Privacy Policy for onSpark AI

      Last Updated: September 21, 2026

Thank you for choosing onSpark AI (also called onSpark or The Deal Room), operated by Deal Room Group, Inc. ("Company," "we," "us," or "our"). This Privacy Policy outlines how we collect, use, and protect your information when you use our platform.

This policy describes our privacy practices when you access or use onSpark.

1. Information We Collect

1.1 Personal Information

Name and Contact Details: We collect your name, email, and contact information to personalize your experience and facilitate partner matching.

Voice Intake Data: During the AI-guided intake call (which uses Deepgram for speech-to-text and OpenAI for speech and language processing), we collect information about your business, goals, partnership preferences, and relevant professional details.

Profile Information: You may upload pitch decks, media kits, and other business assets to your profile.

Payment Information: We process payments securely through Fort Point Payments. We do not store your complete payment information on our servers.

1.2 Device, Usage, and Cookie Data

We use cookies and similar technologies to collect information such as IP address, browser type, device information, and usage patterns to improve our services and user experience.

1.3 Google Ads Conversion Measurement

We use the Google tag and Google Ads conversion tracking to measure whether advertising leads to account registrations and purchases. We use Google Consent Mode v2. Before you make a choice, or when you reject marketing cookies, advertising storage, advertising user data, advertising personalization, and analytics storage default to denied. In that state, Google may receive cookieless, redacted measurement pings, but our site does not grant permission for advertising cookies or personalized advertising.

If you grant Marketing consent, the Google tag receives granted advertising consent signals and may use advertising storage and advertising data for campaign attribution. A confirmed purchase conversion includes the amount paid, currency, and a unique payment transaction identifier. It does not include complete card details.

When an advertising link contains a Google click identifier (gclid, gbraid, or wbraid), we retain only that identifier for up to 90 days in session storage, not the complete landing URL. We may send it with the same consent state and transaction identifier through Google's Data Manager API as a retryable server-side supplement. Browser and server reports use the same transaction identifier so Google can deduplicate them. These identifiers are forwarded only to our owned qualification service and Google for conversion measurement; they are not included in our error telemetry.

You can grant, reject, or customize optional Analytics and Marketing consent from the consent banner and can change or withdraw that choice at any time using the Cookie settings control.

1.4 Reddit Conversion Measurement

With Marketing consent, we load the Reddit Pixel to measure page visits, completed email registrations, and confirmed purchases. Reddit may receive the page URL, referrer, browser and device information, its cookie and advertising click identifiers, and public page metadata according to the pixel's settings. A purchase event includes the amount paid, currency, item count, and a conversion identifier. Our integration does not supply email addresses, phone numbers, or payment card details as matching fields.

The Reddit Pixel does not load before Marketing consent. If you withdraw that consent, we stop sending events through our integration, disable the pixel's first-party cookies, and reload the page to remove its active tracking code. Links tagged with campaign parameters may separately identify visits from Reddit conversations; a pixel event alone does not identify which organic conversation led to a visit.

2. How We Use Your Information

We use your data to:
- Provide AI-powered partner matching services
- Connect you with relevant members from our database
- Facilitate communication and networking
- Provide access to community resources and tools
- Process payments and manage your membership
- Send important updates about matches, events, and platform features
- Improve our AI matching algorithms and services

2.1 Authorized Account Access

Authorized onSpark personnel may temporarily access or act within an account for account setup, member-requested or contracted concierge management, customer support and troubleshooting, fraud prevention, and platform security. Depending on the account and task, the legal basis is performance of our service contract or our legitimate interests in delivering, protecting, and supporting the service. We do not treat acceptance of our Terms as GDPR consent to unrelated processing.

We limit access to administrators with a dedicated permission and enrolled multi-factor authentication. Each impersonation session records the acting administrator, affected account, date and time, and a required specific reason. Sessions start read-only by default; dry-run and live modes are available only when needed for the documented task. Personnel are required to use the least intrusive access appropriate to that purpose.

Authentication and impersonation audit records are retained for 24 months so we can investigate access, demonstrate accountability, resolve disputes, and meet legal obligations, then deleted automatically. A specific record may be isolated for longer when required by a documented legal hold. Account content remains subject to the retention periods applicable to that content.

Where we rely on legitimate interests, you may object to that processing. We will stop unless we demonstrate compelling legitimate grounds or need the processing to establish, exercise, or defend legal claims. Limiting operational access may affect our ability to provide setup, concierge, or support services that require it.

3. Data Sharing

We share your profile information with matched partners within the platform to facilitate connections.

We do not sell your personal information to third parties.

