Privacy Policy

01 Who we are

InfoSpark is a product of MossForge Ltd ("MossForge", "we", "us"). For data protection purposes, MossForge Ltd is the data controller for information collected through the InfoSpark website at mossforge.dev and the InfoSpark WordPress plugin.

If you have questions about this policy, please contact us at privacy@mossforge.dev.

02 What we collect

We collect the minimum necessary to run the service:

• Email address — provided when you register for an API key. Used to send your key, billing receipts, and critical service notices.
• API usage data — timestamps and credit counts for each generation request. Used for billing accuracy and abuse prevention.
• Billing data — handled entirely by Stripe. We store only a Stripe customer ID and your plan tier; we never see raw card numbers.
• Server logs — standard HTTP logs (IP address, user-agent, response code) retained for 30 days for security monitoring.

03 How we use it

Your data is used exclusively to:

• Deliver and authenticate your API key
• Track credit consumption and enforce plan limits
• Process payments via Stripe
• Send transactional emails (key delivery, low-credit warnings, receipts)
• Detect and prevent abuse of the API

We do not use your data for advertising, behavioural profiling, or any purpose not listed above.

04 Your WordPress post content

When you click "Generate" in the InfoSpark block, your post content is transmitted from your WordPress server to our API for processing. This is the most sensitive part of our data handling and we want to be specific about it:

• Post content is sent over HTTPS and held in memory only for the duration of the generation request (typically under 10 seconds).
• It is passed to the Anthropic Claude API to extract data and render the SVG. Anthropic's own privacy policy governs their handling of API inputs; as of our last review, Anthropic does not train on API request data by default.
• We do not log, store, or index your post content on our servers at any point.
• Generated SVG output is returned to your WordPress install and embedded in your post HTML. We do not retain a copy of the SVG.

05 Cookies & analytics

The InfoSpark marketing site (this website) uses a single first-party analytics cookie to count unique visitors. We do not use Google Analytics, Meta Pixel, or any third-party tracking scripts. No cross-site tracking takes place.

The InfoSpark WordPress plugin sets no cookies on your readers' browsers.

06 Data sharing

We share data with the following sub-processors only:

• Anthropic — receives post content transiently during generation. Anthropic privacy policy →
• Stripe — processes payments. Stripe privacy policy →
• AWS (Amazon Web Services) — hosts our API infrastructure in the eu-west-1 region (Ireland).

We do not sell, rent, or share your personal data with any other third party.

07 Data retention

• Account data (email, API key, plan) — retained while your account is active. Deleted within 30 days of a confirmed account deletion request.
• Usage logs — retained for 13 months for billing dispute resolution, then deleted.
• Server logs — retained for 30 days, then automatically purged.
• Post content — never retained beyond the generation request. Zero retention.

08 Your rights

Under UK GDPR and, where applicable, EU GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data
• Object to or restrict processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email privacy@mossforge.dev. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

09 Security

API keys are stored hashed in our database. All traffic between the WordPress plugin and our API is encrypted in transit via TLS 1.2+. Our AWS infrastructure is hardened using standard security group rules, and secrets are managed via AWS Secrets Manager. We conduct periodic security reviews.

No system is perfectly secure. If you discover a vulnerability, please disclose it responsibly to security@mossforge.dev.

10 Children

InfoSpark is not directed at or intended for use by anyone under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

11 Changes to this policy

We may update this policy from time to time. Material changes (for example, adding a new sub-processor or changing what we retain) will be communicated by email to registered users at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

12 Contact

MossForge Ltd
privacy@mossforge.dev

For general support: support@mossforge.dev