SparkLaunch Privacy Policy

Last updated: August 16, 2026

This Privacy Policy explains how SparkLaunch ("SparkLaunch", "we", "us", "our") collects, uses, stores, and shares information when you use our websites, applications, and services.

By using SparkLaunch, you agree to this Privacy Policy.

1. Scope

This Policy applies to SparkLaunch services, including product workflows that support startup formation, operations, and fundraising readiness (for example: idea analysis, planning, branding, landing pages, CRM, document vault, cap table, pitch decks, and incorporation workflows). It also applies when you connect an authorized AI Agent or other compatible client to SparkLaunch through the Model Context Protocol (MCP).

2. Information We Collect

We collect information you provide directly, information created through product usage, and limited technical data.

A. Account and profile data

• Name, email, profile image, sign-in provider details (for example Google OAuth or password login).
• Account security and session information (for example login timestamps, password reset records, auth tokens stored in browser local storage).
• Optional profile data such as preferred name, company name, phone, address, and tax identifier fields where you provide them.

B. Project and workflow data

• Startup ideas, descriptions, business planning inputs, generated outputs, and related workspace artifacts.
• Team, cap table, CRM, and GTM workflow data.
• Pitch deck content, presentation settings, and related analytics events.

C. Legal, compliance, and formation data

• Entity formation intake information, founder records, and consent records.
• Identity verification and KYC workflow data (including participant name, email, date of birth, verification status, and related webhook event records).
• EIN workflow information and SS-4 preparation data.
• 83(b) election workflow information and related proof artifacts.
• Some formation intake data is stored encrypted at rest in application storage.

D. Documents and vault activity

• Files uploaded to company library and investor vault features, plus metadata (for example filename, size, type, checksum, upload status).
• Share link settings (token hashes, optional password hashes, expiry and usage data).
• Vault audit activity, which may include actor identity, action type, and in some cases IP address and user-agent.

E. Payments and subscription data

• Payment and subscription status and metadata from our payment processor (Stripe), including Stripe customer/subscription/session IDs and transaction status.
• We do not store full raw payment card numbers in our application database.

F. Leads, analytics, and attribution data

• Landing page and GoLinks lead capture data (email, optional name, consent flags/text/time/source, UTM/referrer metadata).
• Product analytics and attribution fields (for example session IDs, anonymous IDs, URLs, referrers, event metadata).
• Only after you explicitly allow production web analytics, Google Analytics receives sanitized page paths, referrers, device/browser context, and non-PII event metadata. SparkLaunch disables advertising storage, advertising user data, advertising personalization, and Google signals in this integration.
• Traffic data including path, URL, host, user-agent, and IP-derived data:
  • Some analytics flows store hashed IP values.
  • Some endpoints and audit contexts may store raw IP address values.

G. Communications and support data

• Support messages and operational context sent through service tools (for example email and Slack alerting workflows).

H. AI Agent and MCP connected-app data

When you choose to connect an AI Agent or other compatible MCP client to SparkLaunch, we process:

• OAuth client registration metadata, approved redirect addresses, the scopes you grant, your SparkLaunch account and selected project identifiers, and security metadata needed to issue, rotate, expire, and revoke the connection. SparkLaunch stores one-way hashes rather than reusable plaintext authorization codes or refresh tokens.
• The SparkLaunch tool name and the bounded, structured arguments or files you choose to send through the connected client, plus the minimum result, error, idempotency, and confirmation data needed to perform and reconcile the request. SparkLaunch does not receive your full AI Agent conversation or session unless you or the client include that content in a tool argument.
• Project and workflow records created or updated by an approved tool, including CRM personal data when you explicitly use a CRM tool. Results returned to the connected client are limited to the fields defined for that tool.
• Business-card images you explicitly submit are retrieved only from an approved HTTPS file host, limited to supported image types and 10 MB, analyzed, and stored with the related CRM record. Generated logo and QR artifacts may be stored with your project and returned through an expiring HTTPS download link that is valid for no more than one hour.

ChatGPT and OpenAI process the information you provide to ChatGPT under their own terms and privacy policies. SparkLaunch controls only the data processing performed by SparkLaunch and its service providers.

I. Google Calendar connected-app data

When the Google Calendar connected app is available and you choose to connect it, we process:

• The verified Google account email, Google subject identifier, granted scopes, connection status, and connection and revocation timestamps.
• OAuth credentials needed to operate and revoke the connection. These credentials are encrypted and kept on SparkLaunch servers; they are not returned to the web or mobile app.
• Meeting information you explicitly submit from an eligible CRM contact, including title, start/end time, time zone, the server-derived contact attendee email, and any optional description or location. These fields are transmitted to Google Calendar to create the requested event and invitation; SparkLaunch does not retain a provider-event payload copy.
• Minimal opaque identifiers, hashes, outcome state, timestamps, and retry/recovery metadata needed to prevent duplicate invitations and recover an uncertain request. The related CRM activity retains the meeting title and start time as part of your CRM history.

This first workflow does not list calendars or events, read or import existing calendar content, search availability, select another calendar, create recurrence or conferencing, update or delete events, or synchronize Google Calendar data.

3. How We Use Information

We use collected information to:

• Provide, operate, and secure SparkLaunch services.
• Power end-to-end workflows from idea development to funding readiness.
• Personalize your experience and maintain your workspace state.
• Run analytics, monitor performance, prevent abuse, and troubleshoot incidents.
• Process payments and manage subscriptions.
• Communicate with you about account, product, support, and operational matters.
• Comply with legal obligations and enforce our agreements.

