Legal
Privacy notice
What Spontar processes, why, for how long, and what it deliberately never collects.
This notice describes what the Spontar software does with personal data. It is written to be read rather than to be defensible, and where something is unusual it says why.
Who is responsible
For this website, the controller is Hamed Ghaderipour, Germany — hello@spontar.com.
For everything inside the product, your institution is the controller and we are the processor. A school or studio decides which students are on its lists, what is recorded about a session, and how long it is kept. We process it on their instructions under a processing agreement.
The one thing worth knowing first
There is no email address for a student anywhere in the system. Students do not sign in at all: they hold a Cue, a device the institution owns, which the teacher hands to them by name in each lesson. No parent contact details are collected either.
This costs us a support channel and removes an entire category of risk. It is the design decision most of this notice follows from.
What is processed, and why
People
For a student: a name their teacher typed, which groups they are on, a record that parental consent exists where one is needed, which Cue they were given, the lesson records below and any scores the teacher chose to give. No username, password, email address or birth date. For a teacher or an institution owner, the same plus an email address, because staff need to be contacted.
Sessions
While a session runs, the system holds who is present, which role each person is playing, and which beat is theirs. Afterwards it keeps a record of the session: the scenarios used, who was there, the cast, how far each run got, any optional per-student scores, and the note the teacher wrote on the lesson.
Session records are visible to the teaching teacher and to nobody else. Not the head of department, not the institution's owner, and not us in ordinary operation. They are deleted after twelve months by default; an institution can set the window as low as thirty days.
Devices
Each Cue holds a key it generated itself on first start and registers the public half with us, along with an identifier derived from that key and a label. The identifier is not derived from any hardware identifier — a persistent hardware identifier would be exactly the kind of tracking this product exists without.
Usage figures
Separately from all of the above, the system keeps aggregate figures: how many sessions ran, which scenarios were used, how long, how many people attended. These contain no student — no name, no identifier, no per-student row — and they are kept indefinitely.
The two records are never joined. That separation is what lets an institution's owner see whether the product is being used without seeing how a child performed.
What is never collected
- No student email addresses, and no contact details for anyone under eighteen.
- No location, at any point, on any surface.
- No camera and no microphone access. There is no recording of any kind.
- No advertising identifiers and no advertising technology.
- No analytics SDK on the student surface of the app.
- No behavioural profiling of anyone.
Artificial intelligence
Spontar has three optional AI features: helping a teacher shape a scenario, reading the column headings of a class list during import, and writing a paragraph of prose about an institution's usage figures.
Apart from the class-list import described below, no AI model receives student data. The code path from session data to a model does not exist: it is prevented by the type system, checked again at runtime on every call, and asserted by a test that fails the build. Nothing about a student is inferred, scored or predicted by a model, and no automated decision is made about anybody.
During a class-list import the model sees the column headings and at most five sample rows, so that it can tell which column holds a name. Those five rows are shown to a human for review before anything is created.
Where the data is
Google Cloud, region europe-west3 — Frankfurt. Every institution is assigned a
data-residency zone when it is created and at present every zone is the EU one. In the
ordinary course of operating the service, nothing is transferred to a third country.
Who else touches it
Four sub-processors, each with a purpose and a region: the current list is published here, versioned and dated.
Legal bases
- Staff accounts and the operation of the service: performance of the contract with the institution, Art. 6(1)(b) GDPR.
- Student records and session records: processed on the institution's instructions under Art. 28 GDPR. The institution's own basis is usually its public task or its legitimate interest, and that is theirs to determine.
- Under-16s in the EU and under-13s in the US: the institution records that parental consent exists before a session can start. We never contact a family — the school holds that relationship and should keep it.
- Website analytics: consent, Art. 6(1)(a), and nothing is set before it is given.
How long things are kept
| What | How long |
|---|---|
| Live session state (cues, presence) | Destroyed when the run ends |
| Session records, scores and teacher notes | 12 months by default, 30–730 configurable |
| Revoked device registrations | 90 days, then deleted |
| Usage figures | Indefinitely — they contain no student |
| Acceptance of agreements | Indefinitely — it is evidence |
| Credential PDFs in storage | 15 minutes |
| Administrative audit log | 24 months |
Deletion is performed by a job that runs daily and reports what it could not delete. A run that leaves anything past its window raises an alert, because a retention job that fails quietly is a breach rather than a bug.
Your rights
Access, rectification, erasure, restriction, portability and objection, under Arts. 15–21 GDPR. Ask your institution first — they are the controller, they can act immediately, and the software has both an export and a deletion function built in for them to use. If they need us, we help them.
You may also complain to a supervisory authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
This website
Fonts are served by Bunny Fonts, which is hosted in the EU and logs no IP addresses. There is no chat widget, no heatmap and no advertising pixel. If analytics is enabled it is Google Analytics 4 with IP anonymisation, and it does not run until you accept it — refusing sets nothing at all.
The app is different and stricter: the student surface carries no analytics of any kind, ever. Different surfaces, different rules, and this is the distinction.
Changes
This notice is versioned. The version and effective date are at the foot of this page, and the same version is what your institution is recorded as having accepted — the two cannot drift apart, because both are generated from one file.