SparkLaunch Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how SparkLaunch ("SparkLaunch", "we", "us", "our") collects, uses, stores, and shares information when you use our websites, applications, and services.

This Privacy Policy provides notice of our data practices. Where consent is required, we request it separately at the relevant point of collection or use.

1. Scope

This Policy applies to SparkLaunch services, including product workflows that support startup formation, operations, and fundraising readiness (for example: idea analysis, planning, branding, landing pages, CRM, document vault, cap table, pitch decks, and incorporation workflows). It also applies when you connect an authorized AI Agent or other compatible client to SparkLaunch through the Model Context Protocol (MCP).

2. Information We Collect

We collect information you provide directly, information created through product usage, and limited technical data.

A. Account and profile data

• Name, email, profile image, sign-in provider details (for example Google OAuth or password login).
• Account security and session information (for example login timestamps, password reset records, auth tokens stored in browser local storage).
• Optional profile data such as preferred name, company name, phone, address, and tax identifier fields where you provide them.

B. Project and workflow data

• Startup ideas, descriptions, business planning inputs, generated outputs, and related workspace artifacts.
• Team, cap table, CRM, and GTM workflow data.
• Pitch deck content, presentation settings, and related analytics events.

C. Legal, compliance, and formation data

• Entity formation intake information, founder records, and consent records.
• Identity verification and KYC workflow data (including participant name, email, date of birth, verification status, and related webhook event records).
• EIN workflow information and SS-4 preparation data.
• 83(b) election workflow information and related proof artifacts.
• Some formation intake data is stored encrypted at rest in application storage.

D. Documents and vault activity

• Files uploaded to company library and investor vault features, plus metadata (for example filename, size, type, checksum, upload status).
• When you choose the cap-table extraction option after uploading external incorporation evidence, the current clean project-linked PDF, DOCX, or image may be sent to OpenAI to propose equity fields for your review. SparkLaunch does not automatically treat that proposal as current company truth, save an equity packet, or change your cap table or ledger from the analysis request alone.
• Share link settings (token hashes, optional password hashes, expiry and usage data).
• Vault audit activity, which may include actor identity, action type, and in some cases IP address and user-agent.

E. Payments and subscription data

• Payment and subscription status and metadata from our payment processor (Stripe), including Stripe customer/subscription/session IDs and transaction status.
• We do not store full raw payment card numbers in our application database.

F. Leads, analytics, and attribution data

• Landing page and GoLinks lead capture data (email, optional name, consent flags/text/time/source, UTM/referrer metadata).
• Product analytics and attribution fields (for example session IDs, anonymous IDs, URLs, referrers, event metadata).
• In enabled production environments, Google Analytics receives sanitized page paths, referrers, device/browser context, and non-PII event metadata unless you turn analytics off or enable browser Do Not Track. Google Ads measures new account signups and completed paid subscription checkouts as separate actions using opaque transaction identifiers and sanitized page context. SparkLaunch disables advertising storage, advertising user data, advertising personalization, and Google signals in this integration.
• Traffic data including path, URL, host, user-agent, and IP-derived data:
  • Some analytics flows store hashed IP values.
  • Some endpoints and audit contexts may store raw IP address values.

G. Communications and support data

• Support messages and operational context sent through service tools (for example email and Slack alerting workflows).

H. AI Agent and MCP connected-app data

When you choose to connect an AI Agent or other compatible MCP client to SparkLaunch, we process:

• OAuth client registration metadata, approved redirect addresses, the scopes you grant, your SparkLaunch account and selected project identifiers, and security metadata needed to issue, rotate, expire, and revoke the connection. SparkLaunch stores one-way hashes rather than reusable plaintext authorization codes or refresh tokens.
• The SparkLaunch tool name and the bounded, structured arguments or files you choose to send through the connected client, plus the minimum result, error, idempotency, and confirmation data needed to perform and reconcile the request. SparkLaunch does not receive your full AI Agent conversation or session unless you or the client include that content in a tool argument.
• Project and workflow records created or updated by an approved tool, including CRM personal data when you explicitly use a CRM tool. Results returned to the connected client are limited to the fields defined for that tool.
• Business-card images you explicitly submit are limited to supported image types and 10 MB. Images provided through an approved connected-client HTTPS file reference are analyzed and stored with the related CRM record. Images submitted through the authenticated first-party AI Agent handoff are analyzed in the request but are not saved by SparkLaunch to object storage or CRM attachment metadata; OpenAI, currently configured as the business-card analysis provider, may process the image under its own service terms. Generated logo and QR artifacts may be stored with your project and returned through an expiring HTTPS download link that is valid for no more than one hour.

