Privacy Policy

Privacy Notice for Sparrowhawk Labs, Inc covering:

• Website (sparrowhawklabs.com)
• Mobile application (Sparrowhawk CRM)
• Related marketing and events

Contact: privacy@sparrowhawklabs.com (data-protection inquiries) | help@sparrowhawklabs.com (general support)

Voluntarily Provided

• Names, phone numbers, email addresses, mailing addresses
• Job titles, usernames, passwords
• Contact preferences, authentication data
• Billing addresses, debit/credit card numbers
• Sensitive information: Some of the information you submit may meet the CCPA/CPRA definition of "sensitive personal information" (for example, business licence numbers, or precise geolocation collected with your permission). We process this information only as needed to deliver and operate the Services, under access controls and audit logging. We do not use sensitive personal information to infer characteristics about you, and we do not share or sell it.

Payment Data

• Handled and stored by our contracted payment providers (FluidPay / PayRio)
• We do not store payment instrument details directly

Social Media Login Data

• Optional registration via third-party social media accounts
• Profile information received from social media provider

Application Data (with user permission)

• Geolocation information
• Mobile device access (calendar, microphone, reminders, camera)
• Mobile device data (device ID, model, OS, network, IP)
• Push notification preferences

Automatically Collected

• Log and usage data (diagnostic, performance)
• Device data (identifiers, browser, hardware, ISP, OS)
• Location data (IP-based or GPS-based)
• Cookies and similar technologies (see Cookie Policy)

Google API Usage

• Adheres to Google API Services User Data Policy including Limited Use requirements

• Account creation and authentication
• Service delivery (running the CRM for the customer who submitted the data)
• User support and inquiry response
• Administrative communications
• Feedback requests
• Marketing and promotional communications (subject to preferences)
• Security and fraud prevention
• Service improvement — including the development, training, tuning, evaluation, and improvement of algorithms and AI / machine-learning models that power the Services (see "AI, analytics & aggregated insights" below)
• Generation of de-identified, aggregated insights for benchmarks, market intelligence, and product research (see "AI, analytics & aggregated insights" below)
• Legal compliance

We rely on the following legal bases when processing personal information. The exact basis depends on the type of processing and on which Data Protection Laws apply to you (today, primarily US state privacy laws).

Purpose	Legal basis
Provide and operate the Services for our customers (and their authorised users)	Performance of a contract
Customer support and account administration	Performance of a contract; legitimate interests
Security, fraud prevention, abuse detection	Legitimate interests; legal obligation
Improvement of the Services for the customer who submitted the data	Legitimate interests (proportionate; we balance this against your rights and offer opt-outs where required by law)
Generation of de-identified, aggregated insights and training of cross-customer models	Legitimate interests in operating and improving our products (the data we use for these purposes is de-identified before it leaves the per-customer service pipeline — see below)
Marketing and promotional communications	Consent (where required) or legitimate interests, with an unsubscribe mechanism
Compliance with law and legal process	Legal obligation

For US data subjects: state privacy laws (CCPA/CPRA, Colorado, Connecticut, Virginia, etc.) apply, and we treat ourselves as a "service provider" with respect to data submitted by our business customers — we do not sell that data, and we do not share it for cross-context behavioural advertising. See "US-Specific Rights" below.

For data subjects in the EEA, UK, or Switzerland: Sparrowhawk does not currently accept Personal Data subject to the GDPR or UK GDPR. If a customer in those jurisdictions onboards in the future, we will execute a separate UK/EU Addendum and Standard Contractual Clauses with that customer before any such data is submitted to the Services.

