Privacy Policy - Incspark.com

1. About this policy

1.1 This policy explains how Incspark handles personal data (“Personal Data”: any information about an identified or identifiable person) when you visit incspark.com (the “Site”), use the signed-in area (the “Dashboard”), order or use our services (the “Services”), contact us by email or WhatsApp, book a call, or submit an enquiry form. It also covers the people whose data you give us for an order: co-founders, shareholders, directors, managers, beneficial owners, visa holders and representatives.

1.2 It does not cover third-party registered or resident agents, formation agents, notaries, lawyers, accountants, translators, couriers and nominee providers (“Partners”), registries, tax offices, free zone authorities and other public bodies (“Authorities”), banks, electronic money institutions and payment providers (“Financial Institutions”), Stripe, or third-party sites and AI assistants, when they use data for their own purposes. Their own policies apply (see section 5 (Who we share personal data with) and section 15 (Third-party sites and AI assistants)).

1.3 This version is effective from November 12, 2026. It is a notice that tells you how we use Personal Data; it is not a contract and does not ask for your consent.

1.4 If you give us Personal Data about other people, you must have the right to share it and must tell them about this policy.

2. Who we are and how to contact us

2.1 The controller of your Personal Data is Incspark Group, [to be confirmed], [to be confirmed], with its registered address at [to be confirmed], trading as Incspark (“Incspark”, “we”, “us”, “our”).

2.2 Privacy contact: hello@incspark.com.

2.3 We have not appointed a data protection officer.

2.4 We are the controller for the Services. Partners and Authorities that receive data to carry out your order are usually independent controllers. Stripe is an independent controller for its own legal duties, such as anti-money laundering and fraud checks.

2.5 Our representative in the EU (Article 27 GDPR) is [to be confirmed]. Our representative in the UK (Article 27 UK GDPR) is [to be confirmed]. You can always contact us directly at hello@incspark.com.

3. Personal data we collect

Data you give us

Account data: your email address, which you use to sign in.
Order and company data: country, entity type, proposed names, business activity, share capital, roles and ownership percentages, and your registered or service address choices.
Data about owners, directors and other people in your order: full name, date of birth, nationality, residential address, email, phone, occupation, country of residence, role, shareholding, beneficial-owner status and UK person-with-significant-control (PSC) status, and service address; for US companies, the EIN responsible party and ITIN applicant; and for corporate owners, the company name, number, country and representative.
Identity and verification documents: passport copy, proof of address, certified or notarised copies, translations, photos and visa pages (UAE), source-of-funds documents (a statement or bank reference), tax numbers such as a US Social Security Number or ITIN if you choose to give it, a Companies House authentication code if you share one, and a short selfie video where a bank or Authority requires it. We also hold the tax and company identifiers issued to your company, such as an EIN.
Transfer data: your current provider’s name and email, whether you owe them fees, your company’s existing registration and tax numbers, and its certificate of incorporation, registers, articles, trade licence and latest annual return; for UAE companies, the licence expiry date and the number of current residence visas; and which extra services you want moved to us.
Support and communications: ticket messages and attachments, emails, and WhatsApp messages, including your WhatsApp number and profile name.
Calls and enquiries: your name, email, phone number, company, job title, team size, country, enquiry type, message, time zone, the time and length of the call you book, and notes from the call.
Payment data: Stripe collects your card details and, where it asks for them, your billing name and address. We receive the payment status, amount, currency, the billing name and address Stripe collected, email, card brand, the last four digits of the card and invoice records. We never receive or store full card numbers.

Data collected automatically

Technical and security data: IP address, browser and device type, pages requested, and date and time, processed by Cloudflare to deliver and protect the Site (firewall and rate limits).
Sign-in and security events: login-code requests and sign-ins. When we send new-login alerts, we use the device type and approximate location derived from your IP address.
Notifications and preferences: your in-app notifications, your reminder settings and your time zone, used to send reminders at a sensible hour.
Browser storage: see section 12 (Cookies and browser storage).
Email delivery data: whether an email was sent, failed, hard-bounced or marked as spam, and your reminder unsubscribe choices.

Data from others

The person who placed the order: if you are a shareholder, director, beneficial owner or other person named in an order, we received your data from that client.
Authorities and registries: company number, certificates, filing status, tax IDs and official letters.
Partners: filing results and official mail received for your company.
Screening results from sanctions lists, politically exposed person (PEP) lists and adverse-media sources, checked by us or our Partners.
Financial Institutions: whether your application was approved or declined, when they tell us.
Stripe: payment, refund and dispute status.

