Privacy Statement

At 2BrightSparks, your privacy is very important to us. This privacy notice explains what to expect when 2BrightSparks Pte Ltd collects personal information from users. We collect very little. If you buy from us, the customer record we keep is your name, your email address, and the country and company name supplied with the order, alongside the order details themselves. If you open a support ticket, register on our forum or join our mailing list, we hold what you provide for that purpose, and each of those is described below. We do not collect credit card numbers, and we do not collect sensitive personal information.

This policy (together with the Terms and Conditions on our website and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. 2BrightSparks Pte Ltd has no subsidiaries or group companies; “we”, “us” and “our” mean 2BrightSparks Pte Ltd alone. We do work with independent resellers through our affiliate program, which is described below.

Collection, processing and passing on of personal data

Some information is collected automatically whenever anyone visits our website. Our servers, and Cloudflare which delivers and protects the site, record your IP address, the page you asked for, the page you came from, the date and time, and your browser, operating system and device type. The cookies and similar identifiers described later on this page are also set automatically, subject to the consent rules explained under Use of Cookies. IP addresses and identifiers of this kind can amount to personal data even though they contain no name, and we treat them accordingly. We use them to serve and secure the site, to defend it against attack and abuse, and to measure and advertise our products.

Beyond that, personal data is collected only if you give it to us, for example:

• Creating a support ticket on our website (stored by Freshdesk – ticket support site). We previously used UserVoice for support ticketing. We no longer use that service, but we retain a read-only archive of those historic tickets on our own servers.

• Placing an order on our webstore (stored by FastSpring – webstore host, payment processor, Merchant of Record)

• Registering and posting on our forum (stored by 2BrightSparks on Amazon servers)

• Subscribing to our mailing list (managed by 2BrightSparks and stored on Amazon servers, and sent using Amazon SES)

• Customer database (managed by 2BrightSparks and stored on Amazon servers)

• Registering and usage of reseller affiliate program (stored by FastSpring Impact)

• Submitting upgrade enquiries (stored by Logiforms)

• Email correspondence (stored by Microsoft Office365)

What information do we collect?

When you place an order on our webstore, your full name, company (optional), email address and credit card information (or information for other forms of payment) will be required. The information is used by FastSpring to complete the transaction and the order receipt email is sent to your email address, while your full name and company (if any) will be displayed in your invoice. We generally do not collect addresses but on some occasions, customers may contact us and explicitly request that we include their address in the invoice, which we will add on request.

FastSpring does not provide the payment details to 2BrightSparks. We do not receive or record credit card numbers or other payment details. FastSpring passes us only the last four digits of the card so that a payment can be matched to an order.

The customer record we keep contains your first and last name, your email address, and the order details themselves (product, version, amount, currency, invoice reference and coupon, if any). Where the checkout collected them it also contains a company name, a country and a language preference. The country reaches us because FastSpring, as Merchant of Record, needs it to calculate and remit sales tax and VAT on the sale; we keep it so that we can tell which jurisdiction a licence was sold in. We do not collect or store telephone numbers. This information helps with customer support, license verification and subscriptions.

Where you link SyncBackPro to a cloud service such as Amazon S3, Microsoft Azure, OneDrive, Google Drive, Dropbox or Backblaze B2, that connection is made from your own computer using your own account. We do not receive or store your credentials, your access tokens, or the contents of the files you back up.

Where a service uses OAuth to authorise that link, the provider returns you to a page on our website once you have approved it, and the short-lived authorisation code forms part of that redirect, so it passes through our web server in transit. The exchange of that code for the access and refresh tokens themselves is made directly between SyncBackPro and the provider, not through us, and those tokens are stored only on your own computer.

When you provide us with personal identifying information in an e-mail or ticket support, we use the information to locate your records and provide you with answers to your questions. We use third party vendors and hosting partners to provide the necessary networking, storage, query and retrieval of these records. When you submit a ticket to our support channel, your information (like name and email address) will be captured by our customer support partner, Freshdesk.

We have an active forum that runs on phpBB, an open source forum software. When you visit our forum and signup as a forum member and/or submit postings, we may collect your information based on what you submit to us. Your forum account will contain a uniquely identifiable name (user name), a personal password used for logging into your account and a personal, valid email address. Any information beyond your user name, password, and email address during the registration process is either mandatory or optional, at the discretion of 2BrightSparks. In all cases, you have the option to decide what information in your account is publicly displayed. Furthermore, within your account, you have the option to opt-in or opt-out of automatically generated emails from the phpBB software.

We have an affiliate program where resellers can sign up as our affiliates to earn commission for reselling our products. This program is hosted by Impact (owned by FastSpring), our affiliate management partner. All account information required during registration are required by Impact and the reseller information database is hosted by them.

