Privacy notice

Your review request

The form asks for your name, work email, school or organization, and a description of your materials. You may also attach a document or provide a document link. We use these details to review your request, reply, prepare a quote, and discuss your project.

We don’t save or transmit your contact details, description, document link, or file while you type, select a file, or leave the page. Clicking the submission button sends them to us. Anonymous interaction counts, including that a form was started, are described below. If sending fails, your answers remain in the open form so you can retry.

Please remove student information and other confidential details before sharing. This form is for school materials, not student records. Document links are included in your request for our review; the website does not automatically open or download them.

Uploaded documents

You can submit one PDF or DOCX up to 10 MB. After submission, the file passes format checks and antivirus scanning through a private Google Cloud service before accepted bytes are stored in private Cloudflare storage. The scanner uses temporary files that are removed after processing. Scanning reduces risk; it cannot guarantee that every unsafe file will be detected.

We store the accepted file and associated metadata, including its filename, type, size, submission identifier, fingerprint, and expiry. Our notification email contains an authenticated review link rather than an attachment or public file link. Only authorized Studio reviewers who sign in with an emailed code can download a confirmed, unexpired upload.

How long information stays

Submitted inquiry details

Completed requests expire from private dashboard storage after seven days. The notification email and subsequent correspondence are separate copies.

Accepted uploads

Reviewer access expires seven days from the initial upload. Scheduled cleanup removes expired files and their metadata. A separate seven-day storage lifecycle provides a deletion backstop.

Incomplete file submissions

If a file is stored but the inquiry does not complete, it expires after 23 hours. Cleanup runs every 15 minutes and targets deletion within 24 hours. Service outages can delay physical deletion; expired files are not available through the review endpoint.

Email, downloaded copies, and project files

The seven-day upload and dashboard limits do not delete email or reviewer-downloaded copies. We retain correspondence and working files as needed to respond, carry out an agreed project, and keep business records. These copies have no automatic seven-day deletion schedule. Contact us about removal.

Website statistics and security records

Our aggregate activity counters and hashed submission records have no automatic expiry. IP-derived rate-limit records generally expire after two hours; the scanner’s daily usage limit expires after two days. Expired document-service security records are removed by scheduled cleanup. Provider-managed operational logs and backups follow the provider’s retention settings.

Analytics and browser storage

The homepage loads Google Analytics automatically unless an exclusion applies. It uses cookies to understand visits and basic engagement. We configure Google’s analytics cookies for 90 days; repeat visits can refresh that period. Google processes technical information such as browser and device data. Google Analytics data retention is controlled separately in the service’s account settings.

The page data we configure for Google excludes form answers, attachments, document links, page query strings, and URL fragments. Referrers are reduced to the referring site’s origin. Advertising storage, ad personalization, and Google signals are disabled. See how Google uses information from sites that use its services.

We also collect aggregate counts for page views, scroll depth, service-link clicks, form starts, and confirmed inquiries. These include a broad source category such as search or referral, visit day and hour, and approximate city, region, and country supplied by our host. These counters do not contain your name, email, form text, document, or raw IP address. Our servers use IP-derived hashes for abuse prevention and a hashed submission identifier to avoid double-counting delivered requests.

To stop Google Analytics and our browser activity counts on this browser, visit Studio with analytics disabled. This saves an exclusion in local storage on the hostname you visit; repeat it on another browser, device, or hostname you use. Clearing site storage removes the saved exclusion. Google Analytics also honors Global Privacy Control, Do Not Track, and previously saved refusals. Those Google exclusions do not disable our separate aggregate counts. Opting out does not prevent the form from working, delivery records, or essential security processing.

Cloudflare also adds a cookie-free Web Analytics beacon to measure page loads and website performance, including on this notice page. It runs separately from the Google and Studio exclusions above. See Cloudflare’s Web Analytics explanation.

Authorized reviewers use an essential, secure sign-in cookie that expires after one hour. Emailed sign-in codes expire after ten minutes. This notice page does not load Google Analytics or our own activity-counting script.

Services that process information

Cloudflare hosts the website, inquiry services, private storage, and operational statistics. Google Cloud processes uploaded files for scanning. Resend delivers inquiry notifications and reviewer sign-in codes, and Google Workspace handles our Studio mailbox. These providers process the information needed to deliver their services, including ordinary network and security information such as IP addresses. Information may be processed outside your state or country.

We share submitted materials with the authorized Studio team to review and respond to your request. If you become a client, we agree on project scope and file delivery separately.

Privacy questions and requests

Email michelle@sparkeducationstudio.com to ask about this notice or request access, correction, or deletion of information you shared. Include the email address used for your inquiry and its approximate date; don’t send sensitive documents just to identify it. We may need to verify your identity before acting and will explain any information we need to retain for an ongoing project or business records.

We’ll update this page when our practices change and revise the date above.