Legal
Privacy Policy
In short
AlphaSpark is an experimental lab. We collect only what we need to run your account and the tools you use (your login details, the investment profiles you build, and any pitch decks you upload), plus product analytics if you allow them. We use a small number of named service providers to do this, and we never sell your data. The service is offered as-is, so please do not upload anything you cannot afford to lose or that you are not allowed to share.
1. Who we are (Scope and Controller)
This Privacy Policy explains how Martino Bagini, an individual resident in Italy who operates AlphaSpark ("AlphaSpark", "we", "us"), processes personal data when you visit alphaspark.it, use the application at app.alphaspark.it, or otherwise interact with us (together, the "Service").
Data controller: Martino Bagini, Via Arcivescovo Calabiana 6, 20139 Milano (MI), Italy.
Privacy contact: data@alphaspark.it
Data Protection Officer: none appointed, as one is not required for this Service. Please send all privacy questions and requests to the privacy contact above.
This policy covers personal data about you as a user. It also covers personal data about third parties (for example, founders named in a pitch deck) that you upload to the Service; see section 3.4.
Experimental service. AlphaSpark is an experimental, pre-release service. Features, data flows and the providers listed below may change while we iterate. We will update this policy when they do (section 12).
2. Information we collect
2.1 Information you give us
- Account data. Name, email address, and password (stored only as a secure hash by our authentication provider). If you choose "Continue with Google", we receive your name, email address and profile picture from Google.
- Investment profile data. The thesis statements and parameters you enter, such as entity and vehicle type, fund or vehicle size, stage focus, ticket size, instruments, geographies, sectors, governance and involvement preferences. Some of these may reveal information about your professional or financial situation.
- Simulation inputs. Hypothetical or real startup metrics you enter (stage, sector, ARR, growth, margins, valuation, round size and similar).
- Uploaded documents. Pitch decks and other PDFs you upload for extraction, and the structured data we extract from them.
- Communications. What you send us when you contact us or give feedback.
2.2 Information collected automatically
- Technical and log data. IP address, browser type, device information, timestamps, pages and API endpoints requested, and error logs. Our servers and providers collect these to keep the Service running and secure. These providers are Cloudflare, which provides DNS for our domains and serves our static website, and Railway, which hosts our application and API. Cloudflare also routes traffic to our API (api.alphaspark.it), including the content you send to it.
- Strictly necessary cookies and local storage. Cookies and browser storage set by our authentication provider (Clerk) to keep you signed in, and by Cloudflare for security and bot protection (see section 5).
- Product analytics and session recordings (only with your consent). If you accept analytics, PostHog collects:
- usage events: pages viewed, buttons and links clicked and features used, captured automatically, and events the Service records when you complete an action, such as uploading a deck, opening an analysis or saving a profile. These events carry only counts, durations and fixed categories, for example: how many pages a deck has and how many of its fields the extraction filled or left empty; how many of your profile's criteria a deck left unanswered; the recommendation an assessment returned (invest, not invest or request information); how long each step of the profile builder took; how many fields you approved or edited in a review; and how many profiles, extractions and decks your account holds. They never include company or profile names, file names, deck text, extracted values or your profile's parameters;
- session recordings: a replay of your visit (page layout, clicks, scrolling and mouse movement), used to find bugs and confusing parts of the interface;
- approximate location derived from your IP address, device and browser information, and a pseudonymous identifier linked to your account.
We configure PostHog to mask everything you type and the content shown on profile, simulation and deck pages (including deck text and extracted data). Recordings therefore show the interface, not your investment data or the contents of decks. We do not record network request or response contents.
We do not use advertising or marketing cookies.
2.3 Information from third parties
- Google (if you use Google sign-in): basic profile information as described above.
