Snapshot 43746
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Hello. I am Mr. Axios Interceptor Injector >:)
Sparkgrid Software Privacy Policy
Effective Date: March 17, 2026
Last Updated: March 17, 2026
Introduction
Your privacy is important to us. This Privacy Policy explains how Sparkgrid Software ("we," "us," or "our") collects, uses, stores, and discloses personal information in connection with our website at https://www.boxconnector.sparkgridsoftware.com/ and our Box Connector software-as-a-service platform (collectively, the "Service").
Box Connector is a SaaS integration product that connects a customer's HubSpot and Box accounts. The Service accesses data in your HubSpot and Box accounts only as necessary to perform the integration functions you configure.
If our site or Service contains links to third-party sites or services, please be aware that those sites and services have their own privacy policies. This Privacy Policy does not apply to your activities on those third-party sites.
Information We Collect
Account Information
When you register for an account, we collect your first name, last name, and email address. We may also collect your postal code and country code. A Stripe customer ID is created and stored when you register to facilitate subscription billing.
Authentication Credentials
If you register with an email and password, we store a securely hashed version of your password. We never store plaintext passwords. If you register or log in via Google, we store your Google account identifier to link your account. The Service also stores OAuth access tokens and refresh tokens for your connected HubSpot and Box accounts to maintain the integration. These tokens are stored encrypted at rest and are used solely to authenticate API requests on your behalf.
HubSpot Data
When you connect your HubSpot account to Box Connector, the Service stores information about the HubSpot portal connection and the HubSpot users within it. This includes the portal ID, portal domain, the connecting administrator's email address and HubSpot user ID, and for each HubSpot user who accesses the Service: their HubSpot user ID, full name, email address, permissions, and seat assignment status. This data is necessary for user authentication, seat management, and integration configuration.
Box Connector also accesses your HubSpot CRM data (such as contacts, companies, deals, and tickets) via the HubSpot API at runtime in order to perform the integration functions you have configured. This CRM data is processed in transit and is not stored in our database.
Box Data
When you connect your Box account to Box Connector, the Service stores information about the Box user connection, including the Box user ID, email address, full name, enterprise ID, enterprise name, and user role. This data is necessary for authentication and managing the integration connection.
The Service also stores integration configuration data such as Box Sign template field mappings, file request template references (including Box folder IDs and file request URLs), and pinned folder type settings. This is configuration data you create within Box Connector, not a copy of your Box content.
Box Connector accesses your Box files, folders, and metadata via the Box API at runtime in order to perform the integration functions you have configured. SparkGrid does not store copies of your Box files, folder structures, or document content in our database.
Billing and Subscription Data
Subscription and invoice data is stored in our database, including subscription status, plan details, billing period, and invoice records with Stripe invoice IDs. Your payment information (such as credit card details) is collected and processed directly by our third-party payment processor, Stripe. We do not collect or store full credit card numbers. We store a Stripe customer ID to link your account to your Stripe billing record.
Log Data
When you visit our website or use the Service, our servers may automatically log standard data provided by your browser or device. This may include your IP address, browser type and version, pages visited, date and time of your visit, and error information. This data is used for operational and security purposes.
Cookies and Tracking Technologies
We use cookies and similar tracking technologies on the Service. Cookie consent is managed through GetTerms.io, which presents a consent banner when you first visit the site. You may manage your cookie preferences through this banner or through your browser settings.
The following third-party analytics and tracking services are active on the Service:
Google Analytics: Collects anonymized usage data such as pages visited, session duration, device and browser information, and general geographic location. This data helps us understand how the Service is used and identify areas for improvement.
HubSpot Tracking Code: Places cookies to track page visits and browsing activity on the Service. This data may be associated with your contact record if you have interacted with us through HubSpot (for example, via a chat widget or form submission).
Vector: A business-to-business visitor identification service that uses IP addresses to identify the companies visiting the Service. Vector resolves visitor IP addresses to company-level information (such as company name and industry) for sales and marketing purposes. Vector does not identify individual users by name.
You may opt out of non-essential cookies through the cookie consent banner or by adjusting your browser settings. Please refer to our Cookie Policy for more information.
Usage and Analytics Data
We collect usage and analytics data related to your use of the Service, such as feature usage, integration activity, and performance metrics. This data is used for service optimization, technical support, and security monitoring.
How We Use Your Information
We use the information we collect for the following purposes:
To provide, operate, and maintain the Service, including the HubSpot-to-Box integration and file management and e-signature workflows
To process transactions and manage your subscription
To communicate with you about your account, support requests, and service updates
To provide technical support and optimize the Service
To monitor and improve the security, performance, and reliability of the Service
To comply with legal obligations and resolve disputes
For internal record keeping and administrative purposes
We do not sell your personal information. We do not use your personal information for advertising or marketing purposes beyond communicating with you about our own Service, unless you have opted in to receive such communications.
