Privacy

1. Who We Are

Qrious Technologies Inc. is a Delaware C-Corporation headquartered at 251 Little Falls Drive, Wilmington, DE 19808, USA. We operate Sparks, a web service hosted at sparks.qrious.social that offers a growing family of self-knowledge assessments. Today the family includes a personality quiz; additional formats are in development.

For privacy-related inquiries, contact us at privacy@qrious.social.

2. What This Policy Covers

This policy applies to the Sparks website at sparks.qrious.social (the “Service”). It covers every assessment we publish on Sparks, both today and as we add new ones.

It applies to all visitors regardless of location, though additional rights may apply depending on your jurisdiction (see Your Rights below).

3. Age Requirement

Sparks is intended for visitors aged 18 and older. The assessments are not designed for minors and some result content may not be appropriate for younger audiences. If you are a parent or guardian and believe a minor has used the Service, please contact us at privacy@qrious.social.

4. What We Collect

Your Quiz Answers

Your answers stay in your browser. While you take an assessment, your choices are saved to sessionStorage under the key spark-quiz. They are never transmitted to our servers and are cleared automatically when you close the tab.

Your Result

Your result is computed in your browser from those answers. We do not store the result against your identity. If you choose to share it, we generate a URL containing a compact representation of the result, and that URL is what you share.

Anonymous Usage Analytics

We use PostHog to record anonymous interaction events (page loaded, question answered, result reached, share clicked) so we can understand which assessments work, which questions confuse, and where the experience breaks. PostHog runs from the European Union (eu.i.posthog.com). Events are linked to a random session ID we generate the first time you visit. We do not send PostHog your name, your email address, or the content of your answers.

First-Visit Context

On your first visit we capture the marketing context you arrived with: the referring URL, UTM parameters in the query string, and your browser language and timezone. We attach these to your PostHog session record to help us understand which channels bring people in. None of this lets us identify you personally.

Mailing List (Optional)

If you choose to join our launch mailing list, we collect your email address and store it in Brevo (Sendinblue SAS, France) with a double opt-in confirmation. We use this only to send you the updates you signed up for. You can unsubscribe at any time from any email.

Technical Request Data

Our hosting provider (AWS Amplify) and our CDN (Cloudflare) automatically receive standard request data: your IP address, user agent, requested URL, and approximate location derived from the IP. This is used to deliver the site, protect against abuse, and keep the operational logs required for security.

5. What We Don’t Collect

Some things we have deliberately chosen not to collect or store:

• Your name. We never ask for it. The mailing list is email-only.
• Your contacts, calendar, or photos. Sparks runs entirely in a web browser. We have no access to your device beyond what you type into the page.
• Cross-site tracking identifiers. We do not embed Meta Pixel, Google Ads tags, TikTok Pixel, LinkedIn Insight, or any third-party advertising tracker. There are no ad cookies on Sparks.
• Your IP address linked to your answers. PostHog and Cloudflare see your IP for operational reasons. We never join that to the content of your quiz answers, because the answers never leave your browser.
• Your sensitive personal information for advertising. We do not infer your psychological profile, political views, religious beliefs, or sexual orientation from your answers in order to target you with advertising. Inferences may be drawn by the assessment itself to produce your result; that is the whole point of the assessment, and the result stays in your browser.
• Payment data. Sparks has no paid features today. Nothing on this site processes a credit card.

6. How We Use Your Information

• Deliver the Service: Serve the pages, calculate your result in your browser, and let you share it if you choose.
• Improve the Service: Use aggregate analytics to understand which assessments and questions work and which need redesign.
• Communicate with you: Respond to questions you send to privacy@qrious.social, and (if you opted in) send launch updates from our mailing list.
• Protect against abuse: Detect bots, scraping, and traffic patterns that threaten the availability of the Service for other visitors.
• Legal compliance: Respond to valid legal requests and meet our regulatory obligations.

7. Legal Basis for Processing (GDPR)

For visitors in the European Economic Area, the United Kingdom, and other jurisdictions that require a legal basis for processing personal data, we rely on the following:

• Consent (Art. 6(1)(a)): You give consent when you accept analytics or functional cookies in our cookie banner, and again when you confirm a double opt-in to our mailing list.
• Contractual Necessity (Art. 6(1)(b)): Processing required to deliver the Service you requested: serving the page and rendering your assessment result in your browser.
• Legitimate Interest (Art. 6(1)(f)): Securing the Service against abuse and fraud, and the limited operational logging performed by our hosting provider and CDN to keep the site available, where those interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including responses to valid legal requests from law enforcement or regulatory authorities.

8. Services We Use

We are honest about who else touches your data. Each provider below has a specific job, receives only what it needs, and is bound by a data processing agreement that prohibits using your data for any other purpose.