3. How we use data and our legal bases (EU/EEA and UK GDPR)
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and manage your account, authenticate you | Account data, auth cookies | Performance of a contract (6(1)(b)) |
| Provide the tools: store profiles, run simulations, extract data from decks, generate fit analyses | Profile data, simulation inputs, uploaded documents | Performance of a contract (6(1)(b)) |
| Keep the Service secure, prevent abuse, debug errors | Technical and log data | Legitimate interests (6(1)(f)): running a secure, working service |
| Improve and develop the experimental Service, using aggregated or de-identified usage information | Technical data; de-identified content statistics | Legitimate interests (6(1)(f)): improving the product |
| Respond to your messages and send essential service notices (for example, changes to these terms, or a shutdown) | Account data, communications | Performance of a contract; legitimate interests |
| Newsletters and product updates (only if you sign up for them) | Email address, name | Consent (6(1)(a)), which you can withdraw at any time via the unsubscribe link in every email or by writing to data@alphaspark.it |
| Product analytics and session recordings (PostHog): understand which features are used, where users get stuck, and how well the tools work (for example, how complete extractions are) | Usage events with the counts and categories described in section 2.2, masked session recordings, cookie and device identifiers, pseudonymous user ID | Consent (6(1)(a)), given through the cookie banner and withdrawable in Cookie settings |
| Comply with legal obligations, respond to lawful requests, establish or defend legal claims | Any relevant data | Legal obligation (6(1)(c)); legitimate interests |
You are not legally required to give us any personal data. Account data is needed to create an account; without it, we cannot provide the Service. Uploading decks and other content is optional. Refusing analytics has no effect on what you can do in the Service.
3.1 AI processing
Some features send the content you provide (for example, the text of an uploaded deck or your profile parameters) to OpenAI through its API, to extract or classify information and generate analyses. Under OpenAI's API terms, content sent through the API is not used to train OpenAI's models. OpenAI may keep API inputs and outputs for up to 30 days to monitor for abuse, and then deletes them. Outputs are generated automatically, may be inaccurate, and are not investment advice.
3.2 No automated decisions with legal effect
The Service produces scores and classifications to support your judgement. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
3.3 No sale of data
We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.
3.4 Third-party personal data in uploaded content
Pitch decks often contain personal data about other people (founders' names, photos, bios, contact details, shareholdings). By uploading such content you confirm that you have the right to share it with us for this purpose, and that doing so is consistent with any confidentiality obligations you have. We process this data only to provide the feature you requested and do not use it to contact the individuals concerned. Individuals who believe their data has been uploaded can contact us at data@alphaspark.it.
4. Sharing and third-party services
We share personal data only with:
- Service providers (processors) acting on our instructions, under data processing agreements:
| Provider | Role | Data involved | Location |
|---|---|---|---|
| Clerk, Inc. | Authentication and user management, including sign-up and verification emails | Account data, auth cookies, IP and device data | USA |
| Railway Corporation | Application and API hosting, database, and storage of uploaded files | All data stored in the Service | EU (Railway EU West region) |
| Cloudflare, Inc. | DNS, hosting of our static website (Workers), proxying of our API, and security and bot protection | IP address and request metadata of website visitors; API requests and responses in transit, including content you upload | Global edge network (USA-headquartered) |
| OpenAI, L.L.C. | AI extraction, classification and analysis through the API | Uploaded document text, profile and simulation inputs | USA |
| PostHog, Inc. | Product analytics and session recordings (consent only) | Usage events, masked session recordings, device data, pseudonymous ID | EU (PostHog EU Cloud, Frankfurt) |
- Google, as an independent controller, when you choose "Continue with Google". Google confirms your identity and shares your name, email address and profile picture with us. Google's own privacy policy applies to its processing.
- People you choose to share with. If you use share or export features, the content you share will be visible to its recipients. Shared investment profiles are published through a link: anyone with a share link can view the shared content until you revoke the link.
- Professional advisers and authorities, where needed to comply with law, enforce our terms, or protect rights, safety and property.
- A successor entity, if the Service is transferred to a company (for example, one set up to operate AlphaSpark), or is merged or acquired. This policy will continue to apply to your data, and we will notify you of the new controller.
5. Cookies and similar technologies
We use two kinds of cookies and similar technologies:
- Strictly necessary cookies, which the Service needs to work and which do not require consent under EU e-Privacy rules;
- Analytics cookies and storage (PostHog, including session recordings), which we set only if you accept them in our cookie banner. You can change your choice at any time through the "Cookie settings" link in the footer.
| Name | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
__session, __client, __client_uat (and suffixed variants) |
Clerk | Strictly necessary | Keep you signed in; secure your session | Session to ~1 year (provider-defined) |
__clerk_environment (local storage) |
Clerk | Strictly necessary | Authentication configuration | Until cleared |
__cf_bm, _cfuvid, cf_clearance (when set) |
Cloudflare | Strictly necessary | Bot protection, rate limiting, security challenges | 30 minutes to session (cf_clearance per configuration) |
as_consent |
AlphaSpark | Strictly necessary | Remember your cookie choices | 6 months |
ph_<project key>_posthog (cookie and local storage), plus PostHog session-storage keys |
PostHog | Analytics (consent) | Pseudonymous identifier and session ID, for usage analytics and session recordings | Cookie up to 1 year; session storage until the tab closes |
We do not use advertising or marketing cookies. You can also block or delete cookies in your browser settings, but the Service will not work without the strictly necessary ones.