Security of Your Personal Information
We protect your personal information using commercially reasonable technical and organizational measures, including:
Encryption in transit using TLS/HTTPS for all data transmissions
Encryption at rest provided by our infrastructure providers (Heroku, Supabase)
Row-level security on database tables to isolate customer data
Individual user authentication and role-based access controls across all systems
Multi-factor authentication (MFA) required on all systems that support it
Automated vulnerability scanning and dependency monitoring (GitHub Dependabot, CodeQL)
Application logging with 365-day retention for security monitoring and audit
Regular security reviews and defined incident response procedures
Our application is hosted on Heroku with a Supabase PostgreSQL database and Redis Cloud for ephemeral caching. No shared accounts or credentials are used across any systems.
No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
How Long We Keep Your Personal Information
We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law. Processing continues for the duration of your service agreement and for a reasonable period thereafter as required for legal compliance.
If you terminate your account or request deletion, we will delete or anonymize your personal information as directed. Data in backup systems will be deleted in accordance with standard backup retention cycles, not to exceed 90 days after the primary deletion request. Where retention is required for legal, accounting, or compliance purposes, we will retain only the minimum information necessary and notify you.
Disclosure of Personal Information to Third Parties
We may disclose personal information to:
Third-party service providers who help us deliver the Service, including Box (file storage integration), HubSpot (CRM integration and website tracking), Heroku (application hosting), Supabase (database), Redis Cloud (caching), and Stripe (payment processing)
Analytics and visitor identification providers, including Google Analytics (website analytics), Vector (B2B visitor identification via IP address), and GetTerms.io (cookie consent management)
Professional advisors, including legal counsel and auditors
Law enforcement, regulators, or courts as required by law or in connection with legal proceedings
An entity that acquires all or substantially all of our assets or business
All sub-processors are subject to contractual data protection obligations, regular security and compliance assessments, and appropriate technical and organizational security measures. We remain fully responsible for our sub-processors' compliance with data protection obligations.
A Data Processing Agreement (DPA) is available for customers who require one. Please contact us at support@sparkgridsoftware.com to request a copy.
Children's Privacy
The Service is not directed at children under the age of 13 (or 16 in jurisdictions where applicable), and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information.
International Transfers of Personal Information
The personal information we collect is stored and processed in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. We will take appropriate steps to ensure that transfers of personal information are in accordance with applicable law and are adequately protected.
Business Transfers
If Sparkgrid Software or its assets are acquired, or in the unlikely event that we go out of business, your personal information may be transferred to the acquiring entity. You acknowledge that such transfers may occur, and that the acquiring entity will be bound by this Privacy Policy.
Your Rights and Controlling Your Personal Information
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:
Access: You may request a copy of the personal information we hold about you.
Correction: You may request that we correct inaccurate or incomplete personal information.
Deletion: You may request that we delete your personal information, subject to legal retention requirements.
Restriction: You may request that we restrict the processing of your personal information in certain circumstances.
Portability: Where applicable, you may request your personal information in a machine-readable format.
Objection: You may object to the processing of your personal information where we rely on legitimate interests.
Withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
How to Exercise Your Rights
To exercise any of the rights described above, including requests for access, correction, deletion, or data portability, please submit your request by email to:
support@sparkgridsoftware.com
Please include "Data Request" in the subject line and provide sufficient information for us to verify your identity and process your request. We will respond to verified requests within 30 days (or within the timeframe required by applicable law). If we need additional time, we will notify you of the reason and expected timeline.
To unsubscribe from marketing communications, use the unsubscribe link in any marketing email or contact us at the address above.
We will not discriminate against you for exercising any of your privacy rights.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or applicable laws. If we make material changes, we will notify you by posting the updated policy on our website and, where required by law, by email. We encourage you to review this Privacy Policy periodically.
Additional Disclosures for Australian Privacy Act Compliance
This section applies to individuals whose personal information is subject to the Australian Privacy Act 1988.
Some third-party service providers we use may not be regulated by the Privacy Act or the Australian Privacy Principles. If such a third party engages in conduct that contravenes the Australian Privacy Principles, it may not be accountable under the Privacy Act, and you may not be able to seek redress under the Privacy Act.
To make a complaint regarding our handling of your personal information, please contact us using the details in the Contact Us section. You also have the right to contact the Office of the Australian Information Commissioner (OAIC).
Additional Disclosures for GDPR Compliance (EU)
Data Controller
Sparkgrid Software is the Data Controller with respect to the personal information you provide to us. Our contact details are provided in the Contact Us section of this Privacy Policy.
Legal Bases for Processing
We process your personal information only where we have a lawful basis to do so. Our lawful bases include:
Consent: Where you have given consent for a specific purpose. You may withdraw consent at any time by contacting us.
Performance of a Contract: Where processing is necessary to fulfill a contract with you, such as providing the Service.