ChatGPT and OpenAI process the information you provide to ChatGPT under their own terms and privacy policies. SparkLaunch controls only the data processing performed by SparkLaunch and its service providers.

I. Google Calendar connected-app data

When the Google Calendar connected app is available and you choose to connect it, we process:

• The verified Google account email, Google subject identifier, granted scopes, connection status, and connection and revocation timestamps.
• OAuth credentials needed to operate and revoke the connection. These credentials are encrypted and kept on SparkLaunch servers; they are not returned to the web or mobile app.
• Meeting information you explicitly submit from an eligible CRM contact, including title, start/end time, time zone, the server-derived contact attendee email, and any optional description or location. These fields are transmitted to Google Calendar to create the requested event and invitation; SparkLaunch does not retain a provider-event payload copy.
• Minimal opaque identifiers, hashes, outcome state, timestamps, and retry/recovery metadata needed to prevent duplicate invitations and recover an uncertain request. The related CRM activity retains the meeting title and start time as part of your CRM history.

This first workflow does not list calendars or events, read or import existing calendar content, search availability, select another calendar, create recurrence or conferencing, update or delete events, or synchronize Google Calendar data.

3. How We Use Information

We use collected information to:

• Provide, operate, and secure SparkLaunch services.
• Power end-to-end workflows from idea development to funding readiness.
• Personalize your experience and maintain your workspace state.
• Run analytics, monitor performance, prevent abuse, and troubleshoot incidents.
• Process payments and manage subscriptions.
• Communicate with you about account, product, support, and operational matters.
• Comply with legal obligations and enforce our agreements.

Google Calendar data

We use data obtained through the Google Calendar connected app only to provide and secure the connection, verify the selected organizer, create the meeting you request, notify its attendee, recover an uncertain exact-event request, and operate disconnect, revocation, security, and support controls. We do not use Google user data for advertising, sale, cross-app tracking, unrelated personalization, or training general-purpose AI or machine-learning models.

AI Agent and MCP data

We use MCP connection metadata and tool requests to authenticate the connected client, enforce the scopes and project you selected, perform only the requested SparkLaunch workflow, prevent duplicate writes, require confirmation for risky actions, return a bounded result, investigate abuse, and support revocation and recovery. OAuth credentials and security artifacts are not used for advertising or product-model training. Project and workflow data created through MCP is otherwise handled under the same purposes and choices as equivalent data created directly in SparkLaunch.

Product improvement and data moat

A core part of SparkLaunch is improving the quality and conversion strength of the idea-to-funding chain. We use collected workflow, usage, and outcome data to improve internal concepts, models, scoring systems, recommendations, prompts, routing logic, and automation quality. Where practical, we use aggregated or de-identified data; in other cases, we may use identifiable data when needed to operate and improve product performance and reliability.

The Google user data described above is excluded from these general product-improvement and model-training uses. Any use or transfer of information received from Google APIs must also comply with the Google API Services User Data Policy, including its Limited Use requirements where applicable.

4. Legal Bases (Where Applicable)

Depending on your location, we process data under one or more legal bases:

• Performance of a contract (providing the service you requested).
• Legitimate interests (service improvement, analytics, fraud prevention, platform security).
• Consent (for specific processing where required).
• Legal obligations.

5. How We Share Information

We may share information:

• With service providers and infrastructure partners that process data on our behalf (for example cloud hosting, identity/auth, AI processing, payments, messaging, and monitoring tools).
• With integrated providers you invoke through product workflows (for example Stripe, OpenAI, Google services, Veriff, AWS, email/SMTP providers, and operational alerting tools).
• With the AI Agent or MCP client you connect, by returning the requested tool result and any expiring file reference to that client. The client sends the tool inputs you approve to SparkLaunch and may retain them under its own terms and settings.
• When you explicitly create a Google Calendar meeting, with Google Calendar to create the event and with the contact you invite through the resulting guest notification and attendee calendar copy.
• With collaborators, invitees, and recipients of share links you create.
• With legal/regulatory authorities when required by law, legal process, or to protect rights and safety.
• As part of a merger, financing, acquisition, or similar corporate transaction.

We do not sell personal information for money. We do not sell Google user data or transfer it for advertising.

