Privacy notice

Giulio Zanni · Italy · Updated 2026-10-31

Controller and contact

The controller is Giulio Zanni, Italy. For personal-data requests use privacy@saidspark.com or the form on this page. General service contact: contatti@saidspark.com.

Search and approximate location

Search words are transmitted to the service to find sayings; they are not retained as a personal search history or sent to Google Analytics. With analytics consent, Google Analytics may derive approximate location, such as a city or geographic area, from an IP address and receive browser identifiers and technical device data. SaidSpark does not request GPS access or precise location.

Personal data

Account data include email, display name, an optional Google profile image, provider identifiers, protected credentials, verification status and permissions. Service data include your bio, private favorites and notes, comments and requests to the controller. Sessions, IP addresses and browser information are used where needed for security and abuse prevention. Google sign-in does not request access to Gmail, contacts or documents.

Purposes and legal bases

Accounts, authentication, favorites, notes and requested features are processed to provide the service under GDPR Article 6(1)(b). Security, abuse prevention and moderation rely on legitimate interests under Article 6(1)(f). Handling data rights and applicable duties relies on Article 6(1)(c). There is no behavioral advertising or promotional mailing. Consent is not used as a blanket basis for processing necessary for your account.

Administrative reports and notifications

Administrators can request operational notices at their own verified email and view private reports of scheduled activity. Delivery preferences, read status and technical provider receipts are processed; reports and delivery receipts are retained for 30 days. Requested operational emails use Resend and can be disabled in Management → Activity reports. Processing provides the requested feature and operates the service; it is not marketing.

Voluntary support via Ko-fi

Support links open Ko-fi only at your request. We embed no Ko-fi widgets, trackers or payment forms and send no SaidSpark account, favorites or notes to Ko-fi. Ko-fi and the selected payment provider process data under their own notices. In those provider accounts, the controller may receive contribution details and receipts, including name, email, amount and an optional message depending on the payment method. These data are used to manage contributions, requests and applicable duties, not for marketing or automatic publication by SaidSpark. Necessary documents are retained for legally required periods; other data for as long as needed to manage the contribution. Processing relies on the requested relationship (GDPR Article 6(1)(b)) and legal duties (Article 6(1)(c)).

Visibility and AI

Account favorites and notes are private. Only approved comments become public, under the chosen display name. Public catalog texts, attributions and references may be processed using AI for editorial selection and translation. Privacy requests, passwords, private favorites and notes are not sent to the editorial AI models. The service does not make automated decisions about users with legal effects under GDPR Article 22.

Reports and user blocking

You can report a comment or user to the editors without an account. We store the comment reference, reason, any details and, if signed in, a link to your account to prevent abuse and handle reports. Reports are deleted within 12 months; reports linked to your account are removed when you delete it. Do not enter sensitive data in the details. Blocking an author hides all their comments on this device: the preference stays in your browser and can be removed from the comments section.

Optional Google Analytics

Only with consent under GDPR Article 6(1)(a), Google Analytics 4 measures visits, pages, sayings actually visible on screen and detail openings. Google receives cookie identifiers and technical device, connection and navigation data. An impression does not prove a text was read. We do not send email, account names, notes, private comments, search text, full query strings or fragments. To distinguish campaigns, we may send only public labels for source, medium, campaign and link variant, without identifying data. Google Signals and advertising personalization are disabled. The Android TWA uses the same web integration; Android attribution requires a reliable launch indicator, while fullscreen display alone cannot identify the TWA. Reject or withdraw using Cookie preferences without losing service functionality. Before consent the Google tag is not loaded and sends no analytics requests. Withdrawal stops future measurement and removes accessible Analytics cookies; it does not automatically erase past events. Google information: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites.

Service providers and transfers

Cloudflare provides hosting, database and service protection. Google provides OAuth identity, the controller’s destination mailbox and, only with analytics consent, Google Analytics. When enabled, Resend delivers transactional verification and security emails. OpenAI and Workers AI process catalog texts. Providers may process data outside the EEA; applicable provider agreements, adequacy decisions and standard contractual clauses govern such transfers where relevant. Further information can be requested from the controller.

Retention

Profile data, favorites and notes are retained while the account remains active to provide the requested service. Sessions expire within 30 days; verification links within one hour; password-reset and deletion links within 30 minutes. New unverified email accounts are removed after 30 days. Closed privacy requests are deleted after 12 months, including where the related account has been deleted. On account closure, application identity is anonymized and sessions revoked. Backups expire through the provider’s retention cycles and are not used to reactivate deleted accounts.

Your rights

You may request access, rectification, erasure, restriction and portability, and object to legitimate-interest processing where applicable. Your account offers data export and, when email delivery is enabled, email-confirmed deletion. The form also works without an account. Deletion removes login identity, account favorites, notes and comments and anonymizes necessary editorial traces. Old collections linked by a private key are separate: remove them using that key or request assistance without publishing the key.

Requests and complaints

Requests are normally handled within one month, subject to lawful extensions and proportionate identity checks. You may complain to the Italian Garante (garanteprivacy.it) or your competent supervisory authority. Providing necessary account data is optional, but the corresponding features cannot work without it. Cookies are described in the Cookie policy. Last updated: 2026-10-31.

Send a personal-data request

No sign-in is required. Do not send passwords or private keys. The request will be checked and does not automatically delete your account.