Privacy Policy

From businesses: account details (name, email, password), business details, billing information (handled by our payment processor; we do not store card numbers) and how the service is used.

About a business's customers, provided by that business: name, email address, mobile number, the consent the customer gave to be contacted, and details of the visit. From customers themselves: the rating and any feedback, name or contact details they choose to submit, and replies to our messages.

Technical data: IP address, device and browser information, and cookies needed to run the service.

To provide the service: sending review requests and reminders on a business's behalf, showing ratings and feedback to that business, honoring opt-outs, billing, support, security, preventing abuse, and improving Sparkback. We do not sell personal information.

Mobile numbers are used only to send the messages described in our SMS Terms and to record consent and opt-outs.

A business either texts its customers from its own number, registered with US carriers in its name, or has Sparkback text them from Sparkback's number on its behalf. When the business sends, it is the sender and Sparkback processes customers' mobile numbers as its service provider. When Sparkback sends, Sparkback is the sender and this policy applies to those messages. Either way we keep one business's customers separate from every other's. To register a business's own number, we give its business details (legal name, tax ID, address, website and contact) to our messaging provider and the carrier registry; those details are about the business, not its customers.

No mobile information will be sold or shared with third parties or affiliates for promotional or marketing purposes. Text messaging originator opt-in data and consent will not be sold or shared with any third parties.

We share information only with providers that help us run Sparkback, under contracts that limit their use of it: hosting and database (Vercel, Supabase), email delivery (Resend), text message delivery (Sent.dm and its carrier partners), payments (Stripe) and product analytics (PostHog). We may also disclose information when the law requires it, or to protect the rights and safety of our users and others. All of the above excludes text messaging originator opt-in data and consent: that information will not be sold or shared with any third parties.

Sparkback uses the Google Maps Platform Places API to look up a business's public Google rating and review count (for our free review audit and for review tracking). We send Google only the business's name or Google Place ID, never customer information, and we store only Google's Place ID. Use of these features is also subject to Google's Privacy Policy and the Google Maps Platform Terms of Service.

We keep information while a business's account is active and as needed to provide the service. When an account is closed we delete or anonymise its data within 90 days, except records we must keep for legal, tax or dispute purposes. Opt-out records are kept so we can keep honoring them.

Data is encrypted in transit and at rest, access is limited to people who need it, and each business can see only its own data. No system is perfectly secure, so we cannot guarantee absolute security.

You can opt out of texts by replying STOP and of emails with the unsubscribe link. You can ask us to access, correct or delete your personal information by emailing us; if a business uploaded your details, we may pass your request to that business. Depending on where you live (for example California), you may have additional rights, which we will honor.

Sparkback is not directed to children under 13, and we do not knowingly collect their information.

We may update this policy. We will change the date above and, for significant changes, notify businesses by email or in the app.

Spark N Code, Libertyville, Illinois, USA. support@sparkback.app