How LearnSpark handles your data.

GenSpark Solutions Limited · Last updated: [date] · Effective: [date]

1. Who we are

LearnSpark is a training platform operated by GenSpark Solutions Limited, registered in Ireland (CRO [CRO number]), Castlebar, Co. Mayo ("GenSpark", "we"). Contact: privacy@genspark.ie.

Two roles apply. When your employer or a training institute enrols you in a course, they decide why your training records exist and receive cohort results; for that processing GenSpark acts as their processor. For running the platform itself (accounts, security, diagnostics, product improvement) GenSpark is the controller. [Confirm the controller/processor split with your adviser and with NIBRT's DPA.]

2. What we collect

• Enrolment data: your name, work email, company, and optionally your job title and site, entered when a seat is claimed with a class code. Your cohort and seat assignment. Alumni access codes issued to you.
• Training activity: exercise responses, the decisions you make and the reasoning you write down, scores against the course rubric, drafts, progress and completion, session timestamps.
• AI interaction content: the messages you exchange with AI features during exercises, and the steps an AI agent takes under your supervision.
• Learner memory: short notes the platform derives from your exercise work about your professional context (for example your role and the systems you work with), used to make later exercises relevant to you. These are limited to professional context and you can delete them at any time.
• Certificates: a record of course completion issued in your name, kept as a training record.
• Technical data: device type, app version, and first-party diagnostic logs (for example which screen an error occurred on) used for security and reliability.

A note on how email is stored: your real email address is kept in your enrolment profile and shown to your instructor. Sign-in uses an internal identifier rather than your email, so LearnSpark never emails you unless you request alumni access.

3. What we do not collect

No advertising identifiers, no location data, no contacts, no tracking across other apps or websites. We do not use advertising, analytics or tracking SDKs; usage and error data stay in our own database. We do not sell personal data.

4. Why we process it

To deliver the training you or your organisation enrolled in (contract). To score exercises and provide instructor and cohort analytics (contract, and the legitimate interests of your organisation in training outcomes). To secure and improve the service (legitimate interests). To meet legal obligations. Where your employer or a training institute enrols you, they determine the purposes of training records and receive cohort results.

5. AI processing

Exercise content you submit to AI features, including your messages and the exercise context, is processed through our server-side integration with Anthropic's API. API keys are held on our servers and never on your device. Content is transmitted securely for the sole purpose of generating responses within the exercise. [Once the Anthropic Data Processing Addendum is executed: "Under our agreement with Anthropic, your content is not used to train their models."]

6. Where data lives

Application data is stored with Supabase in the AWS eu-west-1 region (Ireland). AI inference is performed by Anthropic in the United States; that transfer relies on [Standard Contractual Clauses / the EU-US Data Privacy Framework, as named in the Anthropic DPA]. Where any other sub-processor handles data outside the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.

7. Sub-processors

8. Retention

Training records, including your responses, scores, AI interaction content and learner memory, are retained until you or your training institution request deletion, or until [a fixed period after the engagement ends, if you decide to set one and build the purge]. Diagnostic logs are deleted after 90 days and unsubmitted drafts after 60 days. Certificates are retained as training records on behalf of your organisation. Aggregated, non-identifiable data may be retained to improve course design.

9. Your rights

Under the GDPR you may request access, rectification, erasure, restriction and portability, and object to certain processing. Contact privacy@genspark.ie; we respond within one month. Where GenSpark processes data on behalf of your training institution, we may direct your request to them. You may lodge a complaint with the Data Protection Commission (dataprotection.ie).

10. Deletion and export

Export and deletion are built into the platform. From your profile you can download your training data for your current enrolment, and you can delete your account, which permanently removes your account and the training data linked to it. Three things to know:

• In a classroom, two learners share one seat. Deleting that account removes the shared workspace for both. Ask your instructor if you are unsure.
• The export covers your most recent enrolment. For earlier enrolments, email us and we will provide them.
• Instructor accounts are deleted on request by email, not in the app, because they are linked to cohort records.

11. Children

LearnSpark is a professional training tool for workplace learners and is not directed at children under 16.

12. Security

Encryption in transit. Row-level security scoped to your organisation, verified by an automated cross-tenant test suite. AI keys and service credentials held server-side only. Least-privilege access for our two-person team, with an audit trail of security fixes. [Add anything else true and specific your adviser wants stated.]

13. Changes

We will post updates here with a revised date. Material changes will be notified through the app or your institution.

Support

For help with the app: support@genspark.ie or the contact page.