Privacy Policy for App

Date: February 20, 2025

---

Intro

Spark Mail Limited (“we” or “us”) welcomes you. We provide you with access to our desktop and mobile versions of the application “Spark Mail” (“App” or “Spark”), subject to the terms and conditions of our Terms of Service.

This Privacy Policy describes what personal data the App collects, how it processes it, and what happens when you interact with the App. We understand you care about your privacy, and we appreciate the trust you place in us. To justify that trust, we embed the latest data security standards, improve our awareness of privacy matters, and comply with the General Data Protection Regulation and other privacy laws.

When you use our application for Mac, iOS, Android, and Windows, your personal data is processed in accordance with this Privacy Policy. When you use our website (“Website”), your personal data is processed in accordance with the Privacy Policy for the Spark Website.

If you have any questions or comments about this Privacy Policy or the App, please visit our Support page or contact us.

Table of Contents

• Intro
• Table of Contents
• About Us
• About You
• Sources of Data
• Lawful Bases for Processing
• Personal Data in Spark
  • Information About You
  • Technical Data
  • Data Related to the Beta Offerings
  • Payments Data
  • Email Communications and Calendar Management
  • Spark AI Features
    • General
    • My Writing Style
    • Meeting Notes
  • Team Data
  • Customer Support Requests
  • Feedback Data
• Data Retention
  • User Account
  • Emails and Other Data
  • Teams
  • Backups
• Data Received from Third Parties
• Data Sharing with Third Parties
• Data Sharing Outside the European Economic Area
• Security Measures
• Data Subjects Rights
  • European Economic Area and United Kingdom Residents
  • United States Residents
    • Do Not Sell My Personal Information
    • Do-Not-Track Requests
  • Canada Residents
• Privacy Policy Updates

About Us

Controller

We are the controller of your personal data processed in connection with the App. This means that we determine the purposes and means of personal data processing when you use the App.

Processor

We can act as a data processor for legal entities under applicable privacy laws, meaning we may process data a customer entrusts us with on their behalf. If this is the case, please refer also to our Data Processing Agreement (DPA).

About You

When you access the App, you become our user (“User”), and we collect and process some of your personal data. You may use the App individually or collaborate with other users in a team created in Spark (“Team”).

Please note that we do not knowingly process the personal data of Users under the age of 16. If you are such a User or you are a legal representative of such a User, please contact us.

Sources of Data

We collect data directly from you or automatically when you access or use the App. We may generate some data concerning you, for example, a user ID. We may also receive data from third parties, depending on your settings and the features you use, but we don't necessarily do so.

Lawful Bases for Processing

To process your personal data, we rely on one of the following lawful bases:

• performance of the contract — for the processing of personal data necessary for the negotiation, conclusion, and performance of a contract (mainly, Terms of Service) with you;
• legal obligation — for the processing of data as required by applicable laws (for example, to comply with tax or KYC/AML regulations) or if requested by a law enforcement agency, court, supervisory authority, or another state-authorized public body;
• legitimate interest — for the processing necessary for the development of our Service and security, taking into consideration your interests, rights, and expectations;
• consent — for additional processing for specific purposes.

Personal Data in Spark

We collect your personal data when you access or use the App. The specific information collected depends on your interactions with Spark, your subscription type, and the features you utilize. Find more detailed information on what data we process and for what reasons below. The data retention rules are described in a separate section below.

Information About You

To use the App, you have to connect at least one email account to Spark. Spark does not create a new email address for you but helps manage your existing email inboxes. Your login credentials are stored as a token, and we cannot retrieve or access them.

We create your Spark account under the email address you use for the first login. Further, you may add other email addresses to Spark.

We may also ask for some information about you to help tailor the App for you.

Technical Data

When you use Spark, we collect or generate certain technical data automatically.

Data Related to the Beta Offerings

We collect additional data listed below during your beta trial programs.

Payments Data

We collect additional data for smooth payment processing. We are legally obligated to retain a record of payments. This information is stored in accordance with legal mandates and cannot be deleted until the expiration of the statutory retention period.

Email Communications and Calendar Management

Once you connect an email account, your email communications, email contacts, and linked calendar data will appear in the App. This data is mainly processed on your device. The data may also be processed in Spark systems if necessary for a feature to function. For example, if you use such features as shared emails, shared drafts, emails to send later, etc., we will process your data on our servers. Please refer to the Data Retention section for more details on the data storage. Please refer to the Data Retention section for more details on the data storage.

