Privacy Policy.
Last updated November 3rd, 2026
1. Who we are
Spark Layer Ltd ("SparkLayer", "we", "us", "our") provides B2B ordering software to merchants, delivered as an app on ecommerce platforms including Shopify, Wix, BigCommerce, WooCommerce and Magento.
Registered office: Trimbridge House, First Floor, Trim Street, Bath, BA1 1HB, United Kingdom.
Company registration number: 12881913.
ICO registration: ZB074246.
This policy explains what personal data we handle, why, the legal bases we rely on, who we share it with, and the rights available to you. It covers this website (www.sparklayer.io), our dashboard and apps, and our sales and support activity.
We are not required by the UK GDPR to appoint a data protection officer and have not appointed one. Any question about this policy or your data can be sent to contact@sparklayer.io or by post to the address above.
2. Do we process personal data when providing our services?
Yes. Providing B2B ordering requires us to process personal data belonging to your customers. In that processing you are the data controller and SparkLayer is your data processor: we act only on your documented instructions, and only to deliver the service. Section 7 sets out exactly what we process and why, and section 21 sets out the terms on which we do it.
3. The two roles we act in
- Controller - for the personal data of people who visit our website, hold or administer a SparkLayer account, and deal with our sales and support teams. This policy governs that data.
- Processor - for the personal data of your customers, handled on your behalf to provide B2B ordering. You are the controller; your own privacy notice governs that data.
4. Personal data we handle as a controller
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, company name, company website, email address, phone number | You, at sign up or when you complete a form on our website |
| Account | Login credentials (hashed), settings, time zone, user role | You / generated by the service |
| Billing | Billing contact, plan, transaction records. Card details are handled by Shopify or Stripe and are not stored by us | You / the platform / Stripe |
| Usage & technical | IP address, device and browser, pages viewed, feature usage, log data | Automatically |
| Support & sales | Messages, chat transcripts, call notes, support tickets | You / our tools |
| Marketing | Preferences and engagement with our emails | You |
| Website demo | The store address you enter into our interactive demo and, if you provide it, your email address | You |
| Ask Sparkie | What you type to Ask Sparkie, the assistant on our website; what you tell it about your business (for example your store, platform, order volumes and how you'd like SparkLayer set up); and, if you choose to share them, your name, email address, company, phone number, a preferred call time and a note for our team | You |
| Product feedback (beta programmes) | Your feedback message, its type, an optional screenshot, your name and role, your store, and your email if you agree to be contacted. Also, automatically: the page you were on, the page address (with secrets removed), your browser, operating system and device, window and screen size, language, time zone, theme, connection type, and up to five recent error messages from the page | You, when you choose to send feedback through Give feedback in a SparkLayer beta / generated by your browser |
| Connected AI apps | The AI apps you connect to SparkLayer through our MCP server, the sites and the live or test data you allow each app to use, when you allowed them, and the tokens each app uses (section 7B) | You / generated by the service |
SparkLayer does not require or intentionally collect special category personal data, or data relating to criminal convictions and offences, in order to provide the service. Customers and users should not provide this information unless it is necessary and lawful to do so.
Ask Sparkie. Ask Sparkie is an AI assistant on our website. It answers questions about SparkLayer, can show SparkLayer running on a store address you give it, and can pass your questions to our team. Its answers are generated automatically and may contain mistakes; the prices and terms on our pricing page and in our Terms of Service apply. Please don't share sensitive personal data with it.
Your conversation is kept in your own browser while you use our website (in session storage, cleared when you close the tab), and what Ask Sparkie has learned about your business is kept in your browser's local storage so it's there when you return. You can clear it at any time with "Clear my brief" or through your browser's settings. It reaches us only when you choose: when you save your plan, message our team, book a call or ask for a call back, your conversation and what Ask Sparkie has learned are sent to our CRM (HubSpot) with the details you gave. If you book a call, your name, email address and the time you choose are sent to HubSpot's meetings tool to make the booking and send you an invitation. A plan you share with your team travels in the link itself; we don't store it.
Some of Ask Sparkie's answers may be generated by an AI model provided by Anthropic. When they are, your question and the recent conversation are sent to our Ask Sparkie service, hosted on Google Cloud in London, and on to Anthropic to generate the reply. Anthropic acts as our service provider and processes this data to provide that service to us. We keep a short log of the questions Ask Sparkie couldn't answer, with email addresses and phone numbers removed, so we can improve the information on our website.
Ask Sparkie. Ask Sparkie is an AI assistant on our website. It answers questions about SparkLayer, can show SparkLayer running on a store address you give it, and can pass your questions to our team. Its answers are generated automatically and may contain mistakes; the prices and terms on our pricing page and in our Terms of Service apply. Please don't share sensitive personal data with it.