When you subscribe to our mailing list, you provide us with a valid email address which is stored on our servers. During the purchase process, you can also optionally opt-in to our mailing list. If so, the name you used during the purchase process is also recorded in the mailing list database along with your email address.

Information collected by our software

SyncBackPro, SyncBackSE and SyncBackFree contain no telemetry and no usage analytics. They do not create a machine or installation identifier, and they do not report on what you back up, when, or where to.

Licence validation is performed entirely on your own computer: there is no activation server, and no check with us is needed for your licence to work. Installing the program contacts us only if you agree to the update check the installer offers, described below. When you enter a serial number we do offer to fetch your Upgrade Assurance details, which sends your serial number as described below; you can decline that and enter an offline Upgrade Assurance serial instead.

The software contacts our servers only in the following cases:

• Checking for a new version. Made only while the program is open in front of you, at most once every 30 days by default. We never make this check on our own initiative during a scheduled or otherwise unattended run. The one exception is where you have asked for it yourself by using one of the version variables in a profile, in which case the version is looked up while that profile runs. You can turn the check off in Preferences. Administrators deploying the software can also set a different interval, or disable the check, at installation time. The request is for one or two static text files, one for the current release and one for the latest major version, and carries no information about you or your machine.

• Checking for a newer version before installing. Made by a SyncBack setup program that is more than 120 days old, and only if you click Check now when it asks. It sends the product name (SyncBackFree, SyncBackSE or SyncBackPro), its version number, whether it is the 32-bit or 64-bit installer, and whether it is installing for all users or the current user. No serial number, name, email address or computer identifier is sent with the check. If it offers a newer major version of SyncBackSE or SyncBackPro and you click to upgrade, the setup program asks the copy already installed on your computer for its serial number and adds it to the address of the upgrade page it opens in your web browser, so that page can look up your licence. That address is recorded like any other page you visit on our website. The script that answers the check does not keep a log, although, as with any request to our website, your IP address and the time of the request are recorded in our web server's access log and by Cloudflare. Silent installations never make this check, and it can be switched off with the /NOUPDATECHECK command line parameter.

• Checking for a new version of SyncBack Touch. Made by SyncBackPro and SyncBackSE on the same schedule as the check above, as a separate request. It carries no information about you or your machine and returns a version number, so we can tell you when a device running SyncBack Touch is out of date.

• Checking Upgrade Assurance status. Made by licensed copies of SyncBackPro and SyncBackSE as part of the version check above, and also whenever you ask for it, for example from the About box, the status bar or the serial number dialog. This request sends your serial number together with the edition and version you are running, and nothing else. It returns your subscription dates and, where applicable, the expiry month and year of the payment card held by our payment processor. SyncBackFree does not make this call.

• Requesting a Customer Account Portal email. Made only when you click the link asking for one. It sends your serial number and returns the email address registered to that licence, which is shown to you partly masked.

• Looking up your public IP address. Made only during an FTP profile run that uses active (PORT) mode, and only where the external address is set to be determined automatically or has been left blank. It sends nothing and returns your own public IP address, which is then given to the FTP server. Passive mode, which is the default, never makes this call.

Crash reports are never transmitted automatically. If the program encounters an unexpected error, the report is saved to a file on your own computer. When you are using SyncBack interactively you are shown the report and can choose to send it to us; if you do, the program sends it directly from your computer to our support address. During a scheduled or unattended run the report is simply saved to disk and nothing is sent.

A crash report that you choose to send contains more than the error itself, so it is worth knowing what is in one before you send it. It contains your serial numbers, stored encrypted within the report, your Upgrade Assurance serial, a session identifier, the path to your temporary folder and its free space, the list of modules loaded into the program, and the stack trace. It also contains the standard diagnostic header, which includes your computer name, your Windows user name, the Terminal Services client name where one applies, the registered owner and organisation recorded in Windows, and the command line the program was started with, which on a scheduled run names the profile being run. You see the report before it is sent, and nothing is sent if you decline.

The Technical Support Wizard likewise creates a file on your disk and uploads nothing.

Separately, if you use the optional AI features in SyncBackPro, you supply your own API key and the requests go directly from your computer to the provider you have chosen. Prompts may include profile settings and extracts from run logs, so that material is sent to that provider. 2BrightSparks is not involved in those requests and receives nothing from them.

Use of Your Personal Information

2BrightSparks collects and uses your personal information to operate and improve its sites and services. These uses may include, but are not limited to, providing you with more effective customer service (ticketing support); making the sites or services easier to use by eliminating the need to repeatedly enter the same information (forum); providing customized upgrade information regarding your license (customer database) and sending you content regarding our products (mailing list).

We may also use your personal information to communicate with you. We may send service communications relating to something you have bought or asked us about, such as your order confirmation and license details, replies to your support tickets, information on technical service issues, and security announcements. These are not marketing and are sent because they are necessary.

