Privacy Policy

Cookies and analytics

We use strictly necessary browser storage to remember your consent choice (cookie-consent-v1, including a timestamp and version). We ask you to renew your choice after 12 months.

With your consent only, Google Analytics 4, provided by Google Ireland Ltd, uses _ga and _ga_<ID> cookies for up to 2 years to measure visits in aggregate. IP addresses are anonymised. We do not use analytics for advertising, and advertising storage, user data and personalisation remain denied. No Google Analytics script or analytics cookies are loaded before you opt in; if analytics is not configured, none are loaded at all.

You can change or withdraw your consent at any time using Cookie settings in the footer. Withdrawal stops analytics tracking and deletes _ga cookies from this website. Consent is the legal basis for this optional analytics processing under EU GDPR and ePrivacy rules, including in Malta. Google may process data outside the EEA under the international-transfer safeguards described below.

1. Data we collect

We collect the following categories of data, depending on how you use SPARK:

• Account data: name, work email address, organisation name, role and password hash, plus optional two-factor authentication secrets.
• Billing data: plan, billing unit (site or client), device packs, invoices and payment status. Card details are entered on Stripe's hosted checkout and are never stored by us; we hold Stripe's customer and subscription identifiers.
• Customer content: the clients, sites, devices, diagrams, documentation notes, tickets, time entries, maintenance reports and vault entries that your organisation creates in the platform. Vault secrets and integration credentials are encrypted with AES-256-GCM before they are stored.
• Collector telemetry: device inventory observed on the networks a collector is enrolled to, including IP and MAC addresses, hostnames, vendor and model, link and port data, interface and performance readings, and online/offline state. The collector is read-only on the network by default and reports outbound only; it only changes a device (reboot, port enable/disable, PoE cycle) when an authorised user asks it to and the site allows it.
• Device credentials: SNMP communities, SSH and API logins that you choose to store in the credentials vault for discovery, backups and device actions. They are encrypted before storage and are only decrypted server-side or sealed to the specific collector that needs them.
• Sign-in provider data: if you sign in with Microsoft, Apple or your organisation's single sign-on, we receive your name, email address and the provider's identifier for your account. We do not receive your provider password and request no access to your mailbox, files or contacts.
• Notification data: if you turn on push notifications, the push subscription address of that browser, or the Apple (APNs) or Google (FCM) device token of that phone, linked to your account so alerts reach that device. Turning notifications off, signing out or deleting your account removes it.
• Integration data: device and status information returned by cloud controllers you connect, such as Cisco Meraki or Ubiquiti UniFi, retrieved with the credentials you provide.
• Support and contact data: the contents of contact forms, support emails and the website assistant conversations you choose to send us.
• Technical data: IP address, browser type, device type and the pages requested, recorded in standard server and security logs.

2. How we use it

• To provide the service: authenticate you, run discovery and topology, store documentation, deliver alerts and process device actions you request.
• To bill you: manage subscriptions, device packs and AI credit through Stripe, and send invoices and renewal notices.
• To support you: answer contact-form and support enquiries, and diagnose problems you report.
• To keep the platform secure: detect abuse, rate-limit sign-in attempts, audit administrative actions and investigate incidents.
• To improve the product: understand which features are used, in aggregate. We do not run advertising or behavioural analytics trackers on the website.
• To meet legal obligations, including accounting and tax record keeping.

Our legal bases under UK and EU data protection law are performance of a contract with you, our legitimate interests in running and securing the service, compliance with legal obligations and, for optional marketing emails, your consent, which you can withdraw at any time.

3. AI features

The website assistant and Nova, the in-app assistant, send the text of your question together with the platform data needed to answer it to an AI model provider through our AI gateway. Prompts are used to generate the response and are not used by us to train models. Nova connector keys let a third-party assistant you already use query your organisation's data through our MCP server; every call is made as the key owner and logged.

4. Who we share data with

We share personal data only with the service providers we need to run SPARK, each under a contract that restricts them to processing on our instructions:

• Supabase: database, authentication, file storage and edge functions that host the platform.
• DigitalOcean: hosting for the website and the application front end.
• Stripe: payment processing and hosted checkout.
• Resend: transactional email such as sign-in links, portal invitations and renewal notices.
• Apple Push Notification service and Google Firebase Cloud Messaging: delivery of push notifications to the iOS and Android apps, and the browser vendor's push service for web notifications. They receive the device token and the notification text (an alert title and short summary).
• Microsoft, Apple or your organisation's identity provider, when you choose to sign in with them.
• AI model providers, accessed through our AI gateway, for the website assistant and Nova.
• Brandfetch: vendor and partner logos shown in the app and on the website's integrations section, requested by vendor domain name only.
• Google Fonts: web fonts served from Google's servers, which receive your IP address when a page loads.
• Cloud controllers you connect (for example Cisco Meraki or Ubiquiti UniFi): we call their APIs with the credentials you provide, on your behalf.

We may also disclose data where the law requires it, to protect the rights and safety of our users, or as part of a merger or acquisition, in which case this policy continues to apply. We do not sell personal data.

5. Where data is stored

Platform data is hosted by Supabase in the European Union. Some of the providers above process data outside the UK and the European Economic Area. Where they do, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with the provider's security commitments.

6. How long we keep data

• Account and customer content: for as long as your organisation's account is active. When an account is deleted, personal data is removed within 30 days and purged from backups within 90 days.
• Billing records: for the period required by tax and accounting law, typically six years.
• Security and audit logs: up to 12 months, unless needed longer for an investigation.
• Contact-form and support correspondence: up to 24 months after the enquiry is closed.

7. Security

• Encryption in transit everywhere, and encryption at rest for the database and backups.
• Vault secrets and integration credentials are encrypted with AES-256-GCM using per-organisation keys and are only ever decrypted server-side.
• Row-level security separates every organisation's data in the database.
• The collector enrols with a one-time site code and communicates over a signed, outbound-only channel; it needs no inbound firewall rules.
• Two-factor authentication is available to every user, and administrative actions are written to an audit log.

8. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data, most of which you can edit directly in your account.
• Delete your account and personal data, subject to legal retention requirements. You can do this yourself at any time in Settings → Account → Delete account, in the apps or on the website, or at www.sparkdock.io/account/delete. Records you created for your organisation (tickets, time entries, reports) stay with that organisation without your name.
• Receive your data in a portable format; customer content can be exported from the platform.
• Object to, or ask us to restrict, certain processing, and withdraw consent where processing is based on it.
• Complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email privacy@sparkdock.io. We will respond within one month. If you are an end user of one of our customers, we may refer your request to that customer, who controls the data.

9. Mobile apps

The SPARK apps for iOS and Android show the same platform as the website and handle the same data described above. They ask for one device permission, notifications, and only when you turn notifications on. They do not access your location, contacts, photos, camera or microphone, contain no advertising and do not track you across other companies' apps or websites. Data is encrypted in transit with standard HTTPS/TLS.

10. Children

SPARK is a business service and is not directed at children under 16. We do not knowingly collect their data.

11. Changes to this policy

We will post any changes on this page and update the date at the top. For material changes we will also notify account holders by email or in the app before they take effect.

12. Contact

YOT LTD, United Kingdom, is the controller for the data described in this policy. Registered office and company number are available on request and are shown on our invoices.

Questions about this document can be sent to support@sparkdock.io. For privacy matters specifically, use privacy@sparkdock.io.