Privacy notice

01Controller and scope

Sponge Theory, identified with its address in the Legal notice, is the controller for the processing it determines for the SPT Models website, enquiries addressed to it and its customer relationships. Data protection contact: contact@sponge-theory.ai, or post to the registered office.

This notice covers that processing, not processing a customer determines in its own installation. Requests, files, results and logs in an installation depend on its models, settings and integrations. The operator informs its users and determines the applicable obligations. Local inference does not exclude external communications configured by that operator, model downloads or information voluntarily sent to support.

02Data, purposes and legal bases

• Website operation and security: IP address, timestamp, requested page and technical details may appear in server logs. The legal basis is our legitimate interest in providing an available website and preventing or investigating incidents and misuse.
• Enquiries: email address, supplied identity, request and attachments allow us to respond. The basis is taking pre-contractual steps at your request when an enquiry concerns a potential purchase; for other correspondence, our legitimate interest in responding to people who contact us.
• Orders, downloads and support included in an offer: customer details, order reference and correspondence are necessary for contract performance. Billing information needed for our accounting and tax duties is processed to comply with those legal obligations. Payment takes place through Lemon Squeezy; do not send us your payment card details.
• Audience and performance: the Oriflux data described below is processed on the basis of your optional, revocable consent.
• Data rights requests and complaints: necessary information is processed to comply with our legal duties and, where needed, our legitimate interest in establishing, exercising or defending legal claims.

You may browse without providing your name or accepting analytics. A reply address and information needed to understand an enquiry are necessary for us to respond; an order cannot be completed without the information required at checkout. Other information you supply is optional: limit it to what is useful.

03Oriflux and language preference

The landing page integrates Oriflux to measure visits and site performance for Sponge Theory, only after your explicit consent. Declining does not restrict the catalogue or video. “Accept” and “Decline” are presented at the same level. Taking no action enables nothing.

After consent, our integration sends the page origin and path (without query parameters or fragments), the referring site's origin (without its path or parameters), and technical performance measurements available after activation. It sends no screen resolution, account identifier or UTM campaign, and performs no advertising tracking. The server also receives the IP address and browser information involved in the request; Oriflux uses these for a daily pseudonymous identifier and technical and geographic enrichment. This is not a promise of anonymity. Retention information appears in the next section.

Acceptance or refusal is saved for 180 days, without renewal on each visit, in spt-landing-audience: choice, notice version and timestamp, with no visitor identifier. If storage is unavailable, the choice lasts only for the open page. Use “Privacy choices” in the footer to change it; “Withdraw analytics consent” stops collection on this page and cancels pending requests where possible. Withdrawal does not retroactively delete data already received: send erasure requests to the contact above. DNT/GPC signals prevent activation even with saved consent. No measurement is sent when Oriflux is not configured.

The separate local spt-lang preference remembers language. These static legal pages work without JavaScript and load no audience-measurement script. To change your choice, return to the landing footer. These technical controls do not certify compliance of all processing activities.

04Recipients, retention and transfers

Recipients are authorised Sponge Theory personnel and, as needed, email and assistance providers, Lemon Squeezy for sales, accounting or legal advisers and legally authorised authorities. Support access to a customer installation's content must have an agreed scope; where Sponge Theory acts as a processor, the required commitments must govern that intervention.

The website and Oriflux are hosted on Sponge Theory's own infrastructure in France. This does not extend to external providers: the Lemon Squeezy Privacy Policy describes its processing, recipients and transfers to the United States or other countries. Read it before entering information at checkout. You may ask our contact for the available information on recipients and safeguards applicable to your correspondence.

• Enquiries and support: retained while handling and usefully following up the correspondence or contract; only records needed for a legal obligation or dispute may be retained beyond that point for the corresponding period.
• Accounting records held by Sponge Theory: supporting documents subject to this duty are retained for ten years from the close of the relevant financial year, under the French business document retention rules.
• Security logs: necessity is assessed against incident detection and investigation; records relevant to an incident or dispute may be isolated for handling it and defending legal claims.
• Analytics: the local choice expires after 180 days. This is not the retention period for events stored by Oriflux. Actual event and backup retention has not been verified as of this notice; no automatic deletion after 180 days or irreversible anonymisation is claimed. You may decline analytics and request details or erasure using the contact above.
• Language: the local preference remains until replaced or the browser's storage is cleared.

05Your rights and practical precautions

Subject to GDPR conditions, you may request access, rectification, erasure, restriction, objection and, where applicable, portability, or withdraw consent without affecting the lawfulness of earlier processing. An objection to processing based on legitimate interests is assessed in light of your circumstances and the legitimate grounds or legal claims involved. Write to the contact above and identify the processing concerned. Proportionate identity verification may be needed if there is reasonable doubt.

We normally respond within one month of receiving your request. An extension of two months is possible under the GDPR, including due to complexity or the number of requests; we will explain the reasons within the first month. You may complain to the CNIL or another competent supervisory authority.

Do not email API keys, passwords or sensitive datasets. For processing determined by your installation operator, address your request to that organisation. The version date identifies updates to this notice; an incompatible new purpose or processing requiring your consent cannot be authorised merely by changing this text.