Spark Studio Ltd
Sub-processors
Last updated: 5 September 2026
Spark is built on a small number of other companies' services. This page names all of them, says what each one does, and says where each one processes data. It is the current and authoritative list referred to in clause 6.2 of our Data Processing Agreement and in section 9 of our Privacy Policy.
We keep the list short on purpose. Every company on it is one more place your data sits, so we add one only when the alternative is not building the feature at all.
Suppliers who process member data
These companies process personal data belonging to your members, on your behalf. For this data you are the controller, we are your processor, and each company below is our sub-processor. They are bound by written terms no less protective than our Data Processing Agreement, and they may only use the data to provide their service to us.
Vercel Inc.
- What it does
- Hosts the Spark dashboard and the application layer through which member data passes
- Where it processes
- United States
- Transfer safeguard
- UK International Data Transfer Agreement
Supabase Inc.
- What it does
- Provides the database, file storage and sign-in used to store member data
- Where it processes
- European Union
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses
Anthropic PBC
- What it does
- Drafts Push Agent message copy
- Where it processes
- United States
- Transfer safeguard
- UK International Data Transfer Agreement
| Supplier | What it does | Where it processes | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Hosts the Spark dashboard and the application layer through which member data passes | United States | UK International Data Transfer Agreement |
| Supabase Inc. | Provides the database, file storage and sign-in used to store member data | European Union | UK Addendum to the EU Standard Contractual Clauses |
| Anthropic PBC | Drafts Push Agent message copy | United States | UK International Data Transfer Agreement |
About Anthropic. Push Agent sends your instruction, your chosen tone and your business details to Anthropic to draft message copy. It does not send member records, member names or member email addresses. Anthropic does not train models on anything we submit, and neither do we. That is a contractual commitment, not a setting.
Suppliers who process our own data
These companies process personal data for which Spark is the controller, which means data about you and your business, and data about visitors to our website. They are not sub-processors of member data. They are listed here because you should be able to see the whole picture in one place.
Stripe Payments Europe Ltd
- What it does
- Takes payment and manages subscriptions. Full card numbers are entered directly into Stripe and never reach us
- Where it processes
- Ireland, with onward transfer to the United States
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses
Resend Inc.
- What it does
- Sends service and marketing email to merchants. Does not send email to members
- Where it processes
- United States
- Transfer safeguard
- UK International Data Transfer Agreement
Google LLC
- What it does
- Website analytics through Google Analytics, on sparkloyalty.co.uk only. Not used in the dashboard
- Where it processes
- United States
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses
Microsoft Corporation
- What it does
- Website analytics and session recording through Microsoft Clarity, on sparkloyalty.co.uk and, only where a merchant has agreed, in the merchant dashboard. Never on join pages or cards, and member names and details on screen are masked in any dashboard recording, so it never receives member data. Microsoft also uses this data for its own purposes and acts as a controller in its own right
- Where it processes
- United States
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses
| Supplier | What it does | Where it processes | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe Ltd | Takes payment and manages subscriptions. Full card numbers are entered directly into Stripe and never reach us | Ireland, with onward transfer to the United States | UK Addendum to the EU Standard Contractual Clauses |
| Resend Inc. | Sends service and marketing email to merchants. Does not send email to members | United States | UK International Data Transfer Agreement |
| Google LLC | Website analytics through Google Analytics, on sparkloyalty.co.uk only. Not used in the dashboard | United States | UK Addendum to the EU Standard Contractual Clauses |
| Microsoft Corporation | Website analytics and session recording through Microsoft Clarity, on sparkloyalty.co.uk and, only where a merchant has agreed, in the merchant dashboard. Never on join pages or cards, and member names and details on screen are masked in any dashboard recording, so it never receives member data. Microsoft also uses this data for its own purposes and acts as a controller in its own right | United States | UK Addendum to the EU Standard Contractual Clauses |
Apple and Google Wallet
Apple and Google are not sub-processors. When a card is delivered to a member's wallet, they act as independent controllers for what happens on the member's own device, including whether a card appears on a lock screen and how a notification is shown. Their own privacy policies apply to that, and we do not control it.
Spark is never told where any member is. Where you switch on lock screen relevance, your own trading locations are included in the card and the decision to display it is made on the device.
Changes to this list
Before we add a supplier who will process member data, or replace one, we give at least 30 days' notice. We update this page and we email the address on your account.
If you want to object to a change on data protection grounds, email support@sparkloyalty.co.uk within 30 days of that notice. Clause 6.3 of the Data Processing Agreement sets out what happens next, including your right to end your subscription without penalty if we cannot resolve it.
Asking us for more
For the transfer safeguards that apply to a particular supplier, for the transfer risk assessment behind them, or for a countersigned copy of our Data Processing Agreement, email support@sparkloyalty.co.uk.
Change log
- 4 September 2026. Microsoft Clarity entry amended: session recording now also runs in the merchant dashboard where a merchant has agreed. Never on join pages or cards.
- 27 July 2026. First published.
Spark Studio Ltd, trading as Spark Loyalty
Registered in England and Wales, company number 17267086
48 Crowestones, Buxton, England, SK17 6NZ