Legitimate Interests: Where processing is necessary for our legitimate interests (such as operating and improving the Service), provided those interests are not overridden by your rights.
Legal Obligation: Where we are required to process your information to comply with applicable law.
International Transfers Outside the EEA
Where we transfer personal information from the EEA to countries outside the EEA (including the United States), we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or other legally accepted mechanisms.
Your GDPR Rights
In addition to the rights described above, EU residents have the right to lodge a complaint with their local data protection authority. We encourage you to contact us first so we can address your concerns. To exercise any rights, email support@sparkgridsoftware.com with "Data Request" in the subject line.
If your personal information is no longer required for the purposes for which it was collected, or if you exercise your right to erasure, we will delete or anonymize it upon your verified request. Data in backup systems will be deleted within 90 days of the primary deletion request, unless retention is required by law.
Additional Disclosures for UK GDPR Compliance
Data Controller
For the purposes of the UK General Data Protection Regulation, Sparkgrid Software is the Data Controller with respect to the personal information you provide to us.
Legal Bases for Processing
Our lawful bases for processing are the same as described in the EU GDPR section above: consent, performance of a contract, legitimate interests, and compliance with law. We do not directly market to individuals under 18 years of age.
International Transfers
The personal information we collect may be transferred to and processed in the United States. We perform such transfers in accordance with UK GDPR (Article 45) and the Data Protection Act 2018, using appropriate safeguards such as Standard Contractual Clauses.
Your UK Data Subject Rights
UK residents have the rights described in the Your Rights section above, including the right to access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk
We encourage you to contact us first so we can address your concerns. Data Subject Access Requests will be fulfilled within 30 calendar days of receipt.
Additional Disclosures for U.S. State Privacy Laws
This section applies to residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia, where applicable state privacy laws provide additional rights.
Categories of Personal Information Collected
In the past 12 months, we have collected the following categories of personal information:
Identifiers (name, email address, IP address, account ID, HubSpot user ID, Box user ID, Stripe customer ID)
Commercial information (subscription status, plan details, invoice history)
Internet or electronic network activity (log data, browser type, pages visited, feature usage)
We do not sell personal information. We do not use or disclose sensitive personal information for purposes other than providing the Service.
Do Not Track
Some browsers have a "Do Not Track" feature. At this time, we do not respond to Do Not Track signals.
Your Rights Under State Privacy Laws
Depending on your state of residence, you may have the right to request access to, correction of, or deletion of your personal information, as well as the right to opt out of the sale of personal information (we do not sell personal information) and the right to non-discrimination for exercising your rights.
To exercise your rights, email support@sparkgridsoftware.com with "Data Request" in the subject line. California residents: You may also submit a request with the subject line "Request for California Privacy Information." We will respond within the timeframe required by applicable law.
California "Shine the Light"
Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.
Additional Disclosures for PIPEDA Compliance (Canada)
This section applies to individuals whose personal information is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA).
Scope of Personal Information
Under PIPEDA, personal information includes any information about an identifiable individual. References to "personal information" and "Personally Identifying Information" (PII) in this policy are equivalent.
Consent
We collect and use your personal information with your consent. Consent is obtained when you register for the Service, and you may withdraw consent at any time by contacting us. Withdrawal of consent may affect our ability to provide the Service. You cannot withdraw consent where collection is required by law, to fulfill a contract, or as required by a regulator.
International Transfers
While Sparkgrid Software endeavors to keep customer data within its hosting infrastructure, we use service providers located in the United States. We use reasonable efforts to ensure that personal information transferred outside Canada receives an equivalent level of protection.
Right of Access
Under PIPEDA, you have the right to access the personal information we hold about you. To make an access request, email support@sparkgridsoftware.com with "Data Request" in the subject line. We will respond within 30 days of receipt.
Right of Rectification
You may request correction of inaccurate or incomplete personal information. If we cannot agree on a correction, you have the right to have your concerns recorded with the Office of the Privacy Commissioner of Canada.
PIPEDA's Ten Principles of Privacy
This Privacy Policy complies with PIPEDA's ten principles of privacy: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance. For details on how we apply each principle, please contact us.
Complaints
If we fail to resolve your privacy concern, you may contact the Office of the Privacy Commissioner of Canada:
30 Victoria Street, Gatineau, QC K1A 1H3
Toll Free: 1-800-282-1376
Website: www.priv.gc.ca
Anti-Spam Compliance
Our email communications comply with Canadian Anti-Spam Legislation (CASL). We do not send unsolicited commercial electronic messages to individuals with whom we have no existing relationship, and we do not sell personal information such as email addresses to third parties.
Contact Us
For any questions or concerns regarding this Privacy Policy, or to exercise your data rights, please contact us:
Chris Eustace
Sparkgrid Software
Email: support@sparkgridsoftware.com
Please include "Data Request" in the subject line for all data rights requests.