Privacy Policy

We use the information we collect to:

• Provide, maintain, and improve the Service;
• Authenticate you and secure your account;
• Synchronize your workspace data across devices;
• Provide AI-assisted chat features (see Section 5);
• Diagnose and fix bugs, crashes, and performance issues;
• Communicate with you about service updates, security alerts, and support requests;
• Comply with legal obligations and enforce our terms.

We share information only as described below:

• With your organization. Data you enter into a workspace is visible to other authorized members of that workspace.
• With service providers. We use trusted third parties to host infrastructure, deliver push notifications, monitor errors, and process AI requests. These providers may only use your data to perform services for us.
• For legal reasons. We may disclose information if required by law, subpoena, or to protect the rights, property, or safety of our users or others.
• In a business transfer. If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

We do not sell your personal information.

When a merchant installs or connects Spark Inventory through Shopify, we receive the merchant's shop domain and shop profile information, including shop name, account email, owner name, country, time zone, and currency. Depending on the features the merchant enables, we also receive product and variant information, SKUs, barcodes, prices, images, metafields, costs, locations, inventory quantities, customer names and contact information, order details, shipping addresses, fulfillment information, and refund or cancellation information.

We use Shopify data only to provision and secure the merchant's Spark account; import and synchronize products, inventory, customers, and orders; manage inventory and fulfillment workflows; provide support; and comply with legal and privacy obligations. We do not sell Shopify protected customer data, share it with advertising providers, or use it for unrelated marketing.

For Shopify merchant and customer data processed on a merchant's behalf, Spark Inventory acts as a service provider or data processor. Spark Inventory may act as a data controller for information used to administer Spark accounts, provide support, secure the service, meet legal obligations, and maintain compliance records.

The App includes an AI chat assistant. When you interact with it, your messages and relevant workspace context are sent to our AI processing provider to generate a response. We do not use your data to train third-party foundation models. You can avoid using AI features by not opening the chat tab.

Spark Inventory offers an optional integration with your Gmail account so you can send replies to suppliers and customers directly from the address they know you by. This section describes how we handle data accessed via Google's APIs.

What we access. When you choose to connect a Gmail account in Spark Inventory, we request a single Google OAuth scope: gmail.send (described to you on Google's consent screen as "Send email on your behalf"). This is the narrowest Gmail scope that permits sending.

What we do not access. With this scope, we cannot read, search, modify, label, archive, delete, or otherwise interact with any messages in your Gmail mailbox. We do not have access to your inbox, contacts, drafts, or any other Gmail data.

How we use it. We send a message via Gmail only when you explicitly click "Send" on a reply or follow-up you have composed inside Spark Inventory. We do not send autonomous, bulk, or marketing email through this integration.

How we store the data. Spark Inventory stores an encrypted OAuth refresh token tied to your Spark Inventory account so the integration continues to work without re-authentication. Outgoing messages and the events that triggered them are recorded in our internal logs for diagnostic and audit purposes.

Third parties. Outgoing messages are transmitted only between Spark Inventory's servers and Google's Gmail API. No other third party receives data obtained via Google's APIs.

How to revoke access. You can disconnect your Gmail account at any time from Spark Inventory's Email accounts page (Profile → Email accounts). You can also revoke Spark Inventory's access directly from your Google Account at myaccount.google.com/permissions. Disconnection deletes the stored refresh token within 30 days.

Limited Use compliance. Spark Inventory's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer, use, or store Google user data for serving advertisements, and we do not allow humans to read Google user data except (a) with your explicit consent, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for limited internal operations where the data has been aggregated and anonymized.

This section describes how we collect, use, and protect the information you provide when you opt in to receive SMS text messages from Spark Inventory.

We retain your account and workspace data for as long as your account is active. If you or your organization delete your account, we delete associated data within 30 days, except where we are required to retain it for legal, tax, or audit purposes.

Shopify-sourced information is retained and deleted according to the Shopify Integration section above. Certain non-personal business records and pseudonymous compliance receipts may be retained for the periods described there.

We use industry-standard measures to protect your information, including encryption in transit (TLS) and at rest, role-based access controls, and audit logging. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

Depending on where you live, you may have rights to:

• Access the personal data we hold about you;
• Correct or update inaccurate data;
• Delete your data;
• Object to or restrict certain processing;
• Receive a copy of your data in a portable format;
• Withdraw consent (where processing is based on consent);
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at support@sparkinventory.com. We will respond within the time required by applicable law.

The Service is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact support@sparkinventory.com and we will delete it.

The Service is operated from the State of New York. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries.

We may update this Privacy Policy from time to time. We will post the new policy here and update the "Effective date" at the top. Material changes will be communicated via email or in-app notice.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

These website marketing technologies are not applied to Shopify protected customer data or data stored inside authenticated Spark Inventory workspaces.

If you have questions about this Privacy Policy or our data practices, contact us at: