Global Privacy Notice

1. Scope and operator

This notice covers the Spairly website, account-based request and contributor-profile forms, authenticated workspace, result-package workflow, API, and related email support operated by Famplified LLC (“Spairly,” “we,” “us,” or “our”). Famplified LLC is the controller or business responsible for this information where those concepts apply.

Privacy, legal, accessibility, security, and support questions may be sent to info@email.famplified.com.

2. Information Spairly collects

The account-based request and contributor-profile forms do not accept file uploads, payment-card details, AI provider credentials, or account passwords. Spairly is not a confidential submission channel: do not place trade secrets, privileged information, confidential or proprietary material, regulated records, medical, financial, identity, or other sensitive information in a description field.

Published request details may be displayed to authenticated Spairly participants, while account and contact information remains access-controlled and subject to this Privacy Notice. Submitting does not create an NDA, professional privilege, fiduciary relationship, or other duty to treat the project description as confidential.

Request and contributor-profile forms do not accept files. An authenticated contributor may upload one result ZIP for a claimed task. Result packages must not contain confidential, privileged, regulated, sensitive, or proprietary material that the participant lacks authority and permission to disclose and use through Spairly.

• Account and project information you provide, including email, display name, country or region, languages, contributor interests, authorized-tool names, availability, request description, intended beneficiary, intended result, and public source links.
• Your confirmations that you are an adult, may lawfully participate, accept the Terms and Privacy Notice, acknowledge the described AI-assisted analysis, understand that the submission is not confidential, and have authority and permission to disclose the information.
• AI-generated information, including internal scope recommendations, service-boundary flags, Social Good analysis, possible pairing recommendations, on-demand translations of request fields, model and prompt versions, and token counts.
• Ordinary security and request logs, such as IP address, user agent, time, requested URL, response status, and anti-abuse signals.
• Messages you send to our support email.
• Account and workspace information, including a Cognito account identifier, email address, task roles, claims, status changes, completion records, and contributor milestone counts.
• Contributor result packages and related metadata, including filename, size, validation status, malware-scan status, timestamps, and download or acceptance events.

3. How we use information

• Read and respond to requests and contributor offers.
• Use AI-assisted analysis to organize a proposed scope, identify uncertainty and possible service-boundary concerns, assess whether a stated Social Good impact is concrete, and rank possible requester-contributor pairings.
• Prepare stored AI translations of a request's title, description, intended beneficiary, intended use, country or region, and preferred-result-language wording for participants using supported Spairly languages.
• Operate the account-based request, claim, contribution, result, and completion workflow.
• Operate, secure, troubleshoot, and prevent abuse of the website and API.
• Validate result-package structure, scan quarantined packages for malware, withhold packages that do not receive a clean scan result, and make an eligible package available to its requester.
• Record result-package security events, temporarily restrict affected accounts for review, and notify an authorized administrator when validation or malware scanning is unsuccessful.
• Comply with law, sanctions, export controls, and enforce our terms.
• Use Google Analytics with Google Consent Mode to understand aggregate visits, page views, scroll depth, and outbound-link use without selling personal information or using it for cross-context behavioral advertising.

4. Automated decision-making

After a request is published, Spairly sends project fields—including the title, description, country or region, language, intended beneficiary, intended use, and public-source summary—to Amazon Nova 2 Lite through Amazon Bedrock. For matching, the model also receives pseudonymous candidate labels with contributor interests, authorized-tool names, languages, country or region, and availability. Spairly does not send email addresses, display names, Cognito subjects, or other stable account identifiers to the model.

After a request is submitted, Spairly sends the request title, description, intended beneficiary, intended use, country or region, and preferred-result-language wording, together with a supported target language, to Amazon Nova 2 Lite through Amazon Bedrock. Translations are stored with the request so they can be shown to participants without being regenerated on every view. Spairly may generate a missing translation when a participant opens a request. The original request remains authoritative, and machine translation may contain errors.

