SparkOps — Privacy Notice

Effective date: 30 May 2026

Version: 1.0 (beta)

This privacy notice tells you how AM R Electrical Ltd ("SparkOps", "we", "us") collects and uses personal data when you visit our website, sign up for the beta waitlist, subscribe to a SparkOps plan, or use the SparkOps Telegram bot.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Data controller: AM R Electrical Ltd

Trading as: SparkOps

Registered office: 129 Ballygomartin Road, Belfast BT13 3NA, Northern Ireland

Companies House: NI674313

VAT: GB423901713

Contact: sparkops@am-r.pro

ICO registration: to be confirmed (registration in progress at launch)

You can write to us at the address above or email sparkops@am-r.pro about any matter in this notice. We aim to respond within 14 days.

2. What personal data we collect

2a. When you visit https://sparkops.am-r.pro

• Your IP address (used briefly for abuse prevention; logs kept 14 days)
• The pages you viewed (kept 14 days)
• Browser user-agent string

2b. When you sign up for the beta waitlist

• Name, email, phone (optional), company name, scheme registration body
• Approximate monthly cert volume (optional)
• Any free-text notes you provide

2c. When you subscribe to a SparkOps plan

• Billing name, billing address, country, VAT number (if any) — collected by

Stripe Checkout on our behalf

• Email address
• Payment card details — held by Stripe, NOT by us
• Your Stripe customer ID and subscription ID (we store these)

2d. When you use the SparkOps Telegram bot as an owner or engineer

• Your Telegram user ID, username and display name
• Every message you send to the bot (text, voice notes, photos)
• Voice notes are transcribed to text
• Photos may be analysed by AI vision models (see section 4)
• Conversation state is retained so the bot can pick up where you left off

2e. When you issue certificates through the bot

• The end-client's name, property address, and any identifying details you

type or photograph

• Test readings, inspection observations
• The signed PDF, retained for audit and re-issue
• A timestamped record of who signed which cert from which Telegram account

This data is generated by you, on behalf of your business, about your end clients. You are the data controller of the end-client data; we process it on your instructions (see section 7).

3. Why we use this data and our lawful basis

We do not sell your personal data, do not use it for advertising profiling, and do not share it with anyone except the processors listed below.

4. Who we share data with (processors and sub-processors)

We use the following carefully chosen services to run SparkOps. Each has a contractual obligation to protect your data on our behalf.

We will tell you in advance before adding a new processor that affects personal data.

Where a processor is outside the UK / EEA, we rely on either an adequacy decision (such as the UK extension to the EU-US Data Privacy Framework, where applicable) or standard contractual clauses (SCCs) approved by the ICO.

5. How long we keep your data

If a legal hold applies (e.g. an open dispute, an ICO investigation, an HMRC audit), we may retain affected data longer until the matter is closed.

6. Your rights under UK GDPR

You can:

• Request a copy of the personal data we hold about you (subject access request)
• Correct inaccurate data
• Erase your data (subject to retention obligations above)
• Restrict or object to our processing
• Port your data to another service in a machine-readable format
• Withdraw consent at any time (for processing that relies on consent)
• Complain to the ICO at https://ico.org.uk or 0303 123 1113

To exercise any right, email sparkops@am-r.pro. We will respond within one month. There is no fee for the first reasonable request.

7. End-client data (data you put through the bot)

When you use SparkOps to generate a cert for one of your clients (e.g. Mrs Smith at 42 Oak Lane), you are the data controller of that information — not us. We are merely the data processor acting on your instructions.

This means:

• You decide what to collect, why, and for how long
• We keep it secure, do not access it except to operate the service, and

delete it on your instruction

• You must give your end clients your own privacy notice (we don't have

a relationship with them — you do)

A separate Data Processing Agreement (DPA) is incorporated by reference into our Terms of Service and applies whenever you put end-client personal data through the bot.

8. Security

• All web traffic is over HTTPS (TLS 1.2+).
• Backblaze backups are encrypted client-side with AES-256 before upload;

the key never leaves our control.

• Customer payment cards never touch our servers — Stripe handles them.
• Engineer access to the bot is gated by per-user Telegram ID whitelist.
• Audit logs record who signed every cert and when.
• We disclose security incidents affecting your data within 72 hours of

becoming aware, as required by UK GDPR.

9. Children

SparkOps is a B2B tool for electrical contractors. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

10. Cookies

The SparkOps website uses no third-party cookies for analytics or advertising. We do not embed Facebook pixels, Google Analytics, or similar. The only data the site logs is what we list in section 2a, kept 14 days.

11. Changes to this notice

We may update this notice. Material changes will be emailed to current subscribers. The latest version always lives at https://sparkops.am-r.pro/privacy with a version number and effective date.

Questions? sparkops@am-r.pro — we genuinely read these.