Sensitive data

We do not ask for data about health, religion or other special categories. If a document you upload, or a UAE visa process, reveals such data, we use it only for that order and only as needed to carry out the application you asked for. We rely on your explicit consent, which we ask for separately before we use such data (Art. 9(2)(a) GDPR), or on the need to establish, exercise or defend legal claims (Art. 9(2)(f)). You can withdraw consent, but we then cannot complete that application.
We use passport photos and selfie videos to check identity. We do not use them for automated biometric identification. Banks and Authorities that require them use them under their own policies.
Screening can reveal information about criminal convictions, offences or security measures. This data has extra protection under Article 10 GDPR and the UK Data Protection Act 2018. We use it only to meet anti-money laundering and sanctions duties, and only as those laws allow (see section 4).

4. How we use personal data and our legal bases

4.1 For each purpose we give the legal basis under the EU and UK GDPR:

Create and secure your account and sign you in (account data). Basis: performance of a contract (Art. 6(1)(b)).
Provide the Services: formation, transfers, tax IDs, registered agent or address, nominee officers, annual filings, bookkeeping and accounting through Partners, official mail and visas (order, company, people, transfer and document data). Basis: contract; for other people in your order, our and your legitimate interest in carrying out the order (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where EU, Member State or UK law requires a registry to receive their data, such as Companies House, France’s guichet unique or the Dutch KvK.
Identity checks, anti-money laundering, sanctions and PEP screening, before and during the Services (identity, document and screening data). Basis: legal obligation (Art. 6(1)(c)) where EU, Member State or UK law imposes the duty; otherwise our and our Partners’ legitimate interests in meeting the anti-money laundering and sanctions laws that apply to them and in preventing financial crime (Art. 6(1)(f)). Offence-related data only where Art. 10 GDPR or Schedule 1 of the UK Data Protection Act 2018 allows it.
Help with bank and payment-provider applications at your request (company, people and document data). Basis: contract.
Payments, invoices, refunds, accounting and tax records (payment and account data). Basis: contract; legal obligation where EU, Member State or UK law requires the records, otherwise legitimate interests in meeting our tax and accounting duties.
Service and security messages: login codes, order updates, document requests, compliance and renewal reminders (account, order and preference data). Basis: contract; legitimate interests for reminders you can switch off.
Support by tickets, email and WhatsApp, and calls and enquiries you request (communications data). Basis: contract and legitimate interests.
Keep the Services secure and prevent fraud and abuse with logs, rate limits and account locks (technical and security data). Basis: legitimate interests.
Establish, exercise or defend legal claims and respond to lawful requests (any relevant data). Basis: legitimate interests, and legal obligation where EU, Member State or UK law requires it.
Improve the Services using aggregated or de-identified information. Basis: legitimate interests.
Optional analytics and marketing cookies. We use none today. If we add them, we will use them only with your consent (Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
Marketing emails. We send none today. If we start, we will rely on your consent (Art. 6(1)(a)) or, where the law allows, on legitimate interests for similar services you bought, and every such email will have an unsubscribe link.

4.2 Where we rely on legitimate interests, they are running a secure and reliable service, carrying out the orders our clients place, showing real examples of results (section 15), and protecting our legal position.

4.3 Right to object: where we rely on legitimate interests, you can object at any time on grounds relating to your situation, and you can always object to direct marketing (see section 10 (Your rights and how to use them)).

4.4 Some data is required by law or needed for the contract, such as identity documents for a formation. If you do not provide it, we cannot carry out that Service; section 11 (Cancellations and refunds) of our Terms of Service explains what happens to your order.

4.5 Where the UAE Personal Data Protection Law applies, we process Personal Data where it is necessary to perform a contract with you or to take steps you ask for before entering into one, to meet obligations under UAE law, or to establish, exercise or defend legal claims (Article 4). Where none of these grounds applies, including for any future analytics or marketing, we ask for your consent.

5.1 Partners in the country you choose, each only for your order.

5.2 Authorities, for example US Secretaries of State and the IRS, Companies House and HMRC, UAE free-zone authorities and the Dubai Department of Economy and Tourism, France’s guichet unique, the Dutch KvK, Montenegro’s Central Register of Business Entities, and the BVI and Panama registries through licensed agents. Some registries publish the names of owners and directors, service addresses and other details by law. We cannot remove data from public registers.

5.3 Financial Institutions that you ask us to help you apply to, such as Wise, Payoneer, Mercury, Revolut or LHV.

5.4 Service providers that process data for us (see section 6 (Service providers)).

5.5 Professional advisers, auditors and insurers, under a duty of confidentiality.

5.6 Authorities, courts and law enforcement where the law requires it. Anti-money-laundering law may prevent us from telling you.

5.7 A buyer or successor in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.

5.8 WhatsApp (Meta Platforms): when you message us on WhatsApp, Meta processes the messages as an independent controller under WhatsApp’s own terms and privacy policy.