Newsletters, product surveys and other promotional email are sent only to people who have subscribed to our mailing list. Subscribing is entirely optional and is always something you choose: either on our website, or by ticking the box offered during the purchase process. You can unsubscribe at any time using the link in any such email or our Unsubscribe Page. If you have not subscribed, we will not send you marketing email.

Some of the service providers listed below are located outside Singapore, principally in the United States and the European Union, so providing our services involves transferring personal data internationally. Where that happens we rely on the safeguards offered by those providers, which include the European Commission’s Standard Contractual Clauses and, for providers certified under it, the EU-U.S. Data Privacy Framework. We do not rely on your having consented to such transfers merely by visiting the website.

Removal procedures

If you no longer wish to receive email from our mailing list, visit our Unsubscribe Page to remove your email address from it. You can also contact us to have your details removed from our servers.

We will delete what we are able to delete. A limited amount of transaction information has to be retained, because Singapore tax and accounting law requires us to keep records of sales for at least five years from the relevant Year of Assessment. That retention is a legal requirement rather than a preference on our part, and everything beyond it can be removed on request.

Please note that deleting your customer record also removes our ability to look up your license details for you later, so please keep your own copy of your serial number before asking us to remove it.

To remove your data from 3rd party services that are used by 2BrightSparks see the List of third-party services section below.

Use of Cookies

The 2BrightSparks website uses cookies, including cookies set by the third-party services listed below. Some are necessary for the site to work; others are used for analytics and for advertising, including measuring our advertising and showing our products to people who have visited us before.

We manage cookie consent using Cookiebot, and the behaviour depends on where you are. In countries whose law requires your prior permission, including the European Economic Area, the United Kingdom and Switzerland, you are shown a consent banner when you first visit, and cookies that are not strictly necessary are not set until you allow them. In other countries, including Singapore, local law permits a different default and non-essential cookies may be set before you make a choice.

Wherever you are, you can make or change that choice at any time by reopening the Cookiebot banner, and you can decline or delete cookies in your browser settings. Declining does not prevent you from using the site, downloading our software or making a purchase.

We have a knowledge base article which you can read to learn more about how we use cookies.

List of third-party services used by 2BrightSparks

We use third-party companies to deliver content and to provide services and support. Where such a company processes personal data on our behalf, we remain responsible for it and put appropriate contractual safeguards in place; where it acts as an independent controller, such as FastSpring, its own privacy policy governs what it does with the data it holds. The companies we use, and their privacy statements, are listed below.

• Freshdesk – ticket support channel (https://www.freshworks.com/privacy/). If you wish to request that they no longer use your Collected Data, contact them at [email protected].

• FastSpring – Webstore host and payment processor (https://fastspring.com/privacy/). To remove your data contact [email protected]

• Logiforms – Submission of user feedback and serial number disputes (https://www.logiforms.com/user-legal/privacy-policy/)

• Office 365 – 2BrightSparks company email hosted by Microsoft (https://privacy.microsoft.com/en-ca/privacystatement)

• Google Analytics and Google Tag Manager – See the section below for details.

• Cookiebot (Usercentrics) – Cookie consent management. Records your consent choice and processes your IP address for that purpose (https://www.cookiebot.com/en/privacy-policy/)

• Cloudflare – Content delivery, security and bot protection for this website, including the Turnstile check used on our forms. Cloudflare processes the IP address of every visitor in order to serve and protect the site (https://www.cloudflare.com/privacypolicy/)

• Amazon Web Services – Hosts our mailing list server and, through Amazon SES, delivers the email we send from it (https://aws.amazon.com/privacy/)

• Stop Forum Spam – Checks mailing list sign-ups against a database of known spammers, so our list cannot be used to sign up people without their knowledge. We send a one-way hash of the email address rather than the address itself (https://www.stopforumspam.com/privacy)

• Freshworks – The support widget shown on some pages, provided by the same company as Freshdesk (https://www.freshworks.com/privacy/)

• ReviewsOnMyWebsite – Displays customer reviews on our website (https://localimpact.com/privacy)

• Smartarget – Displays promotional and contact widgets on our website (https://smartarget.online/page_privacy.html)

• Google Ads – Measures the effectiveness of our advertising and allows us to show our products again to people who have already visited the site. Uses cookies and similar identifiers, including those set by DoubleClick (https://policies.google.com/technologies/ads)

• Microsoft Advertising (Bing) – Does the same for our advertising on Microsoft’s search network (https://privacy.microsoft.com/en-ca/privacystatement)

• Impact – Runs our reseller affiliate program, including the tracking that determines whether a purchase came through an affiliate. Impact is FastSpring’s affiliate platform partner (https://impact.com/privacy-policy/)

• Capterra, GetApp and Software Advice – Review badges displayed on our website, all operated by Gartner (https://www.gartner.com/en/about/policies/privacy)

Google Analytics and Google Tag Manager

This website uses Google Analytics 4, a web analytics service provided by Google LLC (“Google”), which we load through Google Tag Manager. Google Analytics uses cookies to help us understand which pages are useful and how the site is being used. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.

