DRAFT — pending legal review. Live list updated when we change vendors. Referenced by the Privacy Policy and DPA.
Last updated: 2026-05-15
These are the third-party services Spark uses to operate. We update this page when we add, remove, or materially change a vendor.
| Sub-processor | Purpose | Data shared | Location |
|---|---|---|---|
| Anthropic | AI inference (drafts, bios, suggestions, Steward chat, CSV import column mapping) | Prompts containing your contacts, notes, interactions, and CSV-import samples (headers + first 5 rows); no model training | US |
| Resend | Transactional email (verification, password reset, billing) | Email address, name, message content | US |
| Expo | Push notifications | Device push tokens, notification text | US |
| Neon / [hosting provider TBD] | Database hosting | All user data | US (region TBD) |
| AWS S3 (or equivalent) | Avatar / attachment storage | Uploaded files | US |
| Sentry (or equivalent, when shipped) | Error tracking | Stack traces, request metadata, user id | US |
| Stripe (when Phase 8 ships) | Payment processing (web fallback only; IAP runs through Apple/Google for mobile) | Email, payment metadata | US |
| Apple / Google | App Store distribution + IAP | Payment info for IAP, app analytics | US |
Adding a sub-processor
We notify users at least 30 days before adding a new sub-processor when the addition materially changes data flows. Material changes also trigger a Privacy Policy version bump and a re-acceptance prompt.