Your conversation is kept in your own browser while you use our website (in session storage, cleared when you close the tab), and what Ask Sparkie has learned about your business is kept in your browser's local storage so it's there when you return. You can clear it at any time with "Clear my brief" or through your browser's settings. It reaches us only when you choose: when you save your plan, message our team, book a call or ask for a call back, your conversation and what Ask Sparkie has learned are sent to our CRM (HubSpot) with the details you gave. If you book a call, your name, email address and the time you choose are sent to HubSpot's meetings tool to make the booking and send you an invitation. A plan you share with your team travels in the link itself; we don't store it.
Some of Ask Sparkie's answers may be generated by an AI model provided by Anthropic. When they are, your question and the recent conversation are sent to our Ask Sparkie service, hosted on Google Cloud in London, and on to Anthropic to generate the reply. Anthropic acts as our service provider and processes this data to provide that service to us. We keep a short log of the questions Ask Sparkie couldn't answer, with email addresses and phone numbers removed, so we can improve the information on our website.
5. How we collect it
- Directly from you - when you sign up, complete a form on our website (for example to book a demo, download a guide or subscribe to updates), try our interactive demo, chat with Ask Sparkie, contact support or sales, or send us feedback through Give feedback while taking part in a product beta.
- Automatically - through cookies, logs and analytics (section 14).
- From third parties - including the ecommerce platform your store runs on when you install our app, and our billing and CRM providers.
6. Why we process it, and our legal bases
| Purpose | Legal basis |
|---|---|
| Provide, operate and secure the service | Performance of a contract |
| Authenticate users and prevent abuse | Legitimate interests (security) |
| Bill and take payment | Contract / legal obligation |
| Provide support | Contract / legitimate interests |
| Respond to an enquiry or demo request made through our website | Legitimate interests / steps taken at your request before a contract |
| Answer your questions in Ask Sparkie, and pass your conversation and plan to our team, book a call or call you back when you ask us to | Legitimate interests / steps taken at your request before a contract |
| Improve and develop the product and our website | Legitimate interests |
| Let an AI app that you connect read and change your SparkLayer data, when you ask it to | Performance of a contract |
| Investigate, respond to and act on product feedback from beta participants | Legitimate interests (improving the product and fixing problems) |
| Contact you about feedback you sent | Consent (the "You can contact me about this" option). You can withdraw it at any time |
| Send service and transactional messages | Performance of a contract |
| Send marketing where permitted | Consent, or soft opt-in for existing customers |
| Meet legal obligations (tax, accounting) | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for details of that assessment.
We will only use your personal data for the purposes we collected it for, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so.
7. Data we process on behalf of merchants
To provide the service we process personal data belonging to your customers, accessed through the ecommerce platform your store runs on. The fields we process are:
| Field | What it covers |
|---|---|
| Name | First and last name |
| Email address | |
| Phone | Default and billing phone numbers |
| Address | Shipping and billing addresses |
Depending on the ecommerce platform and the features a merchant enables, we may also process customer, company and order information made available through that platform's APIs where it is necessary to provide the configured SparkLayer functionality. On Shopify, the fields above are approved under Shopify's protected customer data requirements.
We process this information only on the merchant's instructions and for the purposes of providing the service - including linking a customer to their customer-specific pricing, creating and managing their orders, enabling your sales agents to search for and view customers on your behalf, and providing customer service. We do not sell Customer Personal Data or use it to build advertising or marketing profiles for our own purposes.
Our Data Processing Agreement sets out our contractual obligations as your processor (see section 21).
7A. Feedback from beta participants
If your business takes part in a SparkLayer product beta (agreed by email with one of our product representatives), the people using it can send us feedback from inside the product with Give feedback. It is only available during a beta, and nothing is sent unless you choose to send it. With your message we receive the page you were on and technical details about your browser and device, which help us reproduce problems. We store your feedback in our issue tracker (Linear) and delete it within three months. We don't use AI on your feedback. We include your email only if you agree to be contacted. Please avoid including your customers' personal data in feedback unless it's needed to explain the problem.
7B. AI apps you connect to SparkLayer
You can connect an AI app, such as ChatGPT or Claude, to your SparkLayer account through our MCP server at mcp.sparklayer.io. To connect an app, you sign in to SparkLayer and choose the sites it can use and, for each site, whether it uses live or test data. The app can then use SparkLayer's tools to read and change the data of those sites when you ask it to.
