Privacy notice

Notice version: 2026-09-04

Who this notice covers

This notice applies when you visit pvspark.com, submit a demonstration or contact request, access the PVspark web application, or communicate with us about the service. In this notice, “PVspark”, “we”, and “us” mean the operator of those services. You can contact the privacy team at privacy@pvspark.com.

PVspark determines how marketing, account, security, support, and service-administration data is used. When a customer organization uses PVspark for its own projects, that organization decides why its customer and project data is processed, and PVspark handles that data for the organization under its instructions and applicable agreement.

Personal data we collect

We collect personal data from you, your organization, your browser or device, and service providers that support the service. Depending on how you interact with PVspark, this may include:

• Enquiry and demonstration data: name, work email, company, role, service region, phone number if supplied, preferred contact method, workflow information, free-text answers, and your consent choices.
• Account and organization data: name, work email, identity-provider subject, organization, role, invitations, membership, account status, and authentication or recovery events.
• Customer and project data: project contacts, site and survey information, designs, equipment, energy and tariff inputs, pricing, documents, comments, approvals, and audit history entered by authorized users.
• Website and device data: page paths, landing page, referring site, campaign parameters, browser and device information, approximate location derived from network information, consent state, and security or diagnostic events.
• Communications: messages, support requests, delivery status, and records needed to respond or maintain an auditable service history.

Please do not place passwords, identity documents, payment-card details, health information, or other unnecessary sensitive data in public forms or free-text fields.

Why we use personal data

We use the data listed above to respond to requests; arrange demonstrations and onboarding; provide, secure, support, and improve PVspark; administer accounts and organizations; deliver requested communications; prevent abuse; maintain records; meet legal obligations; and establish, exercise, or defend legal claims.

Optional analytics and optional marketing updates depend on your choice. You can refuse or withdraw either without losing access to the public website, forms, or sign-in. Other processing is used when needed to take requested steps, provide the service, protect users and the platform, meet legal duties, or pursue a legitimate service purpose permitted by applicable law.

Marketing leads remain separate from customer project records until an authorized operator deliberately qualifies or converts them. Submitting a public form does not create product access automatically. PVspark does not sell personal data, use it for third-party advertising, or make solely automated decisions from public-form or analytics data that produce legal or similarly significant effects.

Service providers and transfers

The current system uses AWS in Mumbai for the application, lead database, object storage, logs, backups, and monitoring; Cloudflare for authoritative DNS; Google Workspace for human-operated company mail; and Google Analytics only after optional analytics consent. CloudFront and other provider networks may use distributed infrastructure to deliver the service.

Resend sends account verification, password recovery, invitation, and limited operational messages from notify.pvspark.com. Transactional delivery necessarily gives Resend the sender, recipient, message content, and delivery metadata. Resend states that it processes data in the United States, and the current service configuration exposes 30 days of email history. PVspark minimizes those messages and does not place project designs, financial records, identity documents, or unnecessary customer data in them.

PVspark’s signed delivery webhook stores only the provider event identifier, event type, provider email identifier, and timestamps. It does not store the recipient address, subject, body, headers, or links from webhook payloads. Amazon SES remains configured but inactive as a reviewed rollback path and does not send PVspark application mail while Resend is active.

Additional providers may process limited data when an organization enables a product feature, such as mapping, solar-data, guided-assistance, billing, or customer-selected integrations. The relevant product screen, order form, or customer agreement describes any feature-specific terms. Personal data may be processed outside your state or country where a provider operates, subject to applicable transfer restrictions and appropriate contractual, organizational, and technical safeguards.

We may also disclose information when required by law; to protect people, the service, or legal rights; in connection with a business reorganization; or with your direction or consent. We do not permit providers to use customer data for their own advertising.

Optional analytics

Google Analytics loads only after the visitor accepts optional analytics. PVspark sends an allowlisted set of aggregate page, navigation, article, CTA, and form-funnel events. It does not send names, email addresses, phone numbers, company names, invitation tokens, lead references, free-form answers, or sensitive URL parameters. The current GA4 event and user retention settings are two months. Advertising signals, advertising pixels, and session replay are disabled on the marketing website.

See the cookies and storage notice for the browser storage involved and how to change your choice.

Retention

We keep personal data only for as long as needed for the purpose described above. The period depends on the type of record, whether an account or customer relationship remains active, contractual and legal requirements, security and dispute needs, and technically bounded backup or object-lifecycle periods. We delete, anonymize, or restrict data when it is no longer needed.

Operational messages currently remain visible in Resend for 30 days, and the GA4 event and user retention setting is two months. Account, project, audit, financial, security, suppression, and backup records can require different periods. A privacy-erasure request removes or pseudonymizes eligible data, but we may retain limited records where necessary to comply with law, preserve security and audit integrity, prevent a suppressed address from being re-added to marketing, or resolve claims.

Security

PVspark uses role-based access, tenant boundaries, encryption, guarded object access, audit history, backups, monitoring, and provider controls appropriate to the data and service. No internet service can be guaranteed risk-free. If you believe your data or account may be at risk, contact security@pvspark.com.

Your choices and rights

Depending on applicable law, you may ask for a summary of personal data and processing, correction or completion, erasure, withdrawal of consent, marketing suppression, or information about service providers and grievance routes. You may also nominate another person to exercise rights where the law provides that option.

Send a request or grievance to privacy@pvspark.com and describe what you need. We may verify your identity and authority before disclosing or changing account or organization information. Withdrawing consent does not affect processing already carried out, and some data may remain where another lawful requirement applies. If we do not resolve a privacy grievance, you may use any complaint route available through the Data Protection Board of India or another competent authority when that route applies.

Children

PVspark is a business service for solar professionals and is not directed to anyone under 18. Do not submit a child’s personal data unless your organization has a lawful, documented reason and all permissions required by applicable law.

Changes to this notice

We may update this notice as the service, providers, or law changes. We will publish the revised version and effective date here and provide additional notice when a change materially affects your choices or is otherwise required.