Privacy policy

Who this covers

SPARK is business software. Companies that use SPARK ("customers") decide what information goes into their SPARK company and who can see it. For that information we act on the customer's behalf. This policy also covers visitors to sparkboss.app.

Information we collect

• Account information: staff names, work email addresses, roles, permissions and sign-in records.
• Business records entered by customers: such as customers, addresses, products, orders, invoices, jobs, schedules, time records, photos, tasks and messages.
• Connected-integration data: information a customer authorizes from third-party services it connects (see Connected third-party integrations below).
• Technical information: basic request and error logs needed to run and secure the service.
• Information from customers' own customers: when a customer's client uses a company website, customer portal or survey.

How we use information

• To provide, secure, support and improve SPARK for the customer.
• To enforce company separation, permissions and history.
• To provide AI assistance requested by authorized users, within their permissions.
• To meet legal obligations.

SPARK does not sell personal information and does not use customer data for advertising.

Company separation and authorized access

Each company's records are separated by database rules. Staff see only what their company and permissions allow. SPARK operations staff access customer data only when needed to operate, secure or support the service.

Service providers (subprocessors)

We use service providers to run SPARK, which may include:

• Lovable — application hosting, database, authentication, file storage and email delivery;
• cloud infrastructure providers used by our hosting provider;
• AI model providers reached through Lovable's AI gateway, for AI features requested by users;
• services a customer chooses to connect, such as Zoom or Google Workspace.

Safeguards

• Encrypted connections (HTTPS) between browsers and SPARK.
• Database-enforced company separation and permission checks.
• Encryption of stored sign-in tokens for connected services such as Zoom; service secrets stay on the server.
• Signature checks on incoming updates from connected services.
• Recorded history of important changes, corrections and approvals.

No system is perfectly secure. SPARK does not currently hold independent security certifications.

Retention

We keep customer information for as long as the customer's SPARK company is active and as needed to keep required business, tax and audit history, resolve disputes and meet legal obligations. Some history is kept append-only so it cannot be silently changed. When a customer ends use of SPARK, we will handle export and deletion of its information as agreed with that customer.

Connected third-party integrations

A company can choose to connect outside services to its SPARK company, such as phone systems, email, calendar, accounting or manufacturer portals. For every integration:

• It is turned on only by a person at that company who has permission, and only for that one company.
• SPARK receives only the data the company authorizes on the provider's own approval screen, and uses it only to provide the features the company turned on.
• Sign-in tokens and keys for the service are kept on the server, encrypted where stored, and never shown in the app.
• Incoming updates are checked for authenticity before they are accepted and are linked to exactly one company.
• The company can disconnect at any time. Disconnecting stops new data; records already saved stay with the company's SPARK records under the retention terms above unless the company asks for export or deletion.
• The outside service's own privacy policy and terms also apply to the data it holds.

Integration-specific details are listed below.

Zoom Phone (Zoom Data)

This section applies when a customer connects its Zoom account to SPARK Phone.

• Access is authorized by the customer: SPARK accesses only the Zoom data that the customer's Zoom administrator approves on Zoom's authorization screen.
• What the core release receives: Zoom account/user IDs, display names, extensions, account numbers and call metadata (caller/callee, time, direction, duration and reported outcome). Safe API evidence contains endpoint category, attempt/time, HTTP result/count and request ID, never provider bodies or tokens.
• Why: to show calls, match them within the company's records by exact phone number, and support internal follow-ups. Last-observed directory records are not automatically mapped to employee identities.
• Optional historical data: voicemail/SMS/media records or references previously recorded remain private under existing permissions. New optional event processing and external recordings/transcripts are disabled in this core release; no optional scope is recommended. Removing a scope does not delete existing history.
• Separation: Zoom data is linked to one SPARK company and is never shown to another company. A Zoom account can be connected to one SPARK company at a time.
• Tokens: Zoom sign-in tokens are encrypted, stored only on the server and never shown in the app.
• Disconnection: when a customer disconnects Zoom in SPARK, stored Zoom tokens are deleted immediately and pending updates stop. Customers should also remove the app in Zoom; automatic disconnection when the app is removed in Zoom is not yet available.
• Retention and deletion: call history already saved remains part of the customer's SPARK records after disconnection, under the retention terms above. A customer may request export or deletion of Zoom-derived records.
• No sale or advertising: Zoom data is not sold and is not used for advertising.
• Customer responsibilities: customers are responsible for employee notices and for consent required by law for recording calls and for text messaging.

Limited disclosures

We disclose information only to our service providers to run SPARK, when the customer directs us to (for example, by connecting a service), when required by law, to protect the rights and safety of people or the service, or as part of a business transfer subject to this policy.

Cookies and similar technology

SPARK stores sign-in information and display preferences (such as theme) in your browser so the service works. SPARK does not use advertising or third-party tracking cookies.

Children

SPARK is for businesses and is not directed to children under 16. We do not knowingly collect their information.

International processing

Our service providers may process information in the United States and other countries where they operate.

Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information held about you;
• correct inaccurate information;
• delete information;
• receive a portable copy, or restrict or object to certain processing, where applicable law provides.

How to exercise them: if your information is in SPARK because of a company you work for or do business with, contact that company first — it controls its records, and we will help it respond. Staff can also ask their company's SPARK administrator. We will verify requests before acting and will not discriminate against you for exercising your rights. You can also write to us directly at privacy@sparkboss.app.

Changes

We may update this policy. We will post the updated version here and, for significant changes, notify customers.

Contact

Privacy questions and requests: privacy@sparkboss.app. Product support: support@sparkboss.app. For Zoom integration questions, see Zoom Phone support.