• PostHog: product analytics. Records anonymized interaction events so we can understand how the Service is used. Routed through eu.i.posthog.com via our /ph proxy to keep your traffic in the EU. We do not send PostHog the content of your quiz answers, your name, or your email. PostHog operates EU infrastructure for European visitors.
• Brevo: mailing list and transactional email. If you sign up for launch updates, your email is stored in a Brevo marketing list using a double opt-in confirmation. Operated by Sendinblue SAS in France. Legal basis: Art. 6(1)(a) consent. You can unsubscribe at any time from any email.
• AWS Amplify (Amazon Web Services): website hosting. sparks.qrious.social is hosted on AWS Amplify in the ap-southeast-1 region (Singapore). Receives only what is needed to serve the site: request URL, IP address, user agent. Legal basis: Art. 6(1)(f) legitimate interest in delivering and securing our website.
• Cloudflare: content delivery network. We use Cloudflare, Inc. (US) as a CDN in front of our hosting for static asset delivery, edge routing, and DDoS protection. Cloudflare sees the request URL, your IP address, and standard request headers. It does not have access to the content of your quiz answers, which never leave your browser. Legal basis: Art. 6(1)(f) legitimate interest in delivering and securing the website.
• Sub-processor changes. When we add, remove, or replace a sub-processor that handles personal data, we update this list. Where required, we will give EU/UK visitors reasonable advance notice.

9. Where Your Data Lives

Qrious Technologies Inc. is based in the United States, but Sparks runs on infrastructure across multiple regions. The website is served from AWS Amplify in Singapore (ap-southeast-1) behind Cloudflare. Analytics events are routed to PostHog in the European Union. The mailing list is stored with Brevo in France.

For visitors in the European Economic Area, United Kingdom, and Switzerland, we ensure that international transfers of personal data are conducted in compliance with applicable data protection laws, using appropriate safeguards: the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), and (for transfers to the United States) reliance on providers self-certified under the EU-U.S. Data Privacy Framework (DPF) and its UK and Swiss extensions where available. Additional technical and organizational measures are applied where required.

10. Your Rights

EEA, UK, and Switzerland (GDPR & UK GDPR)

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Object to Processing: Object to processing based on legitimate interests, including profiling.
• Restrict Processing: Request that we limit the processing of your data in certain circumstances.
• Automated decisions: Not be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you (Art. 22). See section 11 below for how this applies to Sparks.
• Lodge a Complaint: File a complaint with your local data protection authority. UK visitors may contact the Information Commissioner’s Office (ICO) at ico.org.uk.

California (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act gives you additional rights:

• Categories collected: Internet activity (cookies, page views, click events) and inferences drawn from your interaction with the Service. If you join the mailing list, we also collect your email address.
• Sources: Directly from you, automatically from your browser, and from our service providers listed in section 8.
• Purposes: To operate the Service, communicate with you (if you opted in), protect against abuse, and comply with the law.
• Recipients: Only the service providers listed in section 8. We do not sell or share personal information for cross-context behavioral advertising.
• Your rights: Right to know, right to delete, right to correct, right to opt out of sale or sharing (we do not sell), right to non-discrimination for exercising these rights.
• Sensitive personal information (Cal. Civ. Code §1798.121): Some of our assessments may, by inference from your answers, suggest information about your psychological profile, political views, religious beliefs, or sexual orientation. We compute that inference in your browser and do not store it against your identity. You have the right to limit our use of any sensitive personal information that does reach us (for example, if you contact privacy@qrious.social to exercise your rights and reveal such information in your request). Email privacy@qrious.social with subject line “Limit SPI” to exercise this right.
• 12-month lookback (§1798.130(a)(5)): The categories of personal information described above reflect what we have collected, used, and disclosed for a business purpose in the twelve months preceding the effective date of this policy. We have not sold or shared personal information for cross-context behavioral advertising in that period.
• Global Privacy Control (GPC): We treat a Global Privacy Control signal from your browser as a valid request to opt out of any sale or sharing of personal information for cross-context behavioral advertising, in line with the California Attorney General’s guidance. We do not currently sell or share, but the signal is recorded against your session.

To exercise any of these rights, email privacy@qrious.social. We will respond within 30 days.

11. Special Category Data & Automated Decisions

Special Category Data (GDPR Art. 9)

Some assessments on Sparks — currently the personality quiz, and in development a political-orientation compass, an astrology-style profile, and an attachment-style assessment — may, from your answers, reveal information that the GDPR treats as special category under Article 9: political opinions, religious or philosophical beliefs, sexual orientation, or health-related profile. Because every assessment runs entirely in your browser, we never receive your answers and never compute these inferences on our servers. The result is rendered locally and stays with you. If you choose to share your result through a generated URL, that share is your decision and your action; we do not store the result against your identity. No Art. 9(2)(a) consent ceremony is required, because no special-category data ever reaches us.

