Privacy Policy

1. Information about our customers and visitors. When you visit our website, create a Respark account, subscribe, or contact us, Respark decides how that information is used. This policy explains those practices.

2. Information we process for businesses that use Respark. Businesses and organizations use Respark to run their own campaigns. When you sign up on one of their campaign pages, buy from them, scan their QR code, or receive their emails, that business controls your information and decides how it’s used. Respark only processes it for them, under a Data Processing Addendum. To access, correct, or delete that information, or to stop their messages, contact the business directly (its name appears on the campaign page and in its emails). If you contact us, we’ll pass your request to the business.

Account and team information: name, email address, password (stored scrambled by our sign-in provider, never readable by us), business name, team members you invite, and their roles.

Billing information: plan, billing status, and billing contact details. Card numbers are entered on Stripe’s page and go directly to Stripe; we never see or store them.

Content you add: campaigns, contacts, sales records, notes, images and logos, email content, and settings. (This is the business’s data described in Section 1.)

Support and the Spark assistant: questions you type into Spark and messages you send to support, including your email address if you ask for help.

Technical information: basic server logs (such as IP address, browser type, pages requested, and errors) used for security and to keep the Service working. To limit abuse, we store short-lived counters keyed by a scrambled (hashed) version of an IP address. For flyer QR scans we record the time and a one-way code that changes every day, so a business can estimate unique scans without identifying anyone.

Integrations: if a business connects Shopify, we receive order details for its linked products so the sale can be recorded.

On a business’s campaign page or form, Respark collects, on that business’s behalf:

• what you enter: name, email, phone number, and optional details like city;
• your choices about receiving emails or text messages, with the exact wording you agreed to and the time (kept as proof of consent);
• confirmation that you are 18 or older;
• activity with that business: which campaign you signed up through, purchases it records, whether its emails were opened or links clicked, and which participant or referral link you used.

Fundraising participants (for example students or players) sign up with only a first name, last initial, and group. We don’t ask participants for contact details.

• to provide, maintain, and secure the Service, and to sign you in;
• to process subscriptions and payments;
• to send account emails (sign-up confirmation, password resets, billing notices, renewal reminders, security alerts, and important changes);
• to answer support questions and run the Spark assistant;
• to prevent fraud, spam, and abuse, and to enforce our Terms;
• to understand, in aggregate, how the Service is used so we can improve it;
• to comply with the law and respond to lawful requests;
• for information we process for businesses: only to provide the Service to that business and follow its instructions.

We do not sell personal information, share it for cross-context behavioral (targeted) advertising, or use it for profiling that has legal or similarly significant effects. We don’t use businesses’ data or your Spark questions to train AI models.

We share information only as needed to run the Service, with these service providers, which are bound by contract to protect it and use it only for us:

We may also share information:

• with the business you interacted with (for information collected on its behalf);
• when the law requires, or to protect the rights, safety, and security of Respark, our customers, or others;
• if Respark is reorganized (for example into a company), merged, or sold, in which case this policy continues to protect your information;
• with your permission.

• We use only essential cookies and browser storage: to keep you signed in, remember which business you’re working in, and remember small preferences (like a plan you picked or whether you’ve seen the homepage intro).
• We don’t use advertising cookies, third-party tracking pixels, or session-recording tools, and we don’t let ad networks track you on our site.
• Campaign emails sent through Respark may include a tiny image and tracked links so the sending business can see opens and clicks.
• Global Privacy Control and Do Not Track: because we don’t sell or share personal information for targeted advertising, there’s nothing to opt out of; we treat these signals as an opt-out request anyway.

• Account and business data: while the account is open. After an account closes, the business has 30 days to export its data; then we delete it within 30 days, and from backups as they expire.
• Proof of consent (email and text permissions): as long as the related contact exists, and longer if needed to show compliance with the law.
• Billing records: as long as required for tax and accounting (generally up to 7 years).
• Abuse counters: hours to days. Daily scan codes: they change every day and can’t identify you.
• Support messages: up to 2 years.

We protect information with encryption in transit (HTTPS), encryption at rest by our hosting providers, database rules that keep each business’s data separate from every other business’s, limited access, and automated testing of those protections. No system is perfectly secure, so we can’t guarantee absolute security. If a breach affects your information, we’ll notify you and the businesses involved as the law requires.

Depending on where you live (including Indiana, California, Virginia, Colorado, Connecticut, Texas, and other states with privacy laws), you may have the right to:

• know and access the personal information we have about you, and get a portable copy;
• correct inaccurate information;
• delete your information;
• opt out of the sale of personal information, targeted advertising, and certain profiling (we don’t do these);
• not be treated differently for using your rights;
• appeal if we decline your request.

How to make a request: email support@resparkgroup.com from the email address on your account, or describe how you interacted with Respark. We’ll verify your identity before acting, and respond within 45 days (we may extend once by 45 days if needed, and will tell you). You can use an authorized agent; we may ask for proof of their authority. Account holders can also update their details and delete contacts directly in the app.

Appeals: if we decline your request, email support@resparkgroup.com with “Privacy appeal” in the subject. We’ll respond within 60 days and explain our decision. If you’re not satisfied, you can contact your state attorney general (for Indiana residents, the Indiana Attorney General).

Information a business collected about you: please contact that business, as explained in Section 1. We’ll help it respond.

In the last 12 months we collected these categories of personal information, from you, your devices, and the businesses you deal with:

• identifiers (name, email, phone, IP address, account ID);
• customer records and commercial information (business name, plan, purchases recorded by businesses);
• internet activity (pages requested, email opens and clicks for campaign emails);
• general location (city, if provided);
• inferences are not created; sensitive personal information is not collected or used to infer characteristics.

We use these for the business purposes in Section 4 and disclose them only to the service providers and parties in Section 5. We have not sold or shared personal information (as those terms are defined in the CCPA), including of anyone under 16. We keep each category for the periods in Section 7. California’s “Shine the Light” law: we don’t share personal information with third parties for their own direct marketing.

Respark accounts are for adults (18+), and campaign sign-up forms ask people to confirm they are 18 or older. We don’t knowingly collect personal information from children under 13. Fundraising participant sign-ups collect only a first name, last initial, and group, at the direction of the organization running the fundraiser, which is responsible for any parent, guardian, or school permission. If you believe a child under 13 has given us personal information, email support@resparkgroup.com and we’ll delete it.

We send account and transactional emails (like confirmations, password resets, billing, and security notices); you can’t opt out of these while you have an account. If we send marketing emails about Respark, each one will have an unsubscribe link.

Respark is operated from the United States and intended for U.S. businesses and organizations. Our service providers may store and process information in the United States and other countries where they operate, with appropriate protections.

We may update this policy. We’ll post the new version here with a new “Last updated” date, and for material changes we’ll notify account holders by email or in the app before they take effect.

Ivan Balboa, doing business as Respark · support@resparkgroup.com · https://resparkgroup.com