Analytics cookies are not set unless you allow them in the consent banner described above, and you can withdraw that consent at any time. Google Analytics 4 does not log or store IP addresses; the IP address of a visitor is used in transit to derive an approximate location and is then discarded. Google may also transfer information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf.

Google LLC is certified under the EU-U.S. Data Privacy Framework, together with its UK Extension and the Swiss-U.S. Data Privacy Framework, which is the mechanism relied upon for transfers of this data to the United States.

Our legal bases for processing

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases for processing your personal data:

• Performance of a contract – to process your order, issue and verify your license, and provide the product support that comes with it.

• Legal obligation – to keep records of sales for the period required by tax and accounting law.

• Legitimate interests – to answer support enquiries, to operate and secure our website and forum against attack and abuse, and to keep proper business records. We rely on this only where it does not override your rights.

• Consent – for our mailing list and for any cookie that is not strictly necessary. Where we rely on consent you may withdraw it at any time, and doing so does not affect anything done before you withdrew it.

How long we keep your information

We retain your personal information for as long as it is needed for the purposes set out in this privacy policy, unless a longer retention period is required by law. In practice this means we keep your customer and license record for as long as your license is in use, so that we can verify it and help you recover it; records of sales are retained for at least five years in order to meet Singapore accounting and tax requirements; support tickets are retained for as long as they remain useful for handling follow-up enquiries; and mailing list entries are kept until you unsubscribe.

Children

Our software, website, webstore and forum are intended for adults and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe that a child has provided us with personal information, please email [email protected] and we will delete it.

Sharing of your information with external parties

We have never sold personal information for money, and we never will.

We do disclose personal data in three situations. The first is to companies carrying out a service on our behalf, such as our support desk and our email host. They act on our instructions, we remain responsible for the data, and we put appropriate contractual safeguards in place with them. The second is to companies acting as independent controllers of their own, principally FastSpring, which is the Merchant of Record for every purchase and therefore the seller in its own right; FastSpring handles payment data under its own privacy policy, and you can contact it directly about that data. The third is where the law requires it, or where it is necessary to establish, exercise or defend legal claims, or to prevent fraud and abuse.

Our advertising and analytics services should be mentioned separately, because they are not simply acting on our instructions. Where you have allowed advertising cookies, or where local law permits them without prior consent, Google and Microsoft receive identifiers that let us measure our advertising and show our products again to people who have visited us. Some privacy laws classify that as "sharing" for cross-context behavioural advertising even though no money changes hands. If you would rather it did not happen, decline advertising cookies in the Cookiebot banner.

If something goes wrong

If we become aware of a security incident affecting your personal data, we will investigate it promptly and notify the relevant supervisory authority where the law requires us to, which under Singapore’s Personal Data Protection Act means within three calendar days of establishing that a breach is notifiable, and under the GDPR means within 72 hours of becoming aware of it. Where an incident is likely to result in a significant risk to you, we will contact you directly as well, using the email address we hold, and tell you what happened, what data was involved and what you can do about it.

Changes to the Privacy Policy

2BrightSparks Pte Ltd may amend this policy by posting the amended terms on our web site, and the date at the foot of this page will be updated whenever we do. Where a change materially affects how we handle your personal data we will take reasonable steps to bring it to your attention, for example by a notice on the website or, where appropriate, by email.

Data Protection Officer

2BrightSparks Pte Ltd has designated a Data Protection Officer, as required by Singapore’s Personal Data Protection Act. The Data Protection Officer can be reached at [email protected].

Contacting Us

2BrightSparks welcomes your comments regarding this privacy statement. For anything to do with your personal data, including the rights described below, you can email our privacy address directly at [email protected]. For anything else, or if you would rather not use email, please contact us.

2BrightSparks Pte Ltd is a company registered in Singapore and is the data controller for the personal information described in this policy. We comply with applicable data protection laws, including Singapore’s Personal Data Protection Act 2012 (PDPA), the EU’s General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

Depending on where you live, you may have the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, to have it deleted, to object to or restrict how we use it, to receive it in a portable form, and to withdraw consent you have previously given. You will never be treated differently for exercising any of these rights. To make a request, email [email protected] or use our contact form, and we will respond within the time limits set by the applicable law. If you are not satisfied with our response you may complain to your local supervisory authority. In Singapore that is the Personal Data Protection Commission. If you are in the European Economic Area it is the data protection authority of the country where you live, work, or where you believe the problem occurred, and in the United Kingdom it is the Information Commissioner’s Office.

2BrightSparks Pte Ltd
https://www.2brightsparks.com

Last Modified September 2026