Spark AI Features

General

For AI features, Spark leverages AI models that operate locally on your device and/or provided by third-party AI providers such as Azure OpenAI Service by Microsoft Corporation, OpenAI by OpenAI LLC, Claude by Anthropic, and Vertex AI by Google. For seamless service delivery, we may manually switch between these AI providers. Please note that data processing rules and interaction protocols will remain consistent even if we switch between the AI providers.

We do not use your data to train any AI model. AI providers may only retain your inputs for up to thirty (30) days as part of their abuse and misuse monitoring. After this period, they delete the inputs automatically unless a longer retention period is required by law.

The data below may be processed within Spark AI features, depending on the specific feature and your request. We may also describe certain AI features in more detail further in this section to ensure more transparency and control for you over the data.

While the data below may be processed by Spark, it does not mean we store all of it. We only store data when it is necessary for the proper functioning of a feature. For example, we save meeting notes and summaries so they remain available to you. Please refer to the Data Retention section for more details on the data storage.

My Writing Style

This feature is based on profiling, i.e. automated processing of personal data to assess specific aspects of a person. In this case, profiling does not result in any legal implications for you, nor does it significantly impact you in a similar manner.

When you turn on the feature, we automatically select several of your recently sent emails that meet the length and other criteria (‘samples’) and pass such samples to the AI provider to get the description of your writing style. The AI provider will not have access to your other emails.

Subsequently, the description of your style will be sent to the AI provider along with each request and applied to all new Spark +AI-generated email drafts.

The samples are stored in your account as the feature's settings. You can review the samples in the ‘Settings’ and manually replace them with other examples if you wish. We also store the samples and your writing style description in our backend.

Meeting Notes

This feature provides AI-powered audio transcription and summarization, allowing you to generate, edit, copy, and share meeting transcripts and summaries via a link.

After you turn on this feature, please ensure that you always inform the meeting participants that you are making a meeting transcription via Spark.

The feature captures an audio stream on your device with the help of the on-device AI model. Once the meeting ends or you finish the transcription, the audio stream is automatically sent to the third-party AI provider to obtain a transcription, which is further summarized. The transcription and summary are saved in your Spark account.

Spark does not store the audio stream of the conversation, unless you choose to share one with us for troubleshooting. The AI provider may retain the audio stream for up to thirty (30) days for abuse and misuse monitoring.

Team Data

You may create Teams in Spark to effectively collaborate with other Users.

Customer Support Requests

When you address your support request, we collect some information to help you.

To enhance your experience, we may offer the option of using AI-powered assistance from a trusted provider. In this case, you can get quick, automated responses to your inquiries. No data will be used for training. Still, you can always choose to continue the chat without AI if you prefer so.

We may also collect analytics on request categories to improve our services and responses.

To process and analyse your requests more efficiently, we may engage trusted AI providers. Before proceeding with these providers, we always take necessary technical and organizational precautions, including pseudonymisation, data minimization, conducting data protection impact assessments, and establishing data processing agreements. No data is used for training.

Feedback Data

Where we have your email, we may contact you to request your feedback. Your insights are invaluable to us in enhancing the App and improving user experience.

When you submit your feedback about the App to us directly or via third-party platforms, we process personal data in your feedback, which may include the data listed below.

We may collect analytics on the categories of issues mentioned in the feedback to improve our services. We may retain AI providers to define the category of your feedback more efficiently. The feedback is pseudonymised before such processing. No data will be used for training.

Data Retention

We do not store all the data we receive from you. Mostly, the data is processed locally on your device.

These retention periods have been determined according to the data minimization principle outlined in the GDPR, as well as other applicable data protection laws. We have carefully analyzed each stage of data processing to identify the shortest retention periods necessary to fulfill the purposes for which personal data is processed.

Once the retention period ends, your data will be deleted. It may also be anonymised for statistical and analytical purposes, so we cannot identify you further on and relate to you specific data.

User Account

Your account is maintained and stored until you delete it.

Also, after thirty-six (36) months of inactivity on a free plan, we may delete your account and related data ourselves. Before such deletion, we will send two (2) reminder emails notifying that your account may be suspended unless you log in. You will be designated a renewal period to log in. If you do not log in within that time, the account will be deleted. If you log in, the next period of inactivity will be calculated since your last login.

Emails and Other Data

Below we list the terms of storage for your data processed via Spark systems.

If the data category is not listed herein, it is stored locally on your device. We may process such data with the help of Spark systems only in transit, but we do not store such data.

