Privacy policy
Last updated November 8, 2026
This text is a draft that a lawyer is reviewing. It may change, and we will update the date above when it does.
Who we are
sferarc.com is the website of sferarc, a small product studio. The sferarc account is the single sign in that every sferarc product uses, and it is operated by sferarc. In this policy, "we" means sferarc. The legal entity behind sferarc is being formed, and its name, tax number and address will be added here when it exists.
This policy covers the sferarc website and the sferarc account. Each product also keeps information of its own, such as a school's lessons or a team's recordings, and has its own privacy policy for that.
What we collect
When you sign up: your name, your email address and, if you choose a password, the password, which we store only as a hash. We ask a product to confirm your email address before it gives you access.
When you sign in with Google: your name, your email address, your profile picture and your Google account identifier, which Google gives us for the scopes openid, email and profile. We do not ask for access to any other Google data, such as your mail, files or calendar, and we do not read it.
When you use the account: the organizations you belong to, your role in them, the invitations you send or accept, and the plan and billing status of your account.
When you browse sferarc.com: the page you ask for is served by our host, which keeps standard request logs. The website has no forms, no accounts and no analytics.
Why we use it
To create your account, sign you in, keep you signed in, send you the emails that the account needs (verification and password reset), and tell each product who you are and what plan you have.
To keep the service secure: to limit repeated sign in attempts, to spot abuse and to investigate problems.
To meet our legal duties, such as keeping invoices.
We do not use this information for advertising and we do not sell it.
Sessions and cookies
When you sign in, we create a session that lasts up to seven days, and a cookie in your browser that identifies it. The cookie is needed for you to stay signed in and is not used to follow you. A session record keeps its creation and expiry time, the address of the product it was created for, your IP address and your browser's user agent text.
The website sets no advertising or analytics cookies. Your colour theme choice stays in your browser.
Security logs and rate limiting
To slow down guessing and abuse, we count requests to the sign in endpoints per IP address and keep those counters for a short time. Our host and our database keep operational logs that include IP addresses and are used only to run and secure the service. A password reset signs you out of every session.
Who we share it with
We use service providers that process information on our behalf, and each receives only what it needs for its task:
Vercel hosts the website and the account service. PlanetScale hosts the account database. Resend sends the account's emails. Stripe processes payments and subscriptions for products that bill through the account. Google is the sign in provider when you choose it, and it receives the fact that you signed in to sferarc.
A product you sign in to receives your name, email address and the plan of your account so it can work. When you sign in to a product, that product's own policy applies to what it keeps.
We may disclose information when the law requires it. We do not sell personal information.
International transfers
Some providers, such as Vercel, Resend, Stripe and Google, are based in or run services from the United States. Where information leaves the European Economic Area, we rely on the safeguards the law allows, such as the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
We keep your account information while the account exists. A session is removed when it expires or when you sign out, and rate limiting counters expire within minutes. When you delete your account we delete its information, except what the law requires us to keep, such as billing records. Provider logs follow each provider's own retention period.
Your rights
You can ask for access to your information, and for its correction, deletion, restriction or transfer, and you can object to its use. You can withdraw a consent at any time. To use any of these rights, write to hola@sferarc.com from the email address of your account, and we answer within one month.
You can also complain to your data protection authority. In Spain it is the Agencia Española de Protección de Datos (aepd.es).
Products and their policies
The information a product keeps is covered by that product's own privacy policy. Where a product processes information for its customers, such as a school, that customer decides how it is used and we process it on the customer's behalf.
Changes
We update this page when our practices change and show the date of the last change at the top. We tell account holders before a material change takes effect.
Contact
Write to hola@sferarc.com about this policy or your information.