Privacy Policy
Effective date: [effective date]
Contents
1. Who we are
This policy is published by SparkFlow AI, operated by Mohsin Tunio in Ontario, Canada (the incorporated entity and its registered address will be named here before publication) (“SparkFlow”, “we”). SparkFlow is an AutoCAD plug-in and a web dashboard for engineering firms. Engineers upload a marked-up drawing and decide on each change SparkFlow proposes, and they ask about their company’s standards and the codes it holds a licence for. Nothing changes in a drawing until an engineer accepts it.
SparkFlow assists licensed professionals; it does not certify code compliance, approve designs or replace professional review.
This policy covers the personal information we handle through this website, the help desk and the service. When your company uses SparkFlow, your company decides what goes into its environment and who may use it, and we handle that information only to provide the service to your company.
2. The personal information we handle
The website’s forms
The contact form and the help desk form ask for your name, your work email, your firm and an approximate seat count; your role, the AutoCAD versions in use and a message are optional. Please never put confidential drawings, passwords or client information in either form.
To limit how many requests one connection can send, a request also carries a key made from your network address and a secret that changes regularly. The key cannot be turned back into the address, and the address itself is not stored with the request.
If a form cannot send, your email app opens a message to hello@sparkflowai.ca holding what you entered, and sending it is your choice.
Accounts
Members sign in through their company’s own sign-in tenant on Google Cloud, usually through the company’s identity provider. The sign-in service holds each member’s sign-in identity and email address, and checks an authenticator app code at sign-in. Where a company signs in with an email address and password instead, the sign-in service holds the password; SparkFlow never does.
SparkFlow’s own record of a member holds an identifier from the sign-in service, a one-way hash of the email address, and the member’s roles, seat and status: never a name and never an address.
When SparkFlow sends your company’s administrators a notice, such as a warning that the company’s allowance is running low, it reads their email addresses from the sign-in service at that moment and hands them to the mail service. It never stores them.
Your company’s work
Your company’s environment holds its work and the record of it: the facts the plug-in reads from drawings, the markups, standards and code books your company loads, the questions members ask and the answers, their decisions and teachings, and an activity ledger of who did what and when. Any of it may name people. Your company’s administrators can see this record; SparkFlow’s operator cannot.
Diagnostics
SparkFlow’s own log lines carry timings, error codes, versions, counts and identifiers, never your content: never a prompt, a drawing, a file name or a markup.
Google Cloud also records each request to this website and to the service: the network address it came from, the address it asked for, the time and the browser’s description of itself. The sign-in service records each sign-in request.
3. What we use it for
- A contact request: to reply to you, and for nothing else.
- A help desk request: to trace what happened and reply to you.
- Account records: to sign members in, apply their roles and seats, and send your administrators notices about your company’s service.
- Your company’s work: to provide the service to your company alone. It is never used to train a model and never used for another company.
- Diagnostics and request records: to run, secure and repair the website and the service.
The website shows no advertising and keeps no marketing list.
5. Who processes it for us
Two providers process customer data for SparkFlow. The subprocessors page lists each purpose with the data it handles and its region.
- Google Cloud hosts your company’s isolated environment and SparkFlow’s own service, runs the model engine, and signs members in through your company’s identity provider.
- Amazon Web Services sends email notices to your administrators.
A contact or help desk request is kept in SparkFlow’s own database on Google Cloud and delivered to the founder [the channel that delivers a request to the founder, and the mailbox or service that receives it].
6. Where it is processed
Your company’s content stays in Canada. It is stored and processed in Google Cloud’s Canadian regions, the model engine included, and when no Canadian route is available a request stops rather than leave the country.
SparkFlow’s own database and its logs are in Canadian regions too, and email notices to your administrators are sent through Amazon Web Services in Canada.
The sign-in service holds members’ sign-in identities in [the region where Identity Platform holds sign-in identities].
7. How long we keep it
- Contact and help desk requests: a request is deleted from SparkFlow’s own database after its notice has been delivered, and in any case once it is thirty days old. After replying, the founder keeps the request and the reply for [the time the founder keeps a request and its reply].
- Uploads waiting for their check: the quarantine copy of every upload is deleted seven days after it arrives, whatever the check decided.
- Exports: an export’s file is deleted seven days after it is ready, and each download link works for fifteen minutes.
- Logs: kept for thirty days.
- Your company’s work and its records stay until your company leaves SparkFlow: its work, its activity ledger, its jobs and requests, its export records and its usage records.
- Backups: each database is backed up daily and encrypted, and each backup is kept for seven days.
- SparkFlow’s own records about a company: [counsel: how long SparkFlow keeps its own account and commercial records about a company after it leaves].
8. Deletion and offboarding
Within your company, an administrator can suspend a member at once, and the member’s next request is refused. The member’s past actions stay in your company’s activity ledger, which is your company’s record.
When your company leaves, SparkFlow tells it in writing when offboarding starts and when its export window ends, [the length of the export window, from 14 to 90 days] after the notice. During the window your administrators can sign in and take your company’s exports, and nothing else.
Then offboarding removes your company’s environment and proves it: every table and every object is wiped, your company’s keys are scheduled for destruction, and your company receives a signed record of the deletion with the date its last encrypted backup expires, [how long encrypted backups remain after a wipe] after the wipe. A company that has left is never routed to again, and its members’ sign-in accounts are removed [the time after offboarding within which sign-in accounts are removed].
Files your members downloaded to their workstations are your company’s to handle.
9. Your rights and requests
You can ask to see the personal information SparkFlow holds about you, to correct it, or to delete it.
If you use SparkFlow through your company, start with your company’s administrator: your company decides what its environment holds, and its administrators can see and export its records. For a contact or help desk request, or anything your administrator cannot settle, write to the privacy contact in section 11.
[counsel: the time within which a request is answered, and the regulator a person may complain to]
10. How we protect it
Each company’s work lives in its own environment, under an encryption key that belongs to that environment, and every request is checked against the company its sign-in belongs to. Multi-factor authentication is required for every member.
SparkFlow’s operator sees counts, never content. Support can read your company’s audit records only under a time-limited grant your administrator approves, and every such read is recorded.
The security page lists the controls in place.
11. The privacy contact
Write to mohsin.tunio@sparkflowai.ca, or by post to SparkFlow AI, operated by Mohsin Tunio in Ontario, Canada (the incorporated entity and its registered address will be named here before publication).