Privacy Policy
Last updated 6 October 2026 · Questions: [email protected]
This policy explains how Carnegie Intelligent Technology Limited ("Sparring", "we") collects and uses personal data when you use the Sparring website and Service. For data our business customers submit to the Service, we act as a processor on their instructions; see our Data Processing Addendum. For website visitors, prospective customers and account administrators we act as controller.
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, work email, SSO subject identifier, role, organization | You, your organization, your identity provider |
| Practice content | What you type in simulated conversations, the generated counterpart lines, debrief reports, skill ratings | You; generated by the Service |
| Arena content | Transcripts between our simulated humans and your organization's AI agents, reports, agent configuration | Your organization; generated by the Service |
| Studio content | Material your organization pastes to draft scenarios | Your organization |
| Usage & technical | Session timestamps, feature usage, IP address, browser, error logs | Automatically |
| Communications | Support requests, pilot enquiries | You |
We do not knowingly collect data from children under 16. We do not collect special-category data on purpose; if a learner discloses such data during practice, it is processed only as part of the transcript and subject to your organization's retention setting.
2. How we use data
- To provide the Service: run simulations, generate debriefs, evaluate agents, deliver reports, show your organization's analytics.
- To secure and operate the Service: authentication, abuse prevention, debugging, capacity planning.
- To bill: usage metering, Marketplace reporting, invoicing.
- To communicate: service notices, support, and (for administrators and prospects only) product updates you can opt out of.
- To improve the Service using aggregated, de-identified statistics. We do not use your content to train machine-learning models.
3. Legal bases (EEA/UK)
Performance of a contract (providing the Service), legitimate interests (security, product analytics, B2B marketing to administrators), legal obligation (tax, accounting), and consent where required (non-essential cookies, marketing to individuals).
4. AI processing
Conversations are processed by large language models to generate counterpart lines and debriefs. Depending on your organization's residency setting, inference runs on Google Cloud (Vertex AI), Amazon Web Services (Bedrock) or our managed provider channels. Providers are bound not to train on your data and to delete inputs after processing (zero-retention or ≤30-day abuse-monitoring retention, per provider terms). Debriefs are automated feedback for learning; they are not used by Sparring to make decisions with legal or similarly significant effects about you, and our terms prohibit customers from using them as the sole basis for employment decisions.
5. Sharing
We share personal data with (a) sub-processors listed on our sub-processor page (cloud hosting, model providers, email delivery); (b) your organization's administrators and managers, according to the roles your organization sets; (c) Google Cloud Marketplace when you purchase there (account identifiers and usage quantities only); (d) authorities when legally required. We do not sell personal data.
6. International transfers
Our primary infrastructure is in Google Cloud regions selected by your organization (default: asia-east1/us-central1). Model providers may process data in the United States. Where EEA/UK data is transferred, we rely on the EU Standard Contractual Clauses and the UK Addendum, available in our DPA.
7. Retention
Account data: life of the account plus 90 days. Practice/Arena/Studio content: per your organization's setting (default 365 days). Billing records: 7 years. Audit logs: 2 years. Backups roll off within 35 days.
8. Your rights
Depending on your location you may have rights to access, correct, delete, restrict or port your data, and to object to processing. Learners can export and request deletion of their own sessions in-app. For other requests, or if you are in the EEA/UK and wish to complain to a supervisory authority, contact [email protected]. Where we act as processor we will refer your request to your organization.
9. Hong Kong PDPO
We comply with the Personal Data (Privacy) Ordinance (Cap. 486). This policy serves as our Personal Information Collection Statement. Data access and correction requests may be sent to the address below; a reasonable fee may apply to access requests as permitted by the Ordinance.
10. Cookies
The Service uses strictly necessary cookies (session, CSRF/state). The marketing website uses no third-party advertising cookies. Privacy-preserving analytics, if enabled, do not use cookies or fingerprinting.
11. Changes and contact
We will post changes here and notify administrators of material changes. Contact: Carnegie Intelligent Technology Limited, Room 5017, 5/F, Yau Lee Centre, 45 Hoi Yuen Road, Kwun Tong, Kowloon, Hong Kong · [email protected].