5.9 Anyone else with your instruction or consent.

5.10 We do not sell Personal Data, and we do not share it for cross-context behavioural advertising.

6. Service providers

6.1 These providers process Personal Data for us under contracts that require them to act only on our instructions and to keep it secure:

Cloudflare, Inc. (USA, global network): hosting, content delivery, security and firewall, databases and file storage.
Stripe (Stripe, Inc., USA, and its affiliates): payments, invoices, the billing portal and fraud prevention. Stripe is also an independent controller under its own Privacy Policy.
Resend (USA): delivery of our emails.
Google (Google LLC, USA): video calls you book with us (Google Meet).
[to be confirmed]: our business email inbox.
[to be confirmed]: online identity verification and electronic signatures.

6.2 On request, we tell you which Partner handles your order.

7. International transfers

7.1 Your data is processed outside your country, including in the USA (Cloudflare, Stripe, Google, Resend), in [to be confirmed], where our team works, and in the country where you form your company.

7.2 For transfers from the EEA, the UK or Switzerland we rely on an adequacy decision where one exists, including the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, where the recipient is certified. Otherwise we use the European Commission’s standard contractual clauses (Decision 2021/914), with the UK International Data Transfer Addendum for transfers from the UK and the adaptations that the Swiss Federal Data Protection and Information Commissioner (FDPIC) requires for transfers from Switzerland.

7.3 Where no such safeguard is available, we transfer data to Authorities and, occasionally, Partners in the country you chose, such as the BVI, Panama, the UAE, Montenegro or the USA, only where the transfer is necessary to perform the contract you asked for or a contract concluded in your interest (Article 49(1)(b) and (c) GDPR and UK GDPR). For regular transfers to Partners, we use the standard contractual clauses in section 7.2.

7.4 From the UAE, we transfer data as the Personal Data Protection Law allows: to countries with adequate protection, or under contractual or other permitted safeguards.

7.5 You can ask for a copy of the safeguards at hello@incspark.com.

8. How long we keep data

8.1 We keep Personal Data for these periods:

Account data: while your account is open, then 2 years after it closes, unless a longer period below applies.
Order and company records (formation documents, filings, registered agent records): while we provide services to the company, then 5 years.
Identity, verification and screening records: 5 years after the business relationship ends, or longer where a law or an Authority requires it.
Invoices, payments and accounting records: 10 years from the end of the financial year they relate to.
Support tickets, messages, call bookings and enquiries: 3 years after the ticket closes or our last contact.
In-app notifications: the latest 50, deleted when you clear them or your account closes.
Email delivery logs: 12 months. Unsubscribe and suppression records: as long as needed to respect your choice.
Login codes: 10 minutes, and they work only once.
Security and server logs: up to 12 months.
Cookie consent choice: 12 months in the cookie; in browser storage until you change it or clear site data.
Data in your browser: until you sign out, clear it or it expires (see section 12 (Cookies and browser storage)).

8.2 We keep data longer only where the law requires it or while a legal claim is ongoing. After that we delete or anonymise it. Backups are overwritten on their normal cycle.

9. Security

9.1 Sign-in is passwordless: we email a single-use code that expires after 10 minutes, so there is no password to leak.

9.2 Data is encrypted in transit (HTTPS), and stored documents are encrypted at rest.

9.3 Access is limited to staff and Partners who need it for your order.

9.4 Card data is handled only by Stripe.

9.5 Our emails never contain your documents, and tax IDs in them are masked.

9.6 A firewall and rate limits protect the Site and the Dashboard.

9.7 No system is completely secure. Protect your email account, because it is the key to your sign-in.

9.8 If a personal data breach occurs, we notify the competent authority and the people affected as the law requires.

10. Your rights and how to use them

10.1 Depending on where you live, you have the right to access your data, correct it, delete it, restrict its use, object to its use (including use based on legitimate interests), receive it in a portable format, withdraw consent at any time without affecting earlier processing, and complain to a data protection authority.

10.2 To use a right, email hello@incspark.com, ideally from the email address of your account. We verify your identity by asking you to confirm from that address or by matching details we hold. If someone acts for you, we may ask for proof of their authority.

10.3 We answer within one month under the GDPR and UK GDPR (extendable by two months for complex requests, with notice) and within 30 days under the Swiss FADP. Deadlines under other laws are in section 11 (Region-specific information). Requests are free, except where the applicable law allows a fee, such as for manifestly unfounded or excessive requests.

10.4 We may keep data that the law requires us to keep, such as anti-money laundering records, and we cannot delete data published in public registers. Deleting identity documents may stop a Service.

10.5 We will not treat you differently for using your rights.

11. Region-specific information

EEA, UK and Switzerland

Your rights are those in section 10 (Your rights and how to use them), under Articles 15 to 22 GDPR or UK GDPR or, in Switzerland, the Federal Act on Data Protection (FADP).
You can complain to the data protection authority where you live or work, or where an alleged breach occurred (list of EEA authorities). In the UK this is the Information Commissioner’s Office. In Switzerland this is the Federal Data Protection and Information Commissioner.
In the UK you can also complain to us first at hello@incspark.com. We acknowledge your complaint within 30 days and tell you the outcome without undue delay.
Our representatives are listed in section 2 (Who we are and how to contact us).