Automated Decision-Making (GDPR Art. 22)

Your assessment result is computed by an algorithm in your browser from the answers you give. The result is shown to you and does not produce legal or similarly significant effects on you within the meaning of Article 22 of the GDPR: we do not use your result to deny you access to anything, set prices, or make any decision about you. If at any point we introduce a feature that would qualify as solely automated decision-making with legal or similarly significant effects, we will obtain explicit consent and offer human review by emailing privacy@qrious.social.

12. Data Retention

• Quiz answers: Never stored by us. Your answers live in browser sessionStorage and are cleared when you close the tab.
• Mailing list: Until you unsubscribe. Unsubscribing removes your email from the Brevo marketing list within 24 hours.
• Analytics events: Retained in PostHog for up to 7 years, then automatically deleted. Events are tied to a random session ID, not to your identity.
• Server access logs: Retained by AWS Amplify and Cloudflare for the periods set by those providers (typically 30–90 days for operational logs).
• Anonymized data: Aggregated, anonymized data that cannot be used to identify you may be retained indefinitely for analytics and product improvement.

13. Data Security

We implement industry-standard security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption of data in transit (TLS) and at rest.
• Access controls and authentication for internal systems.
• Regular security assessments and monitoring.
• Incident response procedures for potential data breaches.

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any incidents.

Personal data breaches: where we are required to notify a supervisory authority under Article 33 GDPR, we will do so without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected visitors without undue delay under Article 34, describing the nature of the breach, likely consequences, measures taken, and a contact point for further information. Equivalent notifications are made under UK GDPR, PDPA Thailand, and California Civ. Code § 1798.82 where those laws apply.

14. Cookies & Local Storage

On first visit you see a consent banner with three buttons (Accept all, Reject all, Customize). Your choice is stored in your browser only and can be changed at any time through “Manage cookies” in the footer.

What runs today on sparks.qrious.social:

The strictly-necessary entries (consent record, quiz state, language, bot management) always run. Functional entries (display and scale preferences) and analytics entries (PostHog) load only if you give consent. No third-party advertising cookies run on Sparks.

Consent categories shown in the banner:

• Strictly necessary: Required for the site to function (consent record, quiz state, language, bot protection). These cannot be disabled.
• Functional: Remember your display preferences (visual mode, answer-scale style). Off by default; you can opt in through the cookie banner.
• Analytics, off by default: PostHog events that help us understand which assessments work and where the experience breaks. Only loads if you give consent.
• Marketing: No marketing scripts run today. If we add any in the future, they will only load if you have given consent.
• No advertising cookies, no cross-site tracking. We do not run third-party ad cookies and do not allow cross-site behavioral tracking. This is independent of the choice above.

Where required by law (EEA, UK), we ask for your consent before setting non-essential cookies and we do not assume consent from continued browsing. You can withdraw consent at any time from the “Manage cookies” link in the footer.

15. EU Representative (GDPR Art. 27)

As a company established outside the European Union but offering the Service to people in the EU, we have designated a representative under Article 27 of the GDPR. EU data subjects and supervisory authorities can address our representative on all matters relating to the processing of personal data.

Representative: Pablo Daniel Oba

Address: Berlin, Germany

Email: dpo@qrious.social

16. Contact

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, contact us at:

Privacy inquiries: privacy@qrious.social

Mail: Qrious Technologies Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA

17. Thailand (PDPA)

If you access the Service from Thailand, the Personal Data Protection Act B.E. 2562 (2019) applies in addition to the rights listed above. The Thai-language version of this policy is available; this section summarizes the rights and bases applicable to visitors in Thailand.

• Legal basis (Secs. 24 and 26). We process personal data on the basis of your consent, contractual necessity, our legitimate interest, or another lawful basis recognized under the PDPA.
• Your rights. You may request access, correction, deletion, restriction or objection to processing, data portability, and withdrawal of consent. You may lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.
• Cross-border transfers (Sec. 28). We transfer personal data to providers in Singapore, France, the United States, and Germany. Transfers rely on adequacy, your consent, contractual necessity, or appropriate safeguards as permitted under Section 28 PDPA.
• Sensitive personal data (Sec. 26). Information that may be inferred from your assessment answers (such as political views, religious beliefs, or sexual orientation) is computed in your browser and is not transmitted to our servers. We do not process sensitive personal data within the meaning of Section 26 PDPA in connection with your assessment results.

Privacy contact: privacy@qrious.social