Privacy

SPARK CMMS Privacy Policy

Effective May 10, 2026. This policy explains how SPARK CMMS handles account, company, maintenance, upload, notification, and security data.

Plain-English Summary

SPARK is built for company maintenance data. We use that data to run the CMMS, keep customer companies separated, protect accounts, send necessary emails, and support maintenance workflows. We do not sell personal information or company maintenance data.

What SPARK Collects

Account information such as name, email address, company, role, invite status, login activity, and security settings.
Company maintenance data such as work orders, scheduled work orders, assets, tools, machines, equipment, sites, buildings, departments, inventory, notes, and related history.
Uploaded files, photos, documents, CSV imports, and records attached to maintenance work.
Email and notification records needed for invites, password resets, work order assignments, and system alerts.
Technical and security information such as browser/device details, session records, audit events, and server logs used to protect and operate the service.

How SPARK Uses Data

To run the CMMS, authenticate users, keep companies separated, and show each person only the records they are allowed to see.
To create and manage work orders, plant records, asset records, inventory, imports, assignments, notifications, and history.
To send security emails, invite links, password reset emails, and work order notifications when those features are enabled.
To troubleshoot issues, improve reliability, protect accounts, investigate abuse, and maintain backups.
To comply with legal, security, or operational obligations when required.

Company Data and Access

Each SPARK company is treated as a separate workspace. One user email belongs to one company.
Company owners and authorized admins control users, access roles, departments, sites, buildings, and permission levels for their company.
Users should only see company data allowed by their role, permission level, and scope.
Customer maintenance data belongs to the customer company that entered or imported it.

Sharing and Service Providers

SPARK does not sell personal information or company maintenance data.
SPARK may use trusted service providers for hosting, database storage, backups, email delivery, monitoring, security, and support.
Email delivery may use Microsoft 365 SMTP to send invites, password resets, and notifications.
Data may be disclosed if required for legal compliance, account protection, fraud prevention, or security investigation.

Security

SPARK uses its own login system, password hashing, invite links, role-based access, scoped permissions, session controls, audit logging, and optional authenticator-app two-factor authentication.
Production traffic should be served over HTTPS/TLS and protected by properly configured server, database, and backup controls.
No system can be guaranteed perfectly secure, but SPARK is designed to reduce unnecessary access and keep company workspaces separated.
Users should protect their passwords, enable 2FA when available, and report suspicious account activity to their company owner or SPARK support.

Retention, Export, and Deletion

SPARK keeps account and company data while the company account is active or as needed to provide the service.
Backups, logs, and audit records may remain for a limited time after records are changed or deleted.
Company owners can request help exporting or deleting company data.
Some records may need to be retained when required for security, legal, billing, backup, or audit reasons.

Children

SPARK is built for businesses and maintenance teams. It is not intended for children or personal use by minors.

Changes and Contact

SPARK may update this policy as the product, security model, or service providers change.
Questions about this policy, data access, exports, or deletion requests can be sent to support@sparkcmms.com or to your SPARK company owner.