Privacy Policy

1. Introduction & scope

This Privacy Policy ("Policy") describes how RepuSpark ("RepuSpark", "we", "us", or "our") collects, uses, discloses, and protects information when you visit our website at repuspark.app (the "Site"), create an account, use the RepuSpark dashboard, or interact with messages sent through the RepuSpark service (collectively, the "Service").

This Policy applies to two categories of individuals:

• Business users — owners, employees, or agents of small businesses that subscribe to RepuSpark.
• End customers — individuals whose contact information is uploaded to RepuSpark by a business user so that the business can request a review.

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Service.

2. Our role: controller and processor

With respect to information about business users (account holders), RepuSpark acts as a data controller. We determine the purposes and means of processing this information.

With respect to end-customer contact information that a business user uploads to the Service, RepuSpark acts as a data processor (or "service provider" under U.S. law) on behalf of the business user, who is the controller. The business user is responsible for the lawful basis on which it collects and shares end-customer information with us.

3. Information we collect

3.1 Information you provide

• Account information: name, email address, password (stored hashed), business name, business address, business phone, and the public URLs of business profiles you choose to monitor (e.g., Google, Yelp, Facebook).
• Billing information: when you subscribe to a paid plan, our payment processor collects your card or other payment instrument details. We do not store full payment card numbers on our systems.
• End-customer contact information uploaded by business users: typically a customer's first name and mobile phone number, used to send a one-time review-request SMS.
• Communications with us: support requests, feedback, and survey responses.

3.2 Information collected automatically

• Usage and device data: IP address, browser type and version, operating system, device identifiers, referring/exit pages, pages viewed, and timestamps.
• Cookies and similar technologies: see Section 15 below.
• Message events: SMS delivery status, error codes, and click events on links contained in messages we send on behalf of business users.

3.3 Information from third parties

• Public review data retrieved from public business profiles (such as Google) via authorized APIs or public web sources, in order to display review trends and alerts in the dashboard.
• Authentication providers (if you sign in via a third-party identity provider): basic profile information such as your name and email, in accordance with the permissions you grant.

We do not knowingly collect Social Security numbers, government-issued ID numbers, financial account numbers (other than payment processing handled by our payment processor), health information, or other sensitive categories of personal information.

4. How we use information

We use information for the following purposes:

• Provide and operate the Service, including authenticating users, displaying review data, sending review requests on behalf of business users, and notifying business owners of new reviews.
• Billing and account administration, including processing subscription payments, sending invoices, and handling refunds.
• Customer support, including responding to your inquiries and troubleshooting issues.
• Improvement and analytics, including measuring feature usage, diagnosing performance issues, and improving the user experience.
• Security and fraud prevention, including detecting, investigating, and preventing fraudulent, unauthorized, abusive, or illegal activity.
• Legal compliance, including complying with applicable laws, regulations, court orders, and lawful government requests, and enforcing our agreements.
• Communications with business users, such as service announcements, security alerts, and (with consent where required) marketing about new features. You can opt out of marketing emails at any time.

We do not sell personal information for monetary consideration, and we do not share end-customer phone numbers or contact information with third parties for those third parties' own marketing.

5. Legal bases for processing (EEA/UK)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:

• Contract — to provide the Service you have requested or to take steps at your request before entering a contract.
• Legitimate interests — to operate, secure, and improve the Service, prevent fraud, and communicate with business users about their account, where those interests are not overridden by your rights.
• Consent — for activities that require consent under applicable law (e.g., certain marketing communications). You may withdraw consent at any time.
• Legal obligation — to comply with applicable law and lawful requests from public authorities.

6. SMS messaging & consent

RepuSpark sends two categories of SMS messages, both delivered through our messaging provider, Twilio Inc.:

For public examples of customer-facing opt-in language, internal consent confirmation, and STOP/HELP handling, see our SMS Compliance page.

1. Review-request messages to end customers — when a business user uploads an end customer's phone number, that customer receives a single SMS inviting them to leave a review of the business they visited.
2. Review alerts to business users — business users who enable SMS alerts receive a text whenever a new public review of their business is detected.

6.1 Consent

End customers: by providing your phone number to a business that uses RepuSpark (for example, at the point of service or checkout), you consent to receive a one-time review-request SMS from that business via RepuSpark relating to your visit. The business that collected your number is responsible for obtaining your consent in compliance with applicable law, including the Telephone Consumer Protection Act (TCPA) and CTIA messaging principles.

Business users must collect consent through a verifiable path, such as a checkout or intake checkbox, written consent, or documented in-person verbal consent, and must provide clear disclosures at collection, including: business identity, purpose (one-time review request), message frequency expectations, message/data rates notice, and STOP/HELP instructions where required by law.

Business users: you consent to receive review-alert SMS messages by enabling SMS alerts in your RepuSpark dashboard settings, and you may disable them at any time from the same settings page.

6.2 Frequency

Review-request messages are sent on a one-time basis per customer interaction. Review-alert messages are sent only when a new review is detected. Message frequency varies depending on review activity for your business.

6.3 Opt out, help, and rates

You can opt out of any RepuSpark SMS at any time by replying STOP to the message. You will receive one confirmation SMS, after which you will not receive further messages of that category. Reply HELP for help, or contact us at support@repuspark.app or +1 (856) 481-8494.

Message and data rates may apply. Messages may be delayed or undelivered for reasons outside our control, including network outages or carrier filtering. Carriers are not liable for delayed or undelivered messages.