6. International transfers
Our application, database and uploaded files are hosted by Railway in the EU, and PostHog stores analytics data in the EU (Frankfurt). Some processing still takes place outside the EEA: Clerk (authentication), OpenAI (AI processing of the content you submit) and Google (sign-in) process data in the United States, and Cloudflare operates a global network. Railway and PostHog are US companies and may access EU-stored data from outside the EEA for support and maintenance. Where personal data is transferred outside the EEA/UK, we rely on an adequacy decision (including the EU–US Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You can request a copy of the relevant safeguards at data@alphaspark.it.
7. Data retention
We keep personal data only as long as needed for the purposes above:
| Data type | Suggested retention |
|---|---|
| Account data | While your account is active; deleted within 30 days of account deletion |
| Investment profiles and simulations | While your account is active, or until you delete them; deleted within 30 days of account deletion |
| Uploaded decks (original files) | Until you ask us to delete your account, or until you delete the deck yourself where the app allows it; deleted within 30 days of the request |
| Extracted structured data from decks | Same as uploaded decks |
| Inactive accounts | If an account has had no sign-in for 24 months, we email you, then delete the account and its content 30 days later unless you sign in |
| Server and security logs (Railway) | Up to 7 days (longer only if needed to investigate an incident) |
| Backups | Overwritten on a rolling cycle of up to 30 days |
| Support communications | Up to 24 months after the last contact |
| Records needed for legal claims or obligations | For the applicable limitation period |
| Product analytics events (PostHog) | Up to 12 months, then deleted; deleted on account deletion |
| Session recordings (PostHog) | Up to 30 days |
| Edge and security logs (Cloudflare) | Per Cloudflare's standard retention (short-lived; we do not export them to long-term storage) |
| Data sent to OpenAI | Up to 30 days for OpenAI abuse monitoring, then deleted (zero retention, if enabled) |
Because the Service is experimental, data may also be lost earlier than these periods (see the Terms of Service). Do not rely on the Service as your only copy of anything.
8. Security
We use reasonable technical and organisational measures appropriate to an early-stage service, including encryption in transit (HTTPS/TLS), Cloudflare's edge protection against attacks and bots, delegated authentication through Clerk with hashed passwords, access controls limiting who can reach production data, and provider-level encryption at rest where available. No system is completely secure, and as an experimental service we cannot guarantee the security of your data. If a personal data breach is likely to put you at risk, we will notify you and the competent authority as the law requires.
9. Your rights
If you are in the EEA, the UK or Switzerland, you have the right to:
- Access your personal data and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict processing in certain circumstances;
- Data portability: receive data you provided in a structured, machine-readable format (you can also use the export feature);
- Object to processing based on legitimate interests;
- Withdraw consent at any time, where processing is based on consent, without affecting earlier processing;
- Lodge a complaint with a supervisory authority, in particular in your country of residence, place of work, or where an alleged infringement occurred. In Italy, this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
To exercise your rights, email data@alphaspark.it from the address linked to your account. We will respond within one month (extendable by two months for complex requests) and may need to verify your identity. To delete your account and everything in it, email data@alphaspark.it from your registered address or use Account settings → Delete account, once available. We will confirm, and complete the deletion within 30 days.
10. Children's privacy
The Service is a professional tool for investors and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact data@alphaspark.it and we will delete it.
11. Links to other services
The Service may link to third-party websites or services. Their own privacy policies apply, not this one.
12. Changes to this policy
Because AlphaSpark is experimental, we may update this policy as the Service changes. We will post the new version with a new effective date and, for material changes, notify you by email or in the app before they take effect. Earlier versions are available on request.
13. Contact
Martino Bagini (AlphaSpark)
Via Arcivescovo Calabiana 6
20139 Milano (MI), Italy
Email: data@alphaspark.it