How WizeWorks handles personal information across the sparx platform. Both the data we collect about our own customers and the data we process on their behalf.
sparx serves two kinds of people, and our role differs for each. When you sign up for sparx as a merchant or publisher, we are the data controller for your account information. When your customers interact with a store or site you run on sparx, you are the controller of their personal data and we act as your data processor: see the Data Processing Addendum. This policy covers the first relationship: plus everyone else who deals with WizeWorks directly, such as job and partner applicants, for whom we are also the controller.
From the businesses that use sparx:
From other people who deal with WizeWorks directly:
The personal data of your customers is a different matter entirely. We handle that for you rather than for ourselves, and the Data Processing Addendum governs it.
We use this information to provide and secure the Service, process payments, communicate with you about your account, provide support, assess applications, comply with legal obligations, and improve the platform. We do not sell your personal information, and we do not use it to train AI models.
We host the Service on Google Cloud and rely on a small number of other companies to operate it, for email delivery, text messages, payments, domain registration, and product analytics. Each is bound by contractual data-protection obligations. Every one of them is named, along with what it does and what data it handles, on our subprocessor list.
sparx runs no AI on an account of its own. Every AI feature works on a key you supply or an AI tool you connect yourself, so your data is never sent to an AI provider on our credential.
Data is encrypted in transit (TLS) and at rest. The platform enforces tenant isolation at the database level, personal information is excluded from application logs and masked in error reporting, and access is restricted to personnel who need it. See our security overview for more.
We keep account information for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and dispute-resolution needs. You can request deletion as described below.
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at [email protected]. We respond to verified requests within the timeframes required by applicable law.
On our own marketing site and dashboard, cookies fall into four groups, and nothing beyond the first group runs until you say yes. There is no pre-ticked box and no “by continuing to browse you agree”. If you have not made a choice, only the strictly-necessary cookies are set.
We also set first-party cookies that record how you first arrived at sparx and how you arrived most recently (which search, link, or campaign sent you) and, if you followed a partner’s referral link, a code identifying that partner for thirty days so they get credit for the introduction. These are ours alone; they are not shared with advertising networks, and they are readable only across sparx’s own domains.
You can change your mind at any time from the cookie preferences link in the footer of every page.
Sites and stores run by our customers are separate. Each of those businesses is responsible for its own cookie notice and its own consent, and sparx gives them the same four-category consent tool to do it with. On those sites we count visits for the business that owns them using a rotating, salted identifier rather than storing IP addresses: enough to tell one visit from another, not enough to build a profile of a person.
sparx runs in Google Cloud’s central United States region, and that is where your data is stored. If you or your customers are outside the United States, using sparx involves a transfer of personal data to the United States. Where the law requires it, we rely on appropriate safeguards (including the European Commission’s standard contractual clauses) to make that transfer lawful.
We do not hand over personal data because an authority asked. Every demand is checked against a written policy first: we confirm it is a genuine legal instrument that reaches us, we disclose only the narrowest set of records it actually compels, we object to requests that are unlawful or overbroad, and we record every request, including the ones we refuse. Where the data belongs to one of our customers, we tell them a request has arrived so they can object themselves, unless a court order or statute forbids us from saying so.
We will post updates to this policy here with a new version and effective date and notify you of material changes. Questions? Email [email protected].