What the app receives. When the app uses a tool, we send the result to the app. Depending on the tools it uses, this can include:
- your name and email address, the names, email addresses and roles of your team members, and the email addresses of people you have invited;
- your store settings and plan, and the names and client IDs of your API keys (never their secrets);
- your customers' names, email addresses, phone numbers and addresses, their companies, customer groups and roles, and their account details such as credit limits, balances, payment terms and tax status;
- your orders, quotes and carts, with their totals, statuses, purchase order numbers, references and addresses;
- your products, stock levels, price lists, prices, discounts and coupon codes, shipping methods, quote statuses and storefront theme files.
When you ask the app to make a change, it sends the change to us and we apply it to your site. We receive only the tool requests the app sends, not your conversation with it.
Who receives it. The app, and the company that provides it (for example OpenAI for ChatGPT, or Anthropic for Claude), receives the data the tools return. You choose the app, so its provider is not our sub-processor: its terms and privacy policy, and your agreement with it, govern what it does with the data. Where the data includes your customers' personal data, you are the controller and you decide to share it with the app, so please check that you can before you connect one.
Records we keep. For each connection we keep the app's registration (the name it gives itself and the addresses it returns you to), the sites you allowed it to use with live or test data, when you allowed them, and the tokens it uses. Access tokens last one hour and refresh tokens one month. A daily clean-up deletes tokens once they are revoked or replaced, and at the latest 7 days after the refresh token expires. Our servers log each request, as for the rest of the service. If an error happens while the app uses a tool, details of the request, which can include the data the app sent, may be sent to Sentry, our error-monitoring provider (section 8).
Disconnecting an app. In the SparkLayer dashboard, click your name at the foot of the sidebar, then Connections, and choose Disconnect next to the app. This removes its access to your sites and revokes its tokens at once. Changing or resetting your password disconnects every app. Removing SparkLayer inside the AI app stops that app from using it, but disconnect it in SparkLayer too to revoke its access on our side.
8. Service providers and sub-processors
We use third-party service providers to operate SparkLayer and our business. The role a provider performs depends on the data involved.
Sub-processors of Customer Personal Data. Where a third party processes Customer Personal Data on our behalf in order to provide the SparkLayer service, it is a sub-processor and is subject to the terms of our Data Processing Agreement. We carry out due diligence on each, bind them by contract to appropriate data protection terms, keep the list current and notify account holders of material changes.
Other service providers. We also use providers to operate our own website, sales, marketing, billing and business systems - our CRM, analytics, cookie-management and billing tools. In those cases SparkLayer generally acts as controller for the relevant personal data; the cookies and analytics among them are described in section 14.
Our current sub-processors of Customer Personal Data are:
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google Cloud | Hosting and storage | UK - europe-west2 (London) | - |
| Amazon Web Services | Transactional email and DNS | EU / US | SCCs / UK IDTA |
| Stripe | Billing and payments | US / EU | SCCs / UK IDTA |
| HubSpot | CRM | US | SCCs / UK IDTA |
| Intercom | Customer support | US / EU | SCCs / UK IDTA |
| Linear | Issue tracking for feedback sent by Customers taking part in a product beta | US | SCCs / UK IDTA |
| Sentry | Error monitoring, including details of the request that caused an error | US | SCCs / UK IDTA |
The other providers we use, where SparkLayer is the controller of the data involved, are:
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| HubSpot | Sales CRM, website forms, meeting booking, marketing email, and the Ask Sparkie conversations you send to our team | US | SCCs / UK IDTA |
| Anthropic | Generates some of Ask Sparkie's answers | US | SCCs / UK IDTA |
| Google Cloud | Runs the Ask Sparkie service | UK - europe-west2 (London) | - |
| Intercom | Website chat | US / EU | SCCs / UK IDTA |
| Google Analytics | Website and product usage analytics | US | SCCs / UK IDTA |
| Microsoft Clarity | Website usage analytics | US / EU | SCCs / UK IDTA |
| Cookiebot | Cookie consent management | EU | - |
| Linear | Issue tracking for beta feedback | US | SCCs / UK IDTA |
The ecommerce platform your store runs on (e.g. Shopify) is the source of the customer data we process on your behalf, under your own agreement with that platform.
9. International transfers
Where personal data is transferred outside the UK / EEA, we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or an adequacy decision, with supplementary safeguards where required. You can request details of the safeguards in place.
10. How we keep data secure
Our production database runs on Google Cloud in the europe-west2 (London) region, in the United Kingdom. We protect personal data with technical and organisational measures including encryption in transit and at rest, least-privilege access, multi-factor authentication, logging and monitoring, and prompt access revocation when people leave. Full detail is in our security policy.
No transmission of data over the internet can be guaranteed to be completely secure. If you believe that your interaction with us is no longer secure, please contact us.
