe in good faith it is reasonably necessary to comply with a law, regulation, subpoena, warrant, court order, or other valid legal process; respond to a lawful government or law enforcement request; enforce our Terms and Community Guidelines; detect, prevent, or address fraud, security, or technical issues; protect the rights, property, or safety of Spark, our users, or the public, including in an emergency involving a risk of death or serious injury; or report CSAM to NCMEC as required by law.

Where permitted by law and consistent with safety, we will notify you before disclosing your information in response to legal process.

6.5 In a Corporate Transaction

If Spark or Fanbase is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any material change in how your information is handled.

6.6 For Advertising

Where we serve advertising, we may share identifiers and activity data with advertising and measurement partners. In some jurisdictions this is a "sale" or "share." See Sections 4.8 and 11.

6.7 With Your Direction

We share information with third parties where you ask us to, such as when you connect an account or authorize an integration or a developer application.

6.8 Aggregated and De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you, for any purpose.

6.9 Developer APIs

Where we offer APIs, developers you authorize may access data as permitted by your authorization and our Developer Terms at [URL]. Public content may be available to developers through our APIs.

---

7. Your Choices and Controls

---

8. How Long We Keep Information

Deleting your Spark account. When you delete your Spark account we delete or de-identify the personal information we hold as a Spark controller within [30–90] days, except for the categories above.

⚠ Important: deleting your Spark account does not delete your Fanbase Family account. Because your account is federated, your credentials, identity, and any data held by Fanbase Social Media, Inc. or other Fanbase Family entities remain until you delete those accounts as well. To delete your federated account across all Fanbase products, use [MECHANISM] or contact [privacy@fanbase.app] and tell us you want your data deleted across the Fanbase Family. We will treat any deletion request as applying across all Fanbase Family entities unless you tell us otherwise.

The FAN ledger is append-only. We do not delete transaction records, but we de-link and anonymize the identifiers connecting them to you, so the financial record survives without identifying you.

Models already trained on your content are not affected by deletion (see Terms of Service § 5.2).

---

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls and least-privilege access, logging and monitoring, and vendor security review. Spark relies on shared security infrastructure operated by Fanbase Social Media, Inc.

No system is perfectly secure. Protect your account with a strong, unique password and two-factor authentication where available. If we experience a data breach affecting your personal information, we will notify you and the relevant regulators as required by law.

---

10. International Data Transfers

We are headquartered in the United States, and we and our service providers process personal information in the United States and other countries. Data protection laws in those countries may differ from those where you live.

Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, together with transfer impact assessments and supplementary measures where appropriate, and/or [the EU–US Data Privacy Framework, if self-certified]. Request a copy of the safeguards at [privacy@fanbase.app].

---

11. Your Privacy Rights

11.1 Rights Available to Everyone

You may access and review your profile and posts, correct your profile information, download a copy of your data, delete content and your account, and manage notification and marketing preferences.

Contact [privacy@fanbase.app] or use [request portal URL]. We will verify your identity before responding, and respond within the timeframes required by applicable law or, where none applies, within 45 days. We will not discriminate against you for exercising your rights. You may use an authorized agent with proof of authorization.

11.2 United States — State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive privacy law, you may have the right to: know/access; correct; delete; portability; opt out of sale; opt out of sharing/targeted advertising; opt out of profiling with legal or similarly significant effects; limit use of sensitive personal information; and appeal a denial.

How to exercise. [privacy@fanbase.app] · [request portal URL] · ["Do Not Sell or Share My Personal Information" link]

Global Privacy Control. We honor the GPC signal as a valid opt-out of sale and sharing on our website.

California — CCPA/CPRA Disclosures

Categories of personal information we collect:

Sources, purposes, and recipients are described in Sections 3, 4, 5, and 6.

Sale and sharing. We do not sell personal information for monetary consideration. [We do / We do not] "share" personal information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

Use of sensitive personal information. We use it only for the purposes permitted by § 1798.121 and not to infer characteristics about you.

Retention is described in Section 8.

Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.

Minors' content removal (BPC § 22581). California residents under 18 may request removal of content they posted. Contact [privacy@fanbase.app].

11.3 EEA, UK, and Switzerland — GDPR Rights

Controller. Fanbase Spark, LLC. [Joint controller with Fanbase Social Media, Inc. for shared identity and safety data — see Section 5.1.] [EU/UK representative under Art. 27: [TO BE APPOINTED].]

Your rights. Access; rectification; erasure; restriction; portability; object to processing based on legitimate interests, including profiling; object to direct marketing at any time, absolutely; withdraw consent at any time; and lodge a complaint with your supervisory authority.

Our lawful bases:

Objecting to AI training. If you are in the EEA, UK, or Switzerland, you may object at [MECHANISM — TO BE BUILT]. We will honor the objection unless we can demonstrate compelling legitimate grounds that override your interests.

11.4 Automated Decision-Making

We use automated processing for content ranking, enforcement, monetization eligibility, and fraud detection. Where an automated decision produces legal or similarly significant effects — such as terminating your account or withholding earnings — you may request human review, express your point of view, and contest the decision. Contact [privacy@fanbase.app] or use the appeals process at [URL].

11.5 Other Jurisdictions

If you are in Canada, Brazil, or another jurisdiction with a comprehensive privacy law, you may have similar rights. Contact [privacy@fanbase.app].

---

12. Cookies and Similar Technologies

On our website and in in-app browsers, we and our partners use cookies, SDKs, pixels, and local storage for strictly necessary purposes (authentication, security, load balancing), functional purposes (settings and preferences), analytics, and, where applicable, advertising.

Manage non-essential cookies through [our cookie banner / preference center] and your browser settings. Blocking strictly necessary cookies will break the Service. In the EEA and UK we obtain consent before setting non-essential cookies.

Mobile identifiers. In our apps we use device and advertising identifiers rather than cookies. Limit these through your device settings.

---

13. Do Not Track

We do not currently respond to browser "Do Not Track" signals, as no common standard exists. We do honor the Global Privacy Control signal as described in Section 11.2.

---

14. Changes to This Privacy Policy

We may update this Privacy Policy. We will change the "Last Updated" date and, for material changes, provide notice through the Service, by email, or another reasonable method at least [30] days before the change takes effect. Where the law requires your consent, we will obtain it. Prior versions are archived at [URL].

---

15. Contact Us

Privacy inquiries and requests [privacy@fanbase.app] [Request portal URL]

Postal Fanbase Spark, LLC Attn: Privacy [Street Address] [City, GA ZIP]

Data Protection Officer — [TO BE APPOINTED / dpo@fanbase.app] EU Representative (GDPR Art. 27) — [TO BE APPOINTED] UK Representative (UK GDPR Art. 27) — [TO BE APPOINTED]

If you are in the EEA, UK, or Switzerland and are not satisfied with our response, you may lodge a complaint with your local supervisory authority.

---

Appendix A — Subprocessors

Our current subprocessors are listed in the Fanbase Subprocessor and Data Processor List at [URL], incorporated by reference and updated as our vendors change.

---

Appendix B — Relationship to the Fanbase Privacy Policy

Fanbase and Fanbase Spark share the Federated Access Network. The table below shows where to look for what.