SparkLaunch Privacy Policy

Last updated: August 6, 2026

This Privacy Policy explains how SparkLaunch ("SparkLaunch", "we", "us", "our") collects, uses, stores, and shares information when you use our websites, applications, and services.

By using SparkLaunch, you agree to this Privacy Policy.

1. Scope

This Policy applies to SparkLaunch services, including product workflows that support startup formation, operations, and fundraising readiness (for example: idea analysis, planning, branding, landing pages, CRM, document vault, cap table, pitch decks, and incorporation workflows).

2. Information We Collect

We collect information you provide directly, information created through product usage, and limited technical data.

A. Account and profile data

• Name, email, profile image, sign-in provider details (for example Google OAuth or password login).
• Account security and session information (for example login timestamps, password reset records, auth tokens stored in browser local storage).
• Optional profile data such as preferred name, company name, phone, address, and tax identifier fields where you provide them.

B. Project and workflow data

• Startup ideas, descriptions, business planning inputs, generated outputs, and related workspace artifacts.
• Team, cap table, CRM, and GTM workflow data.
• Pitch deck content, presentation settings, and related analytics events.

C. Legal, compliance, and formation data

• Entity formation intake information, founder records, and consent records.
• Identity verification and KYC workflow data (including participant name, email, date of birth, verification status, and related webhook event records).
• EIN workflow information and SS-4 preparation data.
• 83(b) election workflow information and related proof artifacts.
• Some formation intake data is stored encrypted at rest in application storage.

D. Documents and vault activity

• Files uploaded to company library and investor vault features, plus metadata (for example filename, size, type, checksum, upload status).
• Share link settings (token hashes, optional password hashes, expiry and usage data).
• Vault audit activity, which may include actor identity, action type, and in some cases IP address and user-agent.

E. Payments and subscription data

• Payment and subscription status and metadata from our payment processor (Stripe), including Stripe customer/subscription/session IDs and transaction status.
• We do not store full raw payment card numbers in our application database.

F. Leads, analytics, and attribution data

• Landing page and GoLinks lead capture data (email, optional name, consent flags/text/time/source, UTM/referrer metadata).
• Product analytics and attribution fields (for example session IDs, anonymous IDs, URLs, referrers, event metadata).
• Only after you explicitly allow production web analytics, Google Analytics receives sanitized page paths, referrers, device/browser context, and non-PII event metadata. SparkLaunch disables advertising storage, advertising user data, advertising personalization, and Google signals in this integration.
• Traffic data including path, URL, host, user-agent, and IP-derived data:
  • Some analytics flows store hashed IP values.
  • Some endpoints and audit contexts may store raw IP address values.

G. Communications and support data

• Support messages and operational context sent through service tools (for example email and Slack alerting workflows).

H. Google Calendar connected-app data

When the Google Calendar connected app is available and you choose to connect it, we process:

• The verified Google account email, Google subject identifier, granted scopes, connection status, and connection and revocation timestamps.
• OAuth credentials needed to operate and revoke the connection. These credentials are encrypted and kept on SparkLaunch servers; they are not returned to the web or mobile app.
• Meeting information you explicitly submit from an eligible CRM contact, including title, start/end time, time zone, the server-derived contact attendee email, and any optional description or location. These fields are transmitted to Google Calendar to create the requested event and invitation; SparkLaunch does not retain a provider-event payload copy.
• Minimal opaque identifiers, hashes, outcome state, timestamps, and retry/recovery metadata needed to prevent duplicate invitations and recover an uncertain request. The related CRM activity retains the meeting title and start time as part of your CRM history.

This first workflow does not list calendars or events, read or import existing calendar content, search availability, select another calendar, create recurrence or conferencing, update or delete events, or synchronize Google Calendar data.

3. How We Use Information

We use collected information to:

• Provide, operate, and secure SparkLaunch services.
• Power end-to-end workflows from idea development to funding readiness.
• Personalize your experience and maintain your workspace state.
• Run analytics, monitor performance, prevent abuse, and troubleshoot incidents.
• Process payments and manage subscriptions.
• Communicate with you about account, product, support, and operational matters.
• Comply with legal obligations and enforce our agreements.

