Privacy policy

Last updated: October 6, 2026. This English version is a translation for your convenience; if there is any discrepancy, the Spanish version prevails.

Data controller

Chispa MKT, S.A. de C.V., Campo Santo 44, Mexico City, Postal Code 64000, Mexico. Privacy contact: contacto@chispachat.com.

What data we process

• Video, audio and chat. They travel directly between your browser and the other person's. When the network does not allow it, they pass encrypted through our relay server (TURN), which cannot see them and does not store them. Text chat passes through our server only to be delivered and is not stored.
• Connection identifier. We store a code derived from your IP address using an irreversible function (we do not store the IP in plain text) and a random browser identifier. We use them to enforce bans and prevent abuse.
• Moderation thumbnails. While you are in the video chat, your browser sends a small, low-resolution image of your own camera every 15 seconds. Only the moderation team sees it, to detect prohibited content; only the most recent one is kept in the server's memory and it is discarded when you disconnect. If your camera is off, nothing is sent. If moderation bans you, that last thumbnail is kept as evidence of the ban.
• Watching conversations. To moderate, the moderation team can open any ongoing conversation and watch the camera image of the people taking part live, without prior notice and for the sole purpose of enforcing the rules. Those images are viewed in the moment and are not stored.
• Captures on entry. Every time someone enters the video chat, the server temporarily keeps an image of their camera at that moment so the moderation team can review it. Only the 30 most recent are kept in the server's memory: each new capture pushes out the oldest, they are all erased when the server restarts, and the moderation team can delete them at any time. If the camera is off on entry, no image is kept.
• Automated AI analysis (sensitive data). With your express consent, which you give by ticking the corresponding box before entering, an artificial intelligence running on our own servers analyzes images from your camera for two purposes: (1) on entry, to estimate your age from a few frames of your face in order to keep minors out, and (2) while you are connected, to check each thumbnail for nudity. Analyzing facial features may be considered processing of biometric data, which Mexican law treats as sensitive personal data. We do not create face templates, we do not identify you or compare your face with other people's, and the images are not sent to third parties. Images are discarded as soon as the analysis ends; they are only kept as evidence when the AI detects possible nudity or prevents your entry. If you do not give your consent, you cannot use the video chat.
• Reports. If someone reports you, we keep the reason, the comment and a screenshot of your video at that moment. If you report someone, we keep your same anonymous identifier to prevent false reports and to keep both browsers from matching again after reconnecting.
• Gender and country. Gender is optional and you choose it (woman, man or prefer not to say); we do not infer it from your image and we do not verify it. We estimate your country from your device's time zone, not from your exact location. Both are used only while you are connected to apply the search filters, are shown to the person you are talking to and to the moderation team, and are not stored on the server.
• Premium. If you buy Premium, the payment is processed by Stripe; we do not see or store your card details. We store the payment ID, the amount, the email you gave Stripe (to handle questions and refunds), your browser's random code and the expiry date. To validate the recovery key we store its cryptographic fingerprint. We also keep a copy encrypted with a server key so we can give it to you when a payment is confirmed, even if it was activated before you came back to Chispa. Your browser stores the key locally so you can look it up.
• Interests. The ones you type are used only to match you and are not stored on the server.
• Language. To show you the page in Spanish or in English, the first time you visit we look up the country your IP address belongs to in a database stored on our own server, and we check your browser's language. The lookup happens in memory: we do not store your IP or your country for this and they are not sent to third parties.
• Local storage and cookies. Your browser stores your interests and the random identifier. The only cookie we use is called “lang”; it only records the language you chose (es or en) and lasts one year. We do not use advertising or tracking cookies.

What we use it for

To provide the service, moderate content, protect the community (especially minors) and comply with legal obligations. The data needed to provide the service is processed for those purposes and to comply with applicable obligations. AI analysis of your image requires your express consent before entering. We do not use your images for advertising or to train models.

Automated decisions

The AI may prevent your entry if it estimates that you are underage, and show you a warning if it detects nudity. These estimates can be wrong. Each case is left pending review by a person on the moderation team, who decides whether to block access or dismiss it. If you think the AI got it wrong, you can request a review by writing to contacto@chispachat.com with the approximate date and time.

How long we keep it

• Moderation thumbnails: only the most recent one, in memory, while you are connected.
• Captures on entry: only the 30 most recent, in memory; each new capture pushes out the oldest and they are erased when the server restarts.
• Frames used to estimate age: discarded when the analysis ends, unless access is blocked (then one is kept as evidence, for the same period as report screenshots).
• Report screenshots: up to 30 days after the report is resolved; if the report is still unreviewed, they are deleted 180 days after it was created. In both cases, unless the law requires keeping them longer.
• Payment records: as long as required by tax law.
• Ban records: while the ban is active and up to 12 months afterwards.
• Browser identity history (dates of use, number of sessions and whether it passed the age check), used to calculate its trust level: up to 90 days after the last visit.

Who we share it with

The infrastructure providers that host the service may process data on Chispa's behalf to operate it; Stripe processes payments under its own privacy notice. These providers may operate outside Mexico. We may also disclose information to the authorities when there is a legal obligation. We do not sell data. You can ask for information about our providers and the processing of your data at contacto@chispachat.com.

Your rights

You can request access, rectification, cancellation or objection, and withdraw your consent to AI analysis, by writing to contacto@chispachat.com. Withdrawing it means you can no longer use the video chat. Include your name, a way to reply, the right you want to exercise and the related data or facts. Since the video chat requires no sign-up, include the approximate date and time to help us find the information. We may ask for proportionate information to confirm that the data relates to you; do not send ID documents or sensitive images until we point you to a suitable channel. We will tell you our decision within 20 business days of receiving the complete request and, if it applies, carry it out within the following 15 business days, with any justified extensions the law allows.

Changes to this notice

We will post any changes on this page with their update date. If a purpose that requires your consent changes, we will ask for it again before carrying out that processing.