SPARTATerms of Service

Legal

Privacy Policy

Effective May 13, 2026

Overview

SPARTA is an advisor-only travel intelligence platform operated by [Legal Entity Name] ("SPARTA," "we," "us"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to advisors who use the SPARTA application and to data we process on their behalf.

SPARTA is not a consumer product. We do not knowingly collect data from anyone who is not an authorized advisor on the platform.

Information we collect

Account information

When you sign in, we collect your email address, name, and profile photo from your Google account. We store these to identify you and your workspace.

Workspace and client data you upload

We process travel itineraries, attachments, and structured client information you choose to upload or import. This content is private to your advisor workspace and is never accessed by other workspaces.

Information from Google APIs

If you connect a Gmail account, we use the gmail.readonly scope to read messages from your Sent folder. We extract the stylistic signal (tone, cadence, signature phrasing) needed to train a private voice persona that drafts client emails in your voice.

The same scope also powers the in-app inbox, which reads your mail live from Google each time you open it. Messages you simply read there are not stored.

Linking a correspondent to a client is different. When you link an email address to one of your clients, we fetch the messages exchanged with that address — going back about two years — and store them: subject lines and message bodies, plus a record of the PDFs attached to them. We analyse that correspondence to build the client's travel profile. This happens per address you link, and only after you link it. It is not a blanket read of your mailbox: mail from an address you have not linked to a client is read live and nothing about it is kept.

Stored message content is encrypted at rest and cannot be read from inside SPARTA by any signed-in account — not by you, not by another advisor, not by an administrator. The application has no screen that displays it. What surfaces on the client's profile is only the preferences we extract from it, such as a stated preference for a particular airline or a dislike of long connections.

Information from Intuit QuickBooks

If an administrator of your workspace connects QuickBooks Online, we use the com.intuit.quickbooks.accounting scope to read invoices and the customers they are billed to. SPARTA only reads: it never creates, edits, or deletes anything in QuickBooks.

We store fee invoices, and the name, email address, and phone number of each customer billed on one, to match each invoice to a client record. We use only the agency's own fee lines (membership, retainer, and planning fees) to show each client's membership level and fee history to advisors in the workspace. We do not read other QuickBooks data, and it is never shared outside the workspace.

Intuit access and refresh tokens are encrypted at rest with AES-256-GCM and are never shown in the application.

Usage and audit information

We record minimal logs needed to operate the platform safely: authentication events, background-job status, and access to sensitive resources. These logs do not include the contents of emails or itineraries.

How we use information

  • To create and improve a private "Travel DNA" profile for each of your clients from the itineraries you upload.
  • To train a private voice persona from your Gmail Sent folder so AI-assisted drafts sound like you.
  • To add to a client's Travel DNA profile from the email you exchange with them, once you have linked their address to their client record.
  • To surface behavioral matches between your clients based on their inferred travel preferences — always advisor-controlled, never auto-published to clients.
  • To generate destination predictions and email drafts you can review before sending.
  • To show advisors each client's membership level and fee history, from the fee invoices in a connected QuickBooks account.
  • To secure the platform, prevent abuse, and provide support.

Google API Services User Data Policy — Limited Use

SPARTA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • Data from Google APIs is used onlyto provide user-facing features in SPARTA: showing you your own mail, training your personal voice persona from your sent email, and — for addresses you have explicitly linked to a client — building that client's travel profile from the correspondence with that address.
  • We do not use Google user data to serve advertisements, including remarketing, personalized, or interest-based advertising.
  • We do not transfer Google user data to third parties except as necessary to operate the service (e.g., trusted infrastructure providers under written agreements, listed below), or as required by law.
  • We do not allow humans to read your Google user data unless (a) we have your specific consent for a support request, (b) it is necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) the data has been aggregated and de-identified.

Third-party processors

We use the following infrastructure and AI providers:

  • Supabase — managed Postgres and object storage (encryption at rest, row-level security).
  • Vercel — application hosting and edge infrastructure.
  • OpenAI— large language model inference for parsing itineraries and generating predictions. API calls are made under OpenAI's zero-retention enterprise terms; we do not use data to train models.
  • Anthropic — large language model inference for drafting client-facing emails. Same enterprise terms apply.
  • Google APIs — Gmail messages read under the scope you grant.
  • Intuit QuickBooks — fee invoices read under the scope a workspace administrator grants.
  • Voyage AI — text embedding generation for voice persona retrieval. Stored vectors are not reversible to source text.

These providers operate under written data processing agreements and only process information on our behalf to deliver the service.

Data retention

We retain workspace data, itineraries, generated profiles, and drafts for as long as your account is active. You may request deletion of your workspace and all associated data at any time by contacting us. We also retain limited audit logs (e.g., authentication events) for up to twelve months for security purposes.

When you disconnect a Gmail account, we revoke the OAuth grant with Google and stop reading your mailbox immediately. Disconnecting does not delete correspondence we have already stored. Messages ingested for a linked client stay in our system, encrypted, and messages used to train your voice persona remain in derived form (embeddings and stylistic signals). Revoking our access to Gmail ends future access; it does not reach back. If you want stored content removed, ask us and we will delete it.

Deleting a client deletes the correspondence stored for that client, along with the records of the files attached to it. Unlinking an address is deliberately gentler: the stored messages are detached from the client record and the preferences drawn from them are dismissed rather than erased, so that a link made in error can still be traced. If you need those messages deleted outright rather than detached, tell us.

Security

We encrypt sensitive credentials and stored email content at rest using AES-256-GCM, run all traffic over TLS, and enforce per-workspace isolation through database row-level security. The tables holding client correspondence carry no read policy at all, so no browser session can reach them. Access to production data is limited to a small number of employees who require it to operate the service.

No service can guarantee perfect security. If you become aware of any suspected breach of your SPARTA account, please contact us immediately.

Your choices

  • Access and correction. You may view and edit your profile and workspace data inside SPARTA at any time.
  • Disconnect Gmail.You may revoke our Gmail access from inside SPARTA (Settings → Integrations) or from your Google Account's third-party access settings. This stops all further reading of your mailbox, but it does not delete correspondence already stored for a linked client — see Data retention above.
  • Disconnect QuickBooks.A workspace administrator can disconnect QuickBooks from inside SPARTA (Settings), or revoke access from the Intuit account's app connections. This stops all further reading. Fee records already imported stay in the workspace until you ask us to delete them.
  • Delete your workspace. Email us at privacy@sparta.ai to request deletion of your workspace and all associated data.

Children's privacy

SPARTA is intended for use by professional travel advisors and is not directed to children. We do not knowingly collect information from anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you within the application and update the "Effective" date above.

Contact

For privacy questions, contact us at privacy@sparta.ai. You can also review our Terms of Service.