The model performs three internal steps: scope and service-boundary triage; Social Good and impact-claim analysis; and possible requester-contributor pairing. Its output is a recommendation that can be incomplete, inaccurate, or biased. It does not verify identity, authority, charitable status, legality, safety, impact, or truth.

Spairly’s automated tools analyze submitted project fields and may use the resulting assessment to organize requests, highlight Social Good projects, or suggest possible matches. This workflow does not make legal or similarly significant decisions about participants.

Automated organization, highlighting, or matching is not identity verification, credential verification, certification, or a guarantee that work will be completed.

5. Legal bases

Where the GDPR, UK GDPR, or similar law applies, our legal bases may include taking steps you request before providing a service, performing an agreement, legitimate interests in operating and securing Spairly, compliance with legal obligations, and consent where required. You may withdraw consent when processing depends on consent.

6. When information is shared

We do not sell personal information or share it for cross-context behavioral advertising. Published project fields are visible within the authenticated workspace; account email addresses and stable account identifiers are not included in project listings.

• With infrastructure and security providers, including Amazon Web Services. Amazon Bedrock processes Spairly model inputs and outputs using Amazon Nova 2 Lite within AWS. AWS states that Bedrock does not store or log prompts and completions or use them to train AWS models.
• With Amazon Web Services for private object storage, identity services, package processing, and GuardDuty Malware Protection for S3. AWS receives the uploaded package and technical metadata needed to validate, scan, quarantine, retain, or deliver it.
• With Google Analytics to measure aggregate website traffic. Advertising storage, Google Signals, personalized advertising, user IDs, form interactions, site search, video engagement, and file-download tracking are disabled. When analytics cookies are declined, Google receives cookieless consent-mode requests that can include technical request information and page context for aggregate measurement.
• With professional advisers, insurers, authorities, or counterparties when reasonably necessary for legal compliance, safety, a dispute, financing, reorganization, or a business transfer.
• With authenticated requesters and contributors as reasonably necessary to display, claim, perform, deliver, and review work through Spairly, consistent with the acknowledgement made at submission and applicable law.

7. Retention

Ordinary application and security logs have a target retention period of 30 days. Requests, related AI-assessment records, and cached request translations have an automated deletion target of 180 days unless a shorter period is requested or a longer period is reasonably required for active work, a security investigation, dispute, legal hold, or legal obligation. Contributor profiles are retained while the account remains active or until deletion is requested, subject to the same exceptions.

Quarantined result packages have a seven-day deletion target. Packages that pass the required checks and are promoted for requester access have a 180-day deletion target. Rejected malware may be deleted sooner. Associated status and completion records may follow the application-record period described above.

Backups and de-identified records may persist for a limited additional period. Retention periods are targets rather than guarantees where restoration, legal, or security constraints apply.

8. International processing and security

Spairly is operated from the United States. The current Bedrock inference profile keeps model processing within AWS Regions in the United States, although a submission may originate elsewhere. Other providers may process information in the United States or other countries. Where required, we use legally recognized transfer safeguards.

We use encryption in transit and at rest, access controls, private storage, logging, rate limits, and other safeguards appropriate to the information. No online service can guarantee absolute security.

A result package is unavailable to the requester until Spairly records successful package validation and a clean malware-scan result. A scan reduces risk but cannot prove that a file is safe, accurate, lawful, or suitable for use.

If package validation or malware scanning is unsuccessful, Spairly may place the contributor account in a temporary security-review state that blocks account actions while authorized personnel review incident metadata. Known-malware objects may be deleted immediately.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information; withdraw consent; use an authorized agent; or complain to a regulator. Applicable thresholds and exceptions vary by jurisdiction.

Email info@email.famplified.com to make a request. We may ask for information reasonably necessary to confirm identity and authority before acting.

10. Adults only

Spairly is for adults age 18 or older and is not directed to children. We do not knowingly collect personal information directly from children under 13. Do not submit a child’s information or ask a child to participate. If we learn that prohibited child information was submitted, we will take appropriate steps to delete it.

11. Changes

We will update this notice before materially changing the categories of information collected or the ways the information is used. The effective date above identifies the current version.