Additionally, where we process data based on consent or legitimate interest, you may always withdraw your consent or object to the relevant processing by contacting us. You may also object to email communications via the Unsubscribe button in the relevant email.

Teams

Only the owner of the Team may delete it. With the Team deletion, all team data, including comments, shared drafts, etc., will be deleted as well.

Backups

We regularly back up our databases to help ensure data integrity and availability. Backups are performed at least once per day and are typically retained for one (1) week. 

We use the Google Cloud SQL service for backup purposes. For more information, please refer to Google’s official documentation.

Data Received from Third Parties

We may receive some personal data from third parties. The amount of data collected, the purposes, and the lawful bases for processing are determined by the respective privacy documents of these parties.

Additionally, Spark integrates with popular third-party services: Notion, Asana, etc. We may receive some data within such integrations.

Data Sharing with Third Parties

We may share your personal data with third parties without causing you any harm and in strict compliance with applicable laws. Additionally, we have put in place organizational and technical measures to secure your personal data during its transfer to third parties.

To share your data, we rely on the lawful bases such as consent, compliance with the law, and performance of a contract, depending on the specific circumstances.

Data Sharing Outside the European Economic Area

The personal data we collect is stored on the US servers, which participate in the Data Privacy Framework, and European Economic Area (“EEA”) servers, which fall under the General Data Protection Regulation.

We may share personal data with recipients in the USA and other countries, including non-EEA ones, ensuring that your data is protected and processed according to the General Data Protection Regulation.

To share the data outside the EEA, we rely on the adequacy decision by the European Commission or the Data Privacy Framework participation of the recipient. If the recipient does not participate in the Data Privacy Framework and its country is not deemed to provide an adequate level of protection for your personal data, we adopt Standard Contractual Clauses based on legislation assessments for data protection during transfer and storage.

You can read more detailed measures to protect your personal data in the Security Measures section.

Security Measures

To protect your personal data, we employ HTTPS and encryption, establish segmented group and individual access (as necessary), utilize an alarm system, implement a corporate VPN, and adhere to formally approved internal policies, including those for password management and physical access. We also routinely conduct Data Protection Impact Assessments to guarantee the implementation of adequate technical and organizational measures.

Furthermore, we consistently monitor the state of the art of our technologies and diligently maintain backups. Additionally, all our contractors are bound by contractual obligations that comply with the GDPR and other privacy legislation requirements.

Data Subjects Rights

As a data subject, you have the right to access, manage, and control your data directly or by submitting a request to us. This section outlines these rights and explains how you can exercise them based on your place of residence.

European Economic Area and United Kingdom Residents

United States Residents

Your rights may vary depending on the state of your residency, as indicated below.

To exercise your rights, contact us.

We will answer your request within thirty (30) to (60) days, depending on the state and legislative requirements. If your request is not satisfied, you can submit a complaint with the Federal Trade Commission.

Please note: Some states do not have privacy laws. The rights of residents of such states are governed by U.S. federal law. If your state is not on the list, please contact us.

Do Not Sell My Personal Information

Under the California Consumer Privacy Act (CCPA), California residents possess the right to opt out of the “sale” of their personal information by entities governed by the CCPA.

We do not sell your personal information to anyone, and we do not use your data as a business model. Ensuring your privacy is our top priority.

We adhere to the CCPA by providing California residents the option to opt out of any potential future sale of their personal information. If you wish to register your preference that we do not sell your data in the future, please contact us at dpo@sparkmailapp.com.

Do-Not-Track Requests

California residents using our App have the option to request that we do not automatically collect and track information related to their online browsing activities across the Internet.

These requests can usually be made via web browser settings that manage signals or other mechanisms, enabling consumers to express their preferences concerning collecting personal data about their online activities over time and across third-party websites or online services.

We currently do not have the ability to honor these requests. However, we may update this Privacy Policy as our capabilities evolve.

Canada Residents

To exercise your rights, contact us. We will answer your request within 30 days. If your inquiry is not satisfied, you can submit a complaint to the Office of the Privacy Commissioner of Canada.

Privacy Policy Updates

The Privacy Policy and the relationships falling under its effect are regulated by the General Data Protection Regulation. Please note that laws and requirements for processing personal data can evolve. In the event of changes, we will release an updated version of the Privacy Policy to reflect these modifications.

If we make substantial changes to the Privacy Policy or the App that affect your data privacy rights, we will notify you by email or display information on the website or in the App and ask you to read it. If you continue to use the App after these changes take effect, you will be considered to have consented to and accepted the revised Privacy Policy.