We share personal information only as follows:

• Subprocessors that we use to provide the Services (e.g. Google Cloud Platform for hosting, FluidPay/PayRio for payment processing, Postmark/SendGrid for email delivery, Sentry for error monitoring, ContentSquare for product analytics). The current list is published at https://www.sparrowhawklabs.com/legal/dpa#annex-a-subprocessors.
• Business transfers (merger, acquisition, financing) — recipients are bound by privacy commitments at least as protective as this Notice.
• Google Maps Platform APIs (location caching on device).
• Google Analytics (website analytics; opt out at https://tools.google.com/dlpage/gaoptout).
• Legal disclosures — to comply with valid legal process or to protect rights, safety, or property.
• Contributory Data Partners — limited business-to-business accounts-receivable/payment-performance data plus the business identity of the debtor that owes you payment, so those partners can generate the credit and risk reports we make available back to you. This is business data, not personal information. See "Credit & Risk Reporting Partners" below.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising, and we do not share identifiable customer data between our customers. A limited category of business-to-business payment-performance data (Contributory Data) is disclosed to vetted Contributory Data Partners so they can produce the credit and risk reports we provide back to you — that data is commercial information about business entities and contains no personal information, so it is not a sale or sharing of personal information. See "Credit & Risk Reporting Partners" below for what is included and how to opt out.

This section explains in plain English how we use data across customers — because customers reasonably want to know.

What we do. We use your Customer Data to train, tune, evaluate, and improve the machine-learning models and analytical features that power Sparrowhawk's services. Internal training and evaluation happen under access controls and audit logging.

What we don't do. We do not sell your Customer Data. We do not show your identifiable data to other Sparrowhawk customers. We do not use your Customer Data for third-party advertising. We do not attempt to re-identify aggregated data.

External publications. When we publish benchmarks, industry insights, or share data outside Sparrowhawk for purposes other than running the service for you, we use de-identified Aggregated Data only (k-anonymity ≥5, minimum cohort of 10 customers, free-text scrubbing). Full standard at https://www.sparrowhawklabs.com/legal/deidentification-standards.

Your choice. You can opt out of being included in our publishable benchmarks and industry insights by contacting privacy@sparrowhawklabs.com. The opt-out does not apply to internal model training, service operation, security, or fraud prevention.

Where you see cross-tenant insights in the product (e.g. "your performance vs market"), those features run on aggregated data and a tooltip will indicate that the comparison is built from anonymised, aggregated data across Sparrowhawk customers.

Data-subject opt-out: If you are an individual whose data is in the Services because a Sparrowhawk customer submitted it, the Sparrowhawk customer is your privacy contact (we are their service provider). We will assist them in honouring your access, correction, deletion, portability, and opt-out requests as required by applicable law.

AI Products: The Services include features powered by AI / machine-learning models (e.g. AI insights, predictive analytics, natural-language processing). Where those features process Personal Data, the processing is governed by this Notice and the Data Processing Agreement. Where models are trained or improved using data from across our customer base, the inputs are de-identified per our standard.

What we share. A narrow slice of your data — invoice amounts, payment-aging buckets, payment timeliness, and credit-utilization metrics ("Contributory Data") — is disclosed to vetted third-party credit-reporting or risk-scoring services ("Contributory Data Partners") so they can generate credit scores, suggested credit limits, and risk reports. The business identity of the retailer or other business debtor that owes you payment (business name, business licence number, and location) is included because it is the subject of the commercial credit report. We do not include the names, emails, or phone numbers of individual people, pricing terms, deal notes, or free-text fields — Contributory Data identifies the business that owes you money and nothing else — its business and DBA name, business licence number, and location. We include no information about that business's owners, officers, employees or guarantors, and we exclude any receivable where the debtor's business name is, or incorporates, a person's name.

Why — to provide the Services to you. This is a business-to-business trade-credit exchange and it exists to deliver a feature you use: the credit scores, limits, and reports these partners generate are made available back to you, so you can see the credit health of the accounts you extend payment terms to. Sparrowhawk may earn a margin reselling full reports.

This is business data, not personal information. Contributory Data is commercial credit information about business entities — your own receivables record, and the identity of the business that owes you money. It contains no personal information about any individual. Disclosing it is therefore not a sale or sharing of personal information under the CCPA/CPRA or comparable US state privacy laws, and we do not sell personal information.

Current partners. Published at sparrowhawklabs.com/legal/data-partners — updated at least 30 days before any new partner or partner category is added.

Your choice — opt out any time, and we will honour it. Contributory Data Partnerships are on by default, consistent with how our other non-essential features work. You can opt out of some or all of them at any time:

• Email privacy@sparrowhawklabs.com, or
• Use the in-product privacy settings, where we make them available in the Services.