Google Calendar data

We use data obtained through the Google Calendar connected app only to provide and secure the connection, verify the selected organizer, create the meeting you request, notify its attendee, recover an uncertain exact-event request, and operate disconnect, revocation, security, and support controls. We do not use Google user data for advertising, sale, cross-app tracking, unrelated personalization, or training general-purpose AI or machine-learning models.

AI Agent and MCP data

We use MCP connection metadata and tool requests to authenticate the connected client, enforce the scopes and project you selected, perform only the requested SparkLaunch workflow, prevent duplicate writes, require confirmation for risky actions, return a bounded result, investigate abuse, and support revocation and recovery. OAuth credentials and security artifacts are not used for advertising or product-model training. Project and workflow data created through MCP is otherwise handled under the same purposes and choices as equivalent data created directly in SparkLaunch.

Product improvement and data moat

A core part of SparkLaunch is improving the quality and conversion strength of the idea-to-funding chain. We use collected workflow, usage, and outcome data to improve internal concepts, models, scoring systems, recommendations, prompts, routing logic, and automation quality. Where practical, we use aggregated or de-identified data; in other cases, we may use identifiable data when needed to operate and improve product performance and reliability.

The Google user data described above is excluded from these general product-improvement and model-training uses. Any use or transfer of information received from Google APIs must also comply with the Google API Services User Data Policy, including its Limited Use requirements where applicable.

4. Legal Bases (Where Applicable)

Depending on your location, we process data under one or more legal bases:

• Performance of a contract (providing the service you requested).
• Legitimate interests (service improvement, analytics, fraud prevention, platform security).
• Consent (for specific processing where required).
• Legal obligations.

5. How We Share Information

We may share information:

• With service providers and infrastructure partners that process data on our behalf (for example cloud hosting, identity/auth, AI processing, payments, messaging, and monitoring tools).
• With integrated providers you invoke through product workflows (for example Stripe, OpenAI, Google services, Veriff, AWS, email/SMTP providers, and operational alerting tools).
• With the AI Agent or MCP client you connect, by returning the requested tool result and any expiring file reference to that client. The client sends the tool inputs you approve to SparkLaunch and may retain them under its own terms and settings.
• When you explicitly create a Google Calendar meeting, with Google Calendar to create the event and with the contact you invite through the resulting guest notification and attendee calendar copy.
• With collaborators, invitees, and recipients of share links you create.
• With legal/regulatory authorities when required by law, legal process, or to protect rights and safety.
• As part of a merger, financing, acquisition, or similar corporate transaction.

We do not sell personal information for money. We do not sell Google user data or transfer it for advertising.

6. Cookies, Local Storage, and Similar Technologies

SparkLaunch uses browser storage and related technologies, including:

• Local storage for authentication/session state.
• Session storage for temporary workflow context and analytics session identifiers.
• First-party traffic measurement using sanitized page paths and temporary session identifiers.
• Google Analytics browser storage in enabled production environments unless you turn analytics off or browser Do Not Track is enabled. Advertising storage and personalization remain disabled.

You can open Manage analytics preferences on this Privacy Policy page to turn analytics off or back on. No analytics preference prompt appears automatically. Browser Do Not Track also keeps analytics off. Turning analytics off does not limit product features.

7. Data Retention

We retain information for as long as needed to:

• Provide and improve services.
• Maintain business and security records.
• Meet legal, tax, accounting, and compliance obligations.
• Resolve disputes and enforce agreements.

Retention duration varies by data type and workflow. Deleted or changed data may persist for limited periods in logs, backups, or legal records.

For AI Agent and MCP connections, authorization requests and codes become unusable within minutes, access tokens within no more than one hour, and grants and refresh tokens within no more than 90 days unless revoked sooner. Disconnecting or revoking the connection makes its grant and refresh-token family unusable immediately. Hashed security records and minimal operational logs may remain for fraud prevention, audit, backup, and legal purposes under our general retention rules. Project records, CRM records, submitted business-card images, and generated artifacts remain under the same workspace retention and deletion rules as data created directly in SparkLaunch; disconnecting the AI Agent does not by itself delete those records. Expiring download links do not extend access after their stated expiration.

For the Google Calendar connected app, connection metadata and encrypted credentials are retained while the connection remains locally usable. Disconnect makes the connection unusable in SparkLaunch immediately and queues provider revocation; Google revocation may require retry or manual intervention. Minimal Calendar operation records are retained for no more than 30 days for duplicate prevention, recovery, and security and do not contain event text, attendee email, raw idempotency keys, or provider response bodies. A CRM meeting activity may remain with the related CRM record under the retention and deletion rules for CRM data. Events and invitation copies already created in Google Calendar or delivered to an attendee are controlled by those recipients and providers.

The Google Calendar disclosure describes the repository's pre-general-availability product boundary. Final product, security, privacy/legal, Google, and mobile-store review remains pending before general availability; this policy does not itself represent any external approval.

8. Security

We use administrative, technical, and organizational measures designed to protect data (for example access controls, encryption in transit, and audit/event logging in key workflows). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Data Transfers

Your information may be processed in jurisdictions outside your home country, including where our service providers operate. We use reasonable contractual and operational safeguards appropriate for those transfers.

10. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal information. You can also request information about how your data is processed.

To make a privacy request, contact us at support@sparklaun.ch.

You can disconnect or revoke an AI Agent/MCP connection without deleting your SparkLaunch account. You may separately request deletion of eligible SparkLaunch data under our Data Deletion Policy. Disconnecting does not remove copies already retained by your AI Agent, another connected client, a recipient, or another provider; use that provider's controls for those copies.

11. Children

SparkLaunch is not intended for children under 18. We do not knowingly collect personal information from children under 18.

12. Changes To This Policy

We may update this Privacy Policy from time to time. We will post updates here with a revised "Last updated" date.

13. Contact

For privacy questions or requests:

• support@sparklaun.ch