How we protect your financial data

What you send us and why

To build your 13-week cash flow model, we need five types of financial data from you: your current bank balance, your open invoices (AR aging from QB/Xero), your unpaid bills (AP from QB/Xero), your payroll schedule, and any known one-off cash items. This is the minimum required to build an accurate model. We do not request QuickBooks or Xero login credentials — we work from CSV exports only.

How data is transmitted to us

All data in transit between your browser and our site is encrypted over TLS 1.2 or higher (HTTPS). Our site does not accept unencrypted HTTP connections.

When you send intake data via email, it travels over TLS-encrypted SMTP. We do not request data through unsecured channels (SMS, plain HTTP links, or consumer file sharing services).

Where your data lives during delivery

Your financial data lives in one place during delivery: a Google Sheet in a restricted Google Drive folder accessible only to the operator performing your Sprint. Google Workspace encrypts data at rest using AES-256 and in transit using TLS. It holds ISO 27001 certification and SOC 2 attestation.

Your QB/Xero CSV exports are downloaded, used to populate the model, and held temporarily in the same restricted folder. They are not copied to any other system, emailed to other addresses, or stored anywhere else.

Lead and contact data (your name, email, company) is stored in Supabase — a SOC 2 Type II certified database platform with encryption at rest and in transit.

Who can access your data

Your Sprint delivery data is accessible only to the single operator assigned to your engagement. Access is not shared with other team members, contractors, or systems. The operator on Sprint A does not have access to Sprint B's client data.

No one at Spark Cashflow has standing access to your financial data outside of active delivery. After delivery, access to Spark's working copy is revoked and the copy is deleted within 30 days.

The AI question — answered directly

Your QuickBooks or Xero data never touches an AI system. Full stop.

The only data that passes through an AI (Anthropic's Claude API) is the five categorical answers from the diagnostic quiz on our homepage — things like “what revenue model do you use” and “how often are you surprised by cash shortfalls.” Those answers contain no company name, no financial figures, and no identifying information. They are range and category selections.

Your actual financial data — bank balances, client invoice amounts, vendor payments, payroll figures — is processed manually inside Google Sheets. It is never sent to Claude, ChatGPT, or any other AI system.

What happens to your delivery model after Sprint

The Google Sheets model we deliver is shared directly to your Google account. You own that copy and we have no access to it. It lives in your Google Drive.

Spark's working copy of your model — the one we built during delivery — is deleted from our Google Drive within 30 days of delivery confirmation. Your QB/Xero CSV exports and payroll data are deleted from all of our storage at the same time.

The Loom walkthrough video we record for your delivery is deleted from Spark's Loom workspace within 90 days. The link we send you continues to work until it is deleted.

Deletion schedule

You can request earlier deletion at any time by emailing hello@sparkcashflow.com. We will confirm deletion within 2 business days.

Infrastructure certifications

If something goes wrong

If we discover or suspect unauthorized access to your data, we will notify you at the email address you provided within 72 hours of discovery. We will tell you what data was involved, what we believe happened, and what we have done to contain it.

Questions and concerns

If you have a question about how your data is handled, or want to report a concern: hello@sparkcashflow.com

For the full legal detail on data collection, processing, and your rights, see our Privacy Policy.