We honour every opt-out request. Requests sent by email are implemented within 15 business days; an opt-out made through an in-product control takes effect on confirmation. Opting out stops future disclosures; it does not force retroactive deletion from a partner's systems, though we will ask the partner to delete data already shared.

• We keep personal information for as long as necessary to fulfil the purposes in this Notice, and longer only where the law requires or permits it.
• If you ask us to delete your account, we delete your personal information within thirty (30) days, except for the records listed in "Deleting Your Account" below.
• When a customer closes its whole Sparrowhawk account, its Customer Data is deleted or anonymised as set out in our Terms of Service (§13.3) and Data Processing Agreement (§9).

You can ask us to delete your Sparrowhawk account — your own login to the Sparrowhawk app or website — and the personal information tied to it at any time. This section explains how to ask, how long it takes, and what we keep.

How to request deletion

Email privacy@sparrowhawklabs.com from the email address registered to your account, with the subject line "Delete my account". You do not need to give a reason.

How we confirm it is you

We act on a request sent from the email address registered to the account. If a request comes from any other address, we reply to the registered address and ask you to confirm before we delete anything. We will never ask for your password.

What happens, and when

• Access stops straight away. Once we have confirmed your request, we sign you out on every device and you can no longer sign in.
• Deletion within 30 days. Within thirty (30) days of confirming your request, we delete your login and sign-in identity, your profile (name, email address, phone numbers, job title), your device and push-notification tokens, your notification and email preferences, and any feedback you have sent us.
• We tell you when it is done. We email the registered address when deletion is complete. If anything prevents us from finishing within 30 days, we email you before the deadline to say why and when we will finish.

Deletion is permanent. To use Sparrowhawk again later, you will need a new account.

What we keep, and why

Record	Why we keep it	How long
Business records you created in a customer's account — orders, account notes, documents, status updates	They belong to the Sparrowhawk customer whose account they are in, not to you. Your name is removed from them when your profile is deleted.	As long as that customer keeps them, then as set out in our Terms of Service §13.3
Security audit-log entries of actions taken with your account	Security, fraud prevention, and investigating misuse	Three hundred sixty-five (365) days from each entry, then deleted
Billing and tax records, if you paid us directly	Required by tax and accounting law	As long as the law requires, generally seven (7) years
Copies in encrypted backups	Disaster recovery — backups cannot be edited record by record	Until the backup expires, at most twelve (12) months. Backups are access-restricted and used for nothing else. If we ever restore one, we re-apply your deletion before the data returns to service.
A record of your request	To show that we honoured it	The request date, completion date, and account identifier, kept for twenty-four (24) months

De-identified, aggregated data that no longer identifies you (see "AI, Analytics & Aggregated Insights") is not personal information and is not affected by deletion.

If a customer gave you your login

If your employer or another Sparrowhawk customer set up your login, you can still ask us to delete it as described above. We will tell that customer's Account Administrator, because the business records you worked on belong to them, and that customer remains your privacy contact for those records. To close a whole customer account rather than a single login, see our Terms of Service §13.

• Appropriate technical and organizational measures implemented
• No 100% guarantee (standard disclaimer)

• Do not knowingly collect from or market to under-18s
• Will deactivate accounts and delete data if discovered

• We do not sell or share personal information for cross-context behavioural advertising.
• We disclose a limited category of business-to-business payment-performance data (Contributory Data) to Contributory Data Partners as described in "Credit & Risk Reporting Partners" above. That data is commercial information about business entities and contains no personal information, so it is not a "sale" or "sharing" of personal information under CCPA/CPRA or similar laws.
• Opt-out, always honoured: you can opt out of the Contributory Data Partner disclosure at any time — see "Credit & Risk Reporting Partners" above for how.
• State-specific rights: know, access, correct, delete, copy, opt out, limit sensitive data use, appeal
• California Shine The Light: category + third-party disclosure on request

• No uniform standard finalized — not currently honoured

Sparrowhawk Labs, Inc 1605 NW Galveston Ave, Bend, OR 97703, United States Email: privacy@sparrowhawklabs.com (data-protection inquiries) | help@sparrowhawklabs.com (general support)