Google Calendar data

We use data obtained through the Google Calendar connected app only to provide and secure the connection, verify the selected organizer, create the meeting you request, notify its attendee, recover an uncertain exact-event request, and operate disconnect, revocation, security, and support controls. We do not use Google user data for advertising, sale, cross-app tracking, unrelated personalization, or training general-purpose AI or machine-learning models.

Product improvement and data moat

A core part of SparkLaunch is improving the quality and conversion strength of the idea-to-funding chain. We use collected workflow, usage, and outcome data to improve internal concepts, models, scoring systems, recommendations, prompts, routing logic, and automation quality. Where practical, we use aggregated or de-identified data; in other cases, we may use identifiable data when needed to operate and improve product performance and reliability.

The Google user data described above is excluded from these general product-improvement and model-training uses. Any use or transfer of information received from Google APIs must also comply with the Google API Services User Data Policy, including its Limited Use requirements where applicable.

4. Legal Bases (Where Applicable)

Depending on your location, we process data under one or more legal bases:

• Performance of a contract (providing the service you requested).
• Legitimate interests (service improvement, analytics, fraud prevention, platform security).
• Consent (for specific processing where required).
• Legal obligations.

5. How We Share Information

We may share information:

• With service providers and infrastructure partners that process data on our behalf (for example cloud hosting, identity/auth, AI processing, payments, messaging, and monitoring tools).
• With integrated providers you invoke through product workflows (for example Stripe, OpenAI, Google services, Veriff, AWS, email/SMTP providers, and operational alerting tools).
• When you explicitly create a Google Calendar meeting, with Google Calendar to create the event and with the contact you invite through the resulting guest notification and attendee calendar copy.
• With collaborators, invitees, and recipients of share links you create.
• With legal/regulatory authorities when required by law, legal process, or to protect rights and safety.
• As part of a merger, financing, acquisition, or similar corporate transaction.

We do not sell personal information for money. We do not sell Google user data or transfer it for advertising.

6. Cookies, Local Storage, and Similar Technologies

SparkLaunch uses browser storage and related technologies, including:

• Local storage for authentication/session state.
• Session storage for temporary workflow context and analytics session identifiers.
• First-party traffic measurement using sanitized page paths and temporary session identifiers.
• Google Analytics browser storage in enabled production environments unless you turn analytics off or browser Do Not Track is enabled. Advertising storage and personalization remain disabled.

You can open Manage analytics preferences on this Privacy Policy page to turn analytics off or back on. No analytics preference prompt appears automatically. Browser Do Not Track also keeps analytics off. Turning analytics off does not limit product features.

7. Data Retention

We retain information for as long as needed to:

• Provide and improve services.
• Maintain business and security records.
• Meet legal, tax, accounting, and compliance obligations.
• Resolve disputes and enforce agreements.

Retention duration varies by data type and workflow. Deleted or changed data may persist for limited periods in logs, backups, or legal records.

For the Google Calendar connected app, connection metadata and encrypted credentials are retained while the connection remains locally usable. Disconnect makes the connection unusable in SparkLaunch immediately and queues provider revocation; Google revocation may require retry or manual intervention. Minimal Calendar operation records are retained for no more than 30 days for duplicate prevention, recovery, and security and do not contain event text, attendee email, raw idempotency keys, or provider response bodies. A CRM meeting activity may remain with the related CRM record under the retention and deletion rules for CRM data. Events and invitation copies already created in Google Calendar or delivered to an attendee are controlled by those recipients and providers.

The Google Calendar disclosure describes the repository's pre-general-availability product boundary. Final product, security, privacy/legal, Google, and mobile-store review remains pending before general availability; this policy does not itself represent any external approval.

8. Security

We use administrative, technical, and organizational measures designed to protect data (for example access controls, encryption in transit, and audit/event logging in key workflows). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Data Transfers

Your information may be processed in jurisdictions outside your home country, including where our service providers operate. We use reasonable contractual and operational safeguards appropriate for those transfers.

10. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal information. You can also request information about how your data is processed.

To make a privacy request, contact us at support@sparklaun.ch.

11. Children

SparkLaunch is not intended for children under 18. We do not knowingly collect personal information from children under 18.

12. Changes To This Policy

We may update this Privacy Policy from time to time. We will post updates here with a revised "Last updated" date.

13. Contact

For privacy questions or requests:

• support@sparklaun.ch