6.4 Mobile information

No mobile information collected for the purpose of sending SMS (including phone numbers and opt-in status) will be shared with third parties or affiliates for marketing or promotional purposes. Information will only be shared with subprocessors (such as Twilio) to the extent necessary to deliver the messages you have consented to receive, as described in Sections 7 and 8.

RepuSpark logs messaging compliance metadata (for example, consent attestation, collection method, link-click events, and recipient confirmation events) to support fraud prevention, auditability, and carrier or regulator compliance reviews.

7. How we share information

We may share information in the following circumstances:

• With service providers / subprocessors who perform services on our behalf (see Section 8).
• With the business user who uploaded an end customer's information (with respect to that information).
• For legal reasons, including to comply with applicable law, regulation, legal process, or governmental request, or to enforce our Terms of Service or protect the rights, property, or safety of RepuSpark, our users, or others.
• In a corporate transaction such as a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, in which case information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.
• With your consent, or at your direction.

8. Service providers / subprocessors

We use the following categories of subprocessors. Each is bound by a written agreement requiring confidentiality and appropriate safeguards:

• Hosting and infrastructure (application hosting and edge delivery).
• Database and authentication — Supabase, Inc. (storage of account and operational data, user authentication).
• SMS delivery — Twilio Inc. (transmission of SMS messages and delivery status reporting).
• Review data sources — third-party data providers used to retrieve public review information.
• Payment processing — our payment processor for subscription billing.
• Email delivery — transactional email provider for account and security emails.
• Analytics and error monitoring — privacy-respecting analytics and error tracking to help us operate and improve the Service.

A current list of subprocessors is available on request by emailing support@repuspark.app.

9. Data retention

We retain personal information for as long as needed to provide the Service and for the additional purposes described below:

• Account data — for the life of your account plus up to 90 days after account closure for backup and recovery purposes.
• Message and review data — for the life of the originating business account, plus a reasonable period afterward for legal, accounting, audit, and dispute resolution purposes.
• Opt-out records — retained indefinitely so that we can honor your opt-out request and not contact you again.
• Billing records — for the period required by applicable tax and accounting laws.

You may request deletion of your account data at any time as described in Section 12.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit using TLS.
• Encryption of data at rest in our database.
• Role-based access controls and least-privilege principles.
• Hashed and salted password storage.
• Logging and monitoring of administrative access.
• Regular software updates and dependency review.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work continuously to protect your information.

11. International data transfers

RepuSpark is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries in which our subprocessors operate. Where required by law, we put in place appropriate safeguards (such as Standard Contractual Clauses) for international transfers of personal information from the EEA, UK, or Switzerland.

12. Your privacy rights

Subject to applicable law and certain exceptions, you may have the following rights with respect to personal information we hold about you:

• Access — request a copy of personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete personal information about you.
• Portability — request that we provide your personal information in a portable, machine-readable format.
• Objection or restriction — object to or restrict certain processing of your personal information.
• Withdrawal of consent — where we rely on consent, withdraw that consent at any time.
• Lodge a complaint — with a supervisory authority in your jurisdiction.

To exercise these rights, please email support@repuspark.app from the email address associated with your account, or contact the business that uploaded your information if you are an end customer. We may need to verify your identity before fulfilling your request. We will respond within the time period required by applicable law.

We will not discriminate against you for exercising any of these rights.

13. U.S. state privacy rights

Depending on the U.S. state in which you reside (including California, Colorado, Connecticut, Virginia, Utah, Texas, and other states with comprehensive privacy laws), you may have additional rights, including the right to know what categories of personal information we have collected about you, the right to delete that information, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information or processing for targeted advertising.

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising. We do not knowingly process the personal information of consumers under the age of 16 for purposes of sale or sharing.

California "Shine the Light": California Civil Code §1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. As stated above, we do not share personal information with third parties for their direct marketing purposes.

To exercise any state privacy right, email support@repuspark.app. You may designate an authorized agent to make a request on your behalf, subject to verification.

14. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will promptly delete it. If you believe a child under 16 has provided personal information to us, please contact us at support@repuspark.app.

15. Cookies & similar technologies

We use cookies and similar technologies (such as local storage) to operate and secure the Service, remember your preferences, keep you signed in, and understand how the Service is used.

We use the following categories of cookies:

• Strictly necessary — required to operate the Service (e.g., authentication, session management, security). These cannot be disabled.
• Functional — remember preferences such as your business selection or theme.
• Analytics — help us measure and improve the Service.

Most browsers let you remove or reject cookies through your browser settings; however, doing so may affect the functionality of the Service. We currently do not respond to "Do Not Track" browser signals because no industry standard has been finalized; however, we honor recognized opt-out preference signals (such as Global Privacy Control) where required by applicable law.

16. Third-party links

The Service may contain links to third-party websites or services (including review platforms such as Google, Yelp, and Facebook). We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you use.

17. Changes to this policy

We may update this Policy from time to time. If we make material changes, we will notify you by email (sent to the email address associated with your account) and/or by posting a prominent notice on the Service prior to the change becoming effective, and we will update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

18. Contact us

If you have questions about this Policy or our privacy practices, or wish to exercise any of your rights, please contact us:

RepuSpark
Email: support@repuspark.app
Phone: +1 (856) 481-8494
Website: repuspark.app