Privacy policy

1. What we collect

Account data: username, emailAddress, cellphone number, business name (for Owners), physical address (for User/Business Owner/Affiliate as required by registration — addressStreet, suburb, city, province, postal code, country), PayPal link where provided for affiliate or business payouts, and role/privilege.

Operational data: products, barcodes/unit codes, transactions, tips, withdrawals, ticket purchases and check-ins, job postings and applications, affiliate referrals and promotion metadata, audit logs and scan logs. This data is created through your use of dashboards and is retained to preserve the ledger.

Inquiry & subscriber data: Contact inquiries via POST /api/contact-inquiries and subscriber contacts via POST /api/subscribers (contact = email or phone). Promotion targeting may use subscriber contact type (CLIENT, AFFILIATE, etc.). Bulk imports are handled via the admin subscriber import flow.

Technical data: Authentication tokens stored as httpOnly cookies (king_sparkon_tracker_access_token / refresh_token), session claims decoded from JWT (userId, businessId, roles, exp), request headers, and error logs. We do not store backend access tokens in localStorage or expose BACKEND_URL to the browser.

2. Why we process it

• To provide role-safe dashboards and enforce access control via the proxy (src/proxy.ts).
• To create and track barcode inventory, QR tickets, transactions and payouts.
• To send verification, password reset and transactional communications.
• To operate promotions only to the audience and channel you select, with a quote before sending.
• To maintain audit trails, reports and capacity dashboards.

3. Legal basis

We process data on the basis of contract performance (providing the platform you registered for), legitimate interest (security, fraud prevention, platform improvement, and audit integrity), consent (newsletters/subscriber opt-in, affiliate promotion opt-in where applicable), and compliance with legal obligations.

4. Cookies

We use httpOnly, Secure (in production), SameSite=Lax cookies for authentication — not for cross-site tracking. The Next.js proxy attaches the Bearer token server-side. We also load Google AdSense with async and crossorigin=anonymous per src/app/layout.tsx:118. AdSense may set its own cookies per Google's policy. You can manage cookies through your browser settings; rejecting auth cookies will prevent login and dashboard access.

5. Sharing

We do not sell your data. We share it only with: the Spring Boot backend that powers the API, infrastructure providers required to host storage and logs (e.g., Supabase for logo storage as in next.config.ts), payment providers when you initiate website payments or tips, and Google publishers if AdSense is enabled. Each recipient is limited to the data needed to perform its function.

6. Retention

Account and ledger data are retained while your account exists and for a reasonable period afterwards to preserve audit integrity and comply with legal obligations. Contact inquiries and subscriber data are retained until you request deletion via DELETE /api/subscribers?contact=… or via the contact form. You may request account deletion via an authenticated request; ledger entries tied to financial transactions may be retained in anonymized or aggregated form where law requires.

7. Your rights

You may request access, correction, export, restriction, or deletion of your personal data, and object to or withdraw consent for direct marketing. To exercise these, contact us via the contact page and include the email or phone associated with your account. Verification may be required.

8. Children

The platform is not directed to children under 16. We do not knowingly collect data from children for marketing or unrelated processing.

9. Changes

We will update this page and the last-updated date when practices change. Significant changes that expand processing will be highlighted in the app and, where required, will seek fresh consent.

10. Contact

Data controller: Sizolwakhe Leonard Mthimunye (King Sparkon) — use the contact form for privacy inquiries. You may also reach the public GitHub profile linked in the footer for platform-related matters.