We disclose data only as necessary to providers that host our application and database, store files, deliver email and communications, process payments, provide AI, speech, meeting, scheduling, CRM, analytics, security, and error-monitoring functions, or support member-connected integrations. Those providers receive only the data needed for the enabled function and are subject to the contractual role and safeguards applicable to that service.

SMS Privacy: We use your mobile number and SMS consent to provide the onSpark text services you request, including partnership intake, requested signup links, and security codes. Intake message frequency varies with your conversation; signup links are one text per request, and security codes are one code per request, with additional messages only when you request another code. Message and data rates may apply. We do not sell or share mobile information with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with third parties for their own use. We provide only the information necessary to service providers that deliver these messages on our behalf. You can stop texts by replying STOP and request help by replying HELP or emailing kyle@onspark.com.

3.1 International Transfers

Some providers process data outside the European Economic Area, United Kingdom, or Switzerland. Where an adequacy decision does not cover the destination, we use an approved transfer safeguard, such as the European Commission's Standard Contractual Clauses and the United Kingdom addendum, together with appropriate supplementary security measures. You may contact us for information about the safeguard applicable to a particular transfer.

3.2 Google and Microsoft User Data

Connecting Google Workspace is optional and separate from signing in with Google. The connection requests access for the following features:

Contacts: We import names, email addresses, organizations, job titles, and available photos from your Google contacts into your onSpark network for contact management and warm introductions. We do not need permission to edit your Google address book.

Gmail: We send outreach and replies that you submit from your connected Gmail account. We read recent message headers to identify correspondents and relationship interactions. When Partnership inbox sync is enabled, our servers fetch message content, filter it for relevant business and partnership conversations, and store selected threads so you can read and reply inside onSpark. Filtering happens after fetching; it can identify relevant business correspondence from previously unknown senders and may not exclude all unrelated messages. Provider change notifications keep connected inboxes current. We do not need permission to modify or delete messages in Gmail.

Calendar: We read events from your primary Google calendar, including titles, descriptions, times, attendees, and meeting links, to display meetings and track partnership interactions. When you schedule a meeting, we create an event on that calendar, optionally with a Google Meet link, and send invitations to the attendees you select. We use provider notifications where configured to keep events current.

Relationship memory: Relevant stored email threads and relationship interactions can be processed into searchable representations to provide your onSpark relationship context. This processing uses Pinecone inference and vector storage. Relevant context may be supplied to the AI service providers supporting the assistance you use. These flows process connected data in addition to displaying it in your inbox.

Microsoft connections support corresponding Outlook mail, contacts, and calendar features. Provider tokens are stored encrypted. You can disconnect a provider in Settings. Disconnecting access is distinct from deleting data already imported into onSpark. Turning off Partnership inbox sync initiates removal of stored synced mail and associated relationship-memory data; imported contacts have a separate removal action. Account deletion and retention are described below.

The Deal Room's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

3.3 How Long We Keep Data

We retain account data while the account is active and for only as long afterward as needed to complete deletion, meet a stated service purpose, comply with tax, accounting, payment, security, or other legal obligations, resolve disputes, or enforce agreements. Users can permanently delete their account from Settings. Backup copies are removed through our ordinary backup lifecycle unless preservation is required by law. More specific periods disclosed in this policy, including the 24-month account-access audit period and 90-day advertising-click identifier period, control for those records.

4. Data Security

We implement industry-standard security measures to protect your information. However, no method of transmission over the internet is 100% secure.

5. Your Rights

You have the right to:
- Access your personal data
- Update or correct your information
- Request deletion of your account and data
- Opt-out of non-essential communications
- Change or withdraw optional cookie and advertising consent at any time
- Object to processing based on legitimate interests
- Request restriction of processing and data portability where applicable
- Lodge a complaint with the supervisory authority in your country of residence, work, or the place of an alleged GDPR infringement

You are required to provide the identity, contact, account configuration, and payment information needed to create and perform a paid account. Without it, we cannot provide the relevant service. Optional profile, integration, cookie, advertising, and outreach information is identified as optional at collection or in the applicable settings.

Our AI features generate recommendations, summaries, and assistance. We do not use them to make decisions based solely on automated processing that produce legal or similarly significant effects about you.

6. Children's Privacy

The Deal Room is intended for business professionals. We do not knowingly collect information from individuals under 18.

7. Updates to Privacy Policy

We may update this Privacy Policy to reflect changes in our practices. We will notify you of significant changes via email.

8. Contact Information

For privacy-related questions or requests, contact us at:

Email: kyle@onspark.com