Privacy Policy

Privacy Notice for Sparrowhawk Labs, Inc covering:

• Website (sparrowhawklabs.com)
• Mobile application (Sparrowhawk CRM)
• Related marketing and events

Contact: privacy@sparrowhawklabs.com (data-protection inquiries) | help@sparrowhawklabs.com (general support)

Voluntarily Provided

• Names, phone numbers, email addresses, mailing addresses
• Job titles, usernames, passwords
• Contact preferences, authentication data
• Billing addresses, debit/credit card numbers
• Sensitive information: Some of the information you submit may meet the CCPA/CPRA definition of "sensitive personal information" (for example, cannabis licence numbers, or precise geolocation collected with your permission). We process this information only as needed to deliver and operate the Services, under access controls and audit logging. We do not use sensitive personal information to infer characteristics about you, and we do not share or sell it.

Payment Data

• Handled and stored by our contracted payment providers (FluidPay / PayRio)
• We do not store payment instrument details directly

Social Media Login Data

• Optional registration via third-party social media accounts
• Profile information received from social media provider

Application Data (with user permission)

• Geolocation information
• Mobile device access (calendar, microphone, reminders, camera)
• Mobile device data (device ID, model, OS, network, IP)
• Push notification preferences

Automatically Collected

• Log and usage data (diagnostic, performance)
• Device data (identifiers, browser, hardware, ISP, OS)
• Location data (IP-based or GPS-based)
• Cookies and similar technologies (see Cookie Policy)

Google API Usage

• Adheres to Google API Services User Data Policy including Limited Use requirements

• Account creation and authentication
• Service delivery (running the CRM for the customer who submitted the data)
• User support and inquiry response
• Administrative communications
• Feedback requests
• Marketing and promotional communications (subject to preferences)
• Security and fraud prevention
• Service improvement — including the development, training, tuning, evaluation, and improvement of algorithms and AI / machine-learning models that power the Services (see "AI, analytics & aggregated insights" below)
• Generation of de-identified, aggregated insights for benchmarks, market intelligence, and product research (see "AI, analytics & aggregated insights" below)
• Legal compliance

We rely on the following legal bases when processing personal information. The exact basis depends on the type of processing and on which Data Protection Laws apply to you (today, primarily US state privacy laws).

Purpose	Legal basis
Provide and operate the Services for our customers (and their authorised users)	Performance of a contract
Customer support and account administration	Performance of a contract; legitimate interests
Security, fraud prevention, abuse detection	Legitimate interests; legal obligation
Improvement of the Services for the customer who submitted the data	Legitimate interests (proportionate; we balance this against your rights and offer opt-outs where required by law)
Generation of de-identified, aggregated insights and training of cross-customer models	Legitimate interests in operating and improving our products (the data we use for these purposes is de-identified before it leaves the per-customer service pipeline — see below)
Marketing and promotional communications	Consent (where required) or legitimate interests, with an unsubscribe mechanism
Compliance with law and legal process	Legal obligation

For US data subjects: state privacy laws (CCPA/CPRA, Colorado, Connecticut, Virginia, etc.) apply, and we treat ourselves as a "service provider" with respect to data submitted by our business customers — we do not sell that data, and we do not share it for cross-context behavioural advertising. See "US-Specific Rights" below.

For data subjects in the EEA, UK, or Switzerland: Sparrowhawk does not currently accept Personal Data subject to the GDPR or UK GDPR. If a customer in those jurisdictions onboards in the future, we will execute a separate UK/EU Addendum and Standard Contractual Clauses with that customer before any such data is submitted to the Services.

We share personal information only as follows:

• Subprocessors that we use to provide the Services (e.g. Google Cloud Platform for hosting, FluidPay/PayRio for payment processing, Postmark/SendGrid for email delivery, Sentry for error monitoring, ContentSquare for product analytics). The current list is published at https://www.sparrowhawklabs.com/legal/subprocessors.
• Business transfers (merger, acquisition, financing) — recipients are bound by privacy commitments at least as protective as this Notice.
• Google Maps Platform APIs (location caching on device).
• Google Analytics (website analytics; opt out at https://tools.google.com/dlpage/gaoptout).
• Legal disclosures — to comply with valid legal process or to protect rights, safety, or property.
• Contributory Data Partners — limited accounts-receivable/payment-performance data plus the retailer/debtor business identity, for the purpose of generating third-party credit and risk-reporting products. See "Credit & Risk Reporting Partners" below.

We do not share personal information for cross-context behavioural advertising, and we do not share identifiable customer data between our customers. We do not sell personal information for money. A limited category of payment-performance data (Contributory Data) may be disclosed to vetted Contributory Data Partners in exchange for reciprocal credit/risk reports — under CCPA/CPRA and similar laws, this may be treated as a "sale" or "sharing" of personal information, and we do not argue otherwise. See "Credit & Risk Reporting Partners" below for what's included and how to opt out.

