Privacy Policy

• Account information: name, email address, password (stored hashed), and role (student or tutor).
• Profile information: profile photo, biography, subjects, languages, timezone, hourly rate, and similar details.
• Tutor application data: qualifications, sample content, and other materials provided during onboarding.
• Booking information: lessons booked, attendees, scheduled times, and related metadata.
• Messages and communications you send through the platform or to our support team.
• User-submitted content such as reviews, lesson notes, and uploaded files.
• Newsletter and waitlist information: your email address, whether you are interested as a student or tutor, and any optional follow-up answers you choose to share (such as subject interests, learning or teaching intent, how you found CoreSpark, and a broad age range). Follow-up answers are always optional.

• Device and browser information (type, OS, language).
• IP address and approximate location derived from it.
• Authentication and session data needed to keep you signed in.
• Cookies and similar identifiers used for security and core functionality.
• Log and security events (request timestamps, error traces, suspicious activity signals).

CoreSpark uses a small number of trusted providers to operate the platform. Each has its own privacy practices.

CoreSpark uses cookies and similar technologies to keep you signed in, secure your account, and (with your consent) improve the platform. See our separate Cookie Policy for a complete list of cookies and third-party technologies we use.

Cookie Consent: On your first visit, we display a cookie consent banner. You can accept all cookies, reject optional cookies, or manage your preferences granularly:

• Functional cookies — always on, required for sign-in and payment processing.
• Analytics cookies — off by default; help us understand how you use CoreSpark.
• Advertising cookies — off by default; measure marketing campaign performance.
• Social media cookies — off by default; enable embedded content and sharing.

After consenting, you can change your preferences anytime by clicking "Cookie Preferences" in the footer. You can also manage cookies through your browser settings, but disabling essential cookies may break sign-in or payment flows.

• Create and operate user accounts.
• Process bookings, payments, and payouts.
• Operate the marketplace, including discovery and scheduling.
• Communicate with you about your account, bookings, and the service.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Improve the platform, including diagnosing issues and informing product decisions.
• Comply with legal, tax, and regulatory obligations.

We have Data Processing Agreements in place with each service provider to ensure compliance with applicable data protection laws.

• With other users when necessary for the service (for example, your tutor sees your booking).
• With service providers (Supabase, Stripe, hCaptcha, hosting) acting on our behalf.
• With authorities or other parties when required by law, court order, or to protect rights and safety.
• In connection with a business transfer such as a merger, acquisition, or asset sale, subject to applicable law.

We do not sell personal information to third parties for advertising.

• Account records are retained while your account is active and for 3 years after account deletion for tax, legal, and dispute purposes.
• Payment and booking records are retained for at least 7 years to comply with tax and financial reporting obligations, and longer if required by law.
• Logs, backups, and security events are retained for 90 days for operational and security purposes.
• Where applicable laws require longer retention (tax, anti-fraud, financial regulations), we follow those requirements.

In the event of a confirmed breach of personal information, we will notify affected users and relevant authorities as required by applicable law, typically within 72 hours of discovery.

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix inaccurate or incomplete information.
• Deletion — request that we delete your account and associated personal information, subject to legal retention requirements.
• Export — request your personal information in a portable format.
• Objection / restriction — where applicable law provides these rights.

To exercise these rights, contact us at contact@corespark.app. We will respond to your request promptly and in compliance with applicable law.

For users in the EU/UK, we process personal data under the following legal bases:

• Contract: Processing necessary to provide the CoreSpark platform (account creation, lesson bookings, payments, profile management).
• Legitimate Interests: Security and fraud prevention, platform improvement and analytics, customer support, legal compliance, and service optimization.
• Consent: Marketing communications (newsletters, promotional emails), optional profile visibility to other users, and non-essential cookies.

You have the right to withdraw consent at any time by updating your preferences or contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

StarPi, LLC has not appointed a Data Protection Officer. For data protection inquiries and to exercise your rights under this policy, please contact us at contact@corespark.app.

CoreSpark does not currently use artificial intelligence (AI), machine learning, or automated decision-making systems to make decisions that significantly affect you. Tutor ranking and search results are based on transparent, user-selected filters (subject, language, timezone, hourly rate, and availability) that you control.

If you have questions about whether a feature uses AI or automated decision-making, contact contact@corespark.app.

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know: Request the specific personal information we collect and the purposes.
• Delete: Request deletion of personal information collected from you.
• Opt-Out: Object to our processing or request we do not use your data for certain purposes.

Data Sharing & Categories: We share personal information with Stripe (payment processing and fraud prevention) and Supabase (authentication, database storage, and file hosting) as necessary to provide CoreSpark. We do not sell or share personal information for cross-context behavioral advertising.

To exercise any of these rights, contact contact@corespark.app.

If you are a California resident, this section supplements Section 10 above. We disclose our practices at the time of collection:

• What we collect: Name, email, password (hashed), profile info, booking data, device and IP info, cookies, and log events.
• Why we collect it: Provide CoreSpark, process payments, secure accounts, improve the platform, and comply with law.
• Who we share with: Supabase (database), Stripe (payments), hCaptcha (bot detection), and hosting providers. We do not share for cross-context behavioral advertising.
• Your rights: You may request access, deletion, or opt-out. Contact contact@corespark.app to exercise these rights.

CoreSpark operates in the United States. If you are located in the EU/UK, your personal data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate safeguards for cross-border transfers.

You may request a copy of our data transfer mechanisms by contacting contact@corespark.app.

CoreSpark currently targets users who are 18 or older. If we permit minors in the future, parental or guardian consent will be required where applicable law (such as COPPA in the United States or similar laws elsewhere) demands it, and additional safeguards will be documented before any minor accounts are enabled.

We use reasonable technical and organizational safeguards, including encryption in transit, role-based access controls, and third-party-managed authentication and payment systems. No system is 100% secure, and our service providers maintain their own security programs.

We may update this policy as the product and legal landscape evolve. Material changes will be communicated in-product or by email where appropriate. The “last updated” date above will always reflect the current version.

For privacy questions, contact contact@corespark.app. You may also mail your inquiry to 1225 Ave. Ponce De Leon, PH - 1751, San Juan, PR, 00907.