Privacy Policy

1. Introduction and data controller

This Privacy Policy describes how TimeSpark (hereafter “we”, “our service”) collects, uses and protects your personal data when you use our application available at timespark.site.

The data controller is TimeSpark, reachable at: [email protected].

By using TimeSpark, you accept the practices described in this policy. If you do not accept these terms, please do not use our service.

2. Data we collect

2.1 Account data

When you sign up, we collect your email address to create your account and authenticate you. Depending on the sign-up method you choose, a hashed password may also be stored.

2.2 Google Calendar data

When you connect your Google account, we access the following data through the Google Calendar API:

• The list of your Google calendars
• The events (title, date, start and end time) in your calendars
• Your Google email address, to link your TimeSpark account to your Google account

This data is used exclusively to detect available time slots, avoid scheduling conflicts and create or modify events on your behalf.

2.3 Audio data and Telegram messages

When you send a voice or text message through the TimeSpark Telegram bot, the audio content is sent to the OpenAI Whisper API for transcription. The transcribed or typed text is then analyzed by an AI model (OpenAI's GPT-4.1 mini, or OpenAI's GPT-4o mini as a fallback, called through OpenRouter) to extract scheduling information (task title, date, duration, priority).

Voice messages are not kept beyond immediate processing. The extracted text is stored as a task in our database.

2.4 Usage data

We record anonymized behavioral events (task created, positive/negative feedback, spark sent, etc.) in our database to improve the service and detect technical anomalies.

2.5 Payment data

Payments are processed by Stripe. We never store your card numbers or payment data. We only keep your Stripe customer ID and the status of your subscription.

4. Legal basis for processing (GDPR)

In accordance with the General Data Protection Regulation (GDPR), our processing relies on the following legal bases:

• Performance of the contract: processing required to provide the service (task creation, calendar sync, voice transcription).
• Explicit consent: access to your Google Calendar — you explicitly authorize this access through the Google OAuth flow.
• Legitimate interest: logging of usage events for service improvement and security purposes.
• Legal obligation: retention of billing data in accordance with accounting and tax obligations.

5. Sharing data with third parties

We never sell your personal data. We rely on the following subprocessors, which process your data only for the purposes described:

• SupabaseDatabase (PostgreSQL + Authentication)
  European Union (Ireland)
  Privacy policy →
• StripePayment processing
  United States / European Union
  Privacy policy →
• OpenRouterRouting of AI requests to OpenAI's GPT-4.1 mini model (message understanding, assistant)
  United States
  Privacy policy →
• OpenAIVoice message transcription (Whisper API) and the GPT-4.1 mini AI model
  United States
  Privacy policy →
• UpstashMessage queue and temporary working memory
  European Union (Frankfurt)
  Privacy policy →
• TelegramMessaging channel for voice/text input
  Dubai / European Union
  Privacy policy →
• GoogleGoogle Calendar API — event synchronization
  European Union / United States
  Privacy policy →
• MicrosoftMicrosoft Outlook Calendar API — if you connect an Outlook calendar
  European Union / United States
  Privacy policy →
• Meta (WhatsApp)Messaging channel — if you connect WhatsApp
  European Union / United States
  Privacy policy →
• ResendEmail delivery (account, booking confirmations)
  United States
  Privacy policy →

Each subprocessor is bound by contractual confidentiality and security commitments, and may only use your data for the purposes for which we share it.

Some of these subprocessors are based in the United States. These transfers outside the European Union are covered by the European Commission's Standard Contractual Clauses or by the EU–US Data Privacy Framework, depending on the subprocessor.

6. Data retention

• Account data and tasks: kept for the duration of your active subscription, then deleted within 30 days after cancellation.
• Synced calendar events: kept as long as needed for conflict detection, deleted when Google access is revoked.
• Payment data (Stripe): kept for 10 years in accordance with French legal accounting obligations.
• Usage logs: kept for a rolling 12 months.
• Voice messages: not kept after transcription.

7. Your rights (GDPR)

Under the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of all the data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): request the deletion of your personal data.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: object to certain processing based on legitimate interest.
• Right to restriction: request the temporary suspension of a processing activity.
• Right to withdraw your consent at any time (including Google Calendar access), without affecting the lawfulness of prior processing.

To exercise these rights, contact us at [email protected]. We will respond within a maximum of 30 days.

You may also lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr.

8. Security

We implement appropriate technical and organizational measures to protect your data:

• Communications encrypted via HTTPS/TLS
• OAuth tokens encrypted at rest (Supabase Row Level Security)
• Database access restricted by strict RLS rules (each user can only access their own data)
• Hardened authentication (Supabase Auth)
• Hashed passwords (bcrypt) — never stored in plain text

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you within 72 hours in accordance with Article 33 of the GDPR.

9. Cookies and local storage

TimeSpark uses a minimal number of cookies and local storage entries, strictly necessary for the service to work:

• Supabase session cookie: keeps you signed in between pages. Duration: browser session or 7 days depending on your settings.
• Language cookie (NEXT_LOCALE): remembers the site language you chose. Duration: browser session.
• Local storage (localStorage): interface preferences (e.g. theme). No personally identifiable data.

We use no advertising cookies, third-party trackers, or behavioral analytics tools such as Google Analytics.

10. Data of people who book via a booking link

When a user enables a public booking link (timespark.site/c/…), the people who book a slot (the "guests") provide us with their name, email address and time zone, plus an optional message.

• Purpose and legal basis: this data is used solely to organize, confirm and manage the meeting (legal basis: performance of the requested measure / legitimate interest). No marketing email is sent to a guest without their explicit consent, collected via a checkbox that is unchecked by default.
• Organizer privacy: the guest never sees the content of the organizer's calendar (no event titles or attendees) — only available slots.
• Retention: a meeting's data is kept for as long as needed to manage it, then deleted. The guest can cancel and delete their data at any time from the management link received by email.
• Processors: sending emails and invites (Resend), organizer calendar sync (Google / Microsoft) — see section 5.

11. Contact and changes

For any question about this policy or your personal data, contact us at:

We reserve the right to modify this policy at any time. In case of substantial changes, we will inform you by email or through an in-app notification at least 15 days before the changes take effect.

The current version is always available at: timespark.site/legal/privacy-policy