United Arab Emirates (PDPL)

Where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, you have the right to information, access, transfer of your data, correction and erasure, restriction, stopping processing, and objection to decisions based on automated processing.
You can complain to the UAE Data Office.
Where the data protection law of the DIFC or ADGM applies instead of the PDPL, you have the rights that law gives, and you can complain to its Commissioner of Data Protection.

United States and California

If the California Consumer Privacy Act, as amended (CCPA), applies to us, this section is our notice at collection. In the last 12 months we collected these categories: identifiers; customer records (Cal. Civ. Code §1798.80(e)); characteristics of protected classifications (age and nationality); commercial information; internet or network activity; approximate geolocation derived from IP address; audio, electronic or visual information (photos and selfie videos); professional information; and sensitive personal information: passport number, Social Security Number or ITIN where given, citizenship or immigration status, and account log-in details (your email address with a one-time sign-in code).
In the last 12 months we disclosed for a business purpose: identifiers, customer records, characteristics of protected classifications, professional information, audio, electronic or visual information and sensitive personal information to Partners, Authorities and Financial Institutions, at your direction, to carry out your Order; identifiers, customer records and commercial information to Stripe; identifiers and internet or network activity to Cloudflare and our email delivery provider; identifiers, customer records and anything else you send us by email to our email inbox provider; identifiers and audio, electronic or visual information to Google for calls you book; identifiers, audio, electronic or visual information and sensitive personal information to our identity-verification provider; and the same categories to professional advisers where needed.
Sources are in section 3, purposes in section 4, recipients in sections 5 and 6, and retention in section 8.
We do not sell or share Personal Data, and we have no actual knowledge of selling or sharing the data of anyone under 16. If we ever add advertising cookies, we will update this notice first, add a “Do Not Sell or Share” link and treat Global Privacy Control signals as a valid opt-out.
We use sensitive personal information only for purposes the CCPA permits, so the right to limit its use does not apply.
You have the right to know and access, delete and correct your data, and not to be discriminated against. An authorised agent needs your signed permission, and we may verify your identity directly with you.
We confirm receipt within 10 business days and answer within 45 days (extendable once by 45 days).
Residents of other US states with privacy laws can use the rights in section 10 in the same way. If we decline your request, you can appeal by replying to our decision at hello@incspark.com. We answer the appeal within 45 days, and if we deny it, you can contact your state Attorney General.
We do not currently respond to Do Not Track signals.

12. Cookies and browser storage

12.1 We use only strictly necessary cookies and browser storage:

to keep you signed in (the session entry in browser storage, until you sign out, and the signed_in cookie, for 30 days; if your browser blocks storage, a signed_in_email cookie that holds your email address, for 30 days);
to remember your order drafts, tickets and notifications until our servers store them, and your cart during sign-in and checkout for up to 60 minutes;
to remember your country choice on pricing;
to remember your cookie choice for 12 months.

12.2 We load no third-party analytics, advertising or tracking scripts today. Optional analytics or marketing cookies would be used only after you choose “Accept”, and only once they are listed in our Cookie Policy.

12.3 You can change your choice at any time:

13. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
A person reviews identity-check and screening results. Automated security tools, such as rate limits and spam filters, only protect the Services.
Financial Institutions and Authorities may use their own automated tools under their own policies.

14. Children

The Services are for adults: 18, or the age of majority where you live if that is higher. We do not knowingly collect data from children, and if we learn that we have, we delete it.

15. Third-party sites and AI assistants

Links to WhatsApp, Stripe and AI assistants (ChatGPT, Claude, Gemini, Grok, Perplexity and DeepSeek) take you to services with their own privacy policies.
The “Ask AI” buttons open an assistant, or Google Search, with only a fixed, pre-written question about our Services (or no text at all), never your Personal Data. Anything you type there is handled by that provider.
Some pages show a live example site from another domain in an embedded frame. When you open such a page, your browser loads the example from that site’s server, which receives your IP address and browser data and may set its own cookies under its own policy. We show these examples based on our legitimate interest in showing real results (Art. 6(1)(f)). You can avoid this by not opening those pages or by blocking third-party cookies in your browser.

16. Changes to this policy

The date at the top shows when this version was last updated; a new version takes effect on the date we announce.
We announce material changes on this page and, if you have an account, by email or in the Dashboard before they apply.
If a change requires your consent, we will ask for it.

17. Contact

Email hello@incspark.com, or write to Incspark Group, [to be confirmed]. Representatives are listed in section 2 (Who we are and how to contact us). See also our Terms of Service and Cookie Policy.