6. Cookies, Local Storage, and Similar Technologies

SparkLaunch uses browser storage and related technologies, including:

• Local storage for authentication/session state.
• Session storage for temporary workflow context and analytics session identifiers.
• First-party traffic measurement using sanitized page paths and temporary session identifiers.
• Google Analytics browser storage in enabled production environments unless you turn analytics off or browser Do Not Track is enabled. Advertising storage and personalization remain disabled.

You can open Manage analytics preferences on this Privacy Policy page to turn analytics off or back on. No analytics preference prompt appears automatically. Browser Do Not Track also keeps analytics off. Turning analytics off does not limit product features.

7. Data Retention

We retain information for as long as needed to:

• Provide and improve services.
• Maintain business and security records.
• Meet legal, tax, accounting, and compliance obligations.
• Resolve disputes and enforce agreements.

Retention duration varies by data type and workflow. Deleted or changed data may persist for limited periods in logs, backups, or legal records.

For AI Agent and MCP connections, authorization requests and codes become unusable within minutes, access tokens within no more than one hour, and grants and refresh tokens within no more than 90 days unless revoked sooner. Disconnecting or revoking the connection makes its grant and refresh-token family unusable immediately. Hashed security records and minimal operational logs may remain for fraud prevention, audit, backup, and legal purposes under our general retention rules. Project records, CRM records, business-card images stored through an approved connected-client file reference, and generated artifacts remain under the same workspace retention and deletion rules as data created directly in SparkLaunch; disconnecting the AI Agent does not by itself delete those records. SparkLaunch does not durably retain the raw image submitted through the authenticated first-party business-card handoff. Extracted CRM data remains under the normal CRM retention rules only after dedicated address fields are removed and high-confidence cross-field address checks pass. OpenAI, currently configured as the business-card analysis provider, may process the image under its own service terms. The handoff's opaque request identifier appears in its page and API paths and may be retained in protected infrastructure request logs for up to 90 days in production or 30 days outside production; it is not itself authorization to use the handoff. Expiring download links do not extend access after their stated expiration.

An external incorporation document remains in the Company Library under the normal workspace retention rules. If you choose cap-table extraction, SparkLaunch processes a bounded copy for that request and retains the returned equity fields in the browser only until you separately save the reviewed packet. OpenAI may process the submitted document content under its service terms; SparkLaunch application logs are designed to exclude raw document text, image bytes, credentials, and provider response bodies.

For the Google Calendar connected app, connection metadata and encrypted credentials are retained while the connection remains locally usable. Disconnect makes the connection unusable in SparkLaunch immediately and queues provider revocation; Google revocation may require retry or manual intervention. Minimal Calendar operation records are retained for no more than 30 days for duplicate prevention, recovery, and security and do not contain event text, attendee email, raw idempotency keys, or provider response bodies. A CRM meeting activity may remain with the related CRM record under the retention and deletion rules for CRM data. Events and invitation copies already created in Google Calendar or delivered to an attendee are controlled by those recipients and providers.

The Google Calendar disclosure describes the repository's pre-general-availability product boundary. Final product, security, privacy/legal, Google, and mobile-store review remains pending before general availability; this policy does not itself represent any external approval.

8. Security

We use administrative, technical, and organizational measures designed to protect data (for example access controls, encryption in transit, and audit/event logging in key workflows). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Data Transfers

Your information may be processed in jurisdictions outside your home country, including where our service providers operate. We use reasonable contractual and operational safeguards appropriate for those transfers.

10. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal information. You can also request information about how your data is processed.

To make a privacy request, contact us at support@sparklaun.ch.

You can disconnect or revoke an AI Agent/MCP connection without deleting your SparkLaunch account. You may separately request deletion of eligible SparkLaunch data under our Data Deletion Policy. Disconnecting does not remove copies already retained by your AI Agent, another connected client, a recipient, or another provider; use that provider's controls for those copies.

11. Children

SparkLaunch is intended for users age 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

The SparkLaunch Android app distributed through Google Play is intended only for adults age 18 and older. Google Play access to that app is restricted to users 18 and older. The minimum age for our other Services remains 13, subject to the guardian permission and additional eligibility requirements below.

If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete it. A parent or legal guardian who believes a child under 13 provided personal information may contact us at support@sparklaun.ch.

Users who are under the age of majority where they live may use SparkLaunch only with permission from a parent or legal guardian, as described in our Terms. Entity formation, document signing, payments, financial services, identity verification, regulated services, and third-party workflows may have additional eligibility requirements.

12. Changes To This Policy

We may update this Privacy Policy from time to time. We will post updates here with a revised "Last updated" date.

13. Contact

For privacy questions or requests:

• support@sparklaun.ch