This section explains in plain English how we use data across customers — because customers reasonably want to know.

What we do. We use your Customer Data to train, tune, evaluate, and improve the machine-learning models and analytical features that power Sparrowhawk's services. Internal training and evaluation happen under access controls and audit logging.

What we don't do. We do not sell your Customer Data. We do not show your identifiable data to other Sparrowhawk customers. We do not use your Customer Data for third-party advertising. We do not attempt to re-identify aggregated data.

External publications. When we publish benchmarks, industry insights, or share data outside Sparrowhawk for purposes other than running the service for you, we use de-identified Aggregated Data only (k-anonymity ≥5, minimum cohort of 10 customers, free-text scrubbing). Full standard at https://www.sparrowhawklabs.com/legal/deidentification-standards.

Your choice. You can opt out of being included in our publishable benchmarks and industry insights by contacting privacy@sparrowhawklabs.com. The opt-out does not apply to internal model training, service operation, security, or fraud prevention.

Where you see cross-tenant insights in the product (e.g. "your performance vs market"), those features run on aggregated data and a tooltip will indicate that the comparison is built from anonymised, aggregated data across Sparrowhawk customers.

Data-subject opt-out: If you are an individual whose data is in the Services because a Sparrowhawk customer submitted it, the Sparrowhawk customer is your privacy contact (we are their service provider). We will assist them in honouring your access, correction, deletion, portability, and opt-out requests as required by applicable law.

AI Products: The Services include features powered by AI / machine-learning models (e.g. AI insights, predictive analytics, natural-language processing). Where those features process Personal Data, the processing is governed by this Notice and the Data Processing Agreement. Where models are trained or improved using data from across our customer base, the inputs are de-identified per our standard.

What we share. A narrow slice of your data — invoice amounts, payment-aging buckets, payment timeliness, and credit-utilization metrics ("Contributory Data") — may be disclosed to vetted third-party credit-reporting or risk-scoring services ("Contributory Data Partners") so they can generate credit scores, suggested credit limits, and risk reports for the cannabis B2B ecosystem. The retailer/debtor business identity (business name, cannabis licence number, and location) is included because it is the subject of the commercial credit report. We do not include the names, emails, or phone numbers of individual people, pricing terms, deal notes, or free-text fields in this disclosure.

Why. Reciprocal value: the credit scores, limits, and reports these partners generate are made available back to you (and to Sparrowhawk, which may earn a margin reselling full reports).

Is this a sale? Under CCPA/CPRA and similar state privacy laws, a disclosure made in exchange for value can qualify as a "sale" or "sharing" of personal information even where no cash changes hands for a specific record. We treat this disclosure as potentially falling into that category and give you the opt-out rights below rather than arguing it doesn't count.

Current partners. Published at sparrowhawklabs.com/legal/data-partners — updated at least 30 days before any new partner or partner category is added.

Your choice — opt out any time. This is an opt-out, not opt-in, feature: your data is included by default, consistent with how our other non-essential analytics features work. To opt out of some or all Contributory Data Partnerships:

• Email privacy@sparrowhawklabs.com, or
• Use in-product settings, or
• Use the "Do Not Sell or Share My Personal Information" link at sparrowhawklabs.com/privacy-choices, or
• Send a recognized Global Privacy Control (GPC) browser signal — we honour GPC as an opt-out-of-sale/sharing request for this purpose.

We implement opt-outs within 15 business days. Opting out stops future disclosures; it does not force retroactive deletion from a partner's systems, though we will ask the partner to delete data already shared.

• Kept as long as necessary to fulfill stated purposes
• Longer retention only if required/permitted by law

• Appropriate technical and organizational measures implemented
• No 100% guarantee (standard disclaimer)

• Do not knowingly collect from or market to under-18s
• Will deactivate accounts and delete data if discovered

• We do not sell or share personal information for cross-context behavioural advertising.
• We may disclose a limited category of payment-performance data (Contributory Data) to Contributory Data Partners as described in "Credit & Risk Reporting Partners" above, which may be treated as a "sale" or "sharing" of personal information under CCPA/CPRA and similar laws.
• Right to opt out of sale/sharing: you can opt out of the Contributory Data Partner disclosure at any time — see "Credit & Risk Reporting Partners" above for how. We honour Global Privacy Control (GPC) signals as an opt-out-of-sale/sharing request.
• State-specific rights: know, access, correct, delete, copy, opt out, limit sensitive data use, appeal
• California Shine The Light: category + third-party disclosure on request

• No uniform standard finalized — not currently honoured

Sparrowhawk Labs, Inc 1605 NW Galveston Ave, Bend, OR 97703, United States Email: privacy@sparrowhawklabs.com (data-protection inquiries) | help@sparrowhawklabs.com (general support)