11. Your rights
Under the UK GDPR you have the right to be informed; to access your data; to have inaccurate data corrected; to erasure; to restrict processing; to data portability; to object (including to direct marketing); and not to be subject to solely automated decisions with significant effects. Where we rely on consent, you may withdraw it at any time.
To exercise any right, email contact@sparklayer.io. We will respond within the statutory period - normally one month, extendable by two further months for complex requests, which we will tell you about. We may need to verify your identity before acting on a request. You will not have to pay a fee to exercise your rights, though we may refuse a request that is clearly unfounded or excessive.
If you are in California, you may also ask us for a notice identifying the categories of personal information we share with third parties for their direct marketing purposes. We do not share personal information for that purpose.
12. Rights over data we process for merchants
If you are a customer of one of our merchants and wish to exercise rights over data we hold as a processor, please contact that merchant, who is the controller. If you contact us, we will forward your request to them and assist them in responding.
13. How long we keep it
We keep personal data only as long as we need it. For account data, that means for the life of your account and for a limited period afterwards. For personal data we process on a merchant's behalf, we retain it while the merchant uses the service, and delete or return it on their instruction and after they uninstall our app. Where the law requires us to keep records - for example billing and tax records - we keep them for the period the law specifies. We may keep data for longer where a complaint has been made or we reasonably believe there is a prospect of a legal claim. Feedback sent through Give feedback during a beta is deleted within three months of receipt, or sooner on request. The record of an AI app you connect is kept until you disconnect it, and its tokens are deleted as section 7B describes. You can ask us what applies to your data at any time.
An Ask Sparkie conversation stays in your browser unless you send it to us. Once you do, we keep it with our other sales records for as long as we have a business relationship with you or a legitimate interest in staying in touch, and delete it on request. We keep the log of unanswered questions for a limited period.
14. Cookies and analytics
We use strictly necessary cookies to run this website and the service and, with your consent, analytics cookies to understand how our website and product are used. We manage cookie consent through Cookiebot - you can review or change your choices at any time through the cookie banner, and through your browser settings.
On this website, with your consent, we use Google Analytics (through Google Tag Manager) and Microsoft Clarity for usage analytics, and HubSpot and Intercom set cookies that let us recognise you when you complete a form or start a chat with us.
Ask Sparkie keeps your conversation and what it has learned in your browser's session and local storage (section 4), which it needs to work; it doesn't use them to track you across websites.
15. Marketing
We send marketing only with your consent, or on a soft opt-in basis to existing customers for similar products. Every marketing email carries an unsubscribe link, and you can opt out at any time by emailing contact@sparklayer.io. Where you opt out of marketing, we will continue to hold other personal data provided to us through interactions not related to your marketing preferences.
16. Automated decision-making
We do not make decisions producing legal or similarly significant effects based solely on automated processing. Ask Sparkie may suggest a SparkLayer plan from what you tell it; that is a suggestion only, and our team is happy to talk it through.
17. Children's data
The service and this website are aimed at businesses and are not directed at children. We do not knowingly collect the personal data of children.
18. Data breaches
If a breach affects personal data, we follow our incident management policy. Where we are the controller and the breach is likely to risk individuals' rights, we notify the ICO within 72 hours where required, and affected individuals without undue delay where the risk is high. Where we are a processor, we notify the affected merchant without undue delay, as set out in our Data Processing Agreement.
19. Sharing your data, and third-party links
We share personal data with the sub-processors in section 8, with professional advisers where necessary, and where required by law or to enforce our terms or this policy. If SparkLayer is involved in a merger, acquisition or sale of all or part of its business or assets, personal data may be transferred as part of that transaction; we will tell you before your data becomes subject to a different privacy policy.
Our website and apps may link to third-party websites, plug-ins and applications that we do not control. This policy does not cover them; please read their own privacy notices.
20. Changes to this policy
We version this policy and show the effective date above. We notify account holders of material changes. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.
21. Data processing terms
Where we process personal data on your behalf as your processor (section 3), the terms on which we do so are set out in our Data Processing Agreement, which forms part of the agreement between us and is intended to satisfy Article 28(3) of the UK GDPR and the EU GDPR. It covers the subject matter and duration of the processing, our obligations as your processor, sub-processors, international transfers, personal data breaches, and your obligations as controller.
22. Contact and complaints
Spark Layer Ltd, Trimbridge House, First Floor, Trim Street, Bath, BA1 1HB, United Kingdom.
contact@sparklayer.io
ICO registration ZB074246.
You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would appreciate the chance to resolve your concern first.
Please also see our Terms of Service, which set out the terms governing your use of SparkLayer.
