Privacy Policy
Last updated:
Sponge Inc., a Delaware corporation ("Sponge," "we," "us," or "our"), provides software that helps businesses manage customer onboarding and account operations. This Privacy Policy describes how we handle personal information when you visit our website, contact us, or use our services.
1. Scope and our role
We are responsible for personal information we use to operate our website and manage our business relationships. When a business customer provides personal information through our platform, we process that information on the customer's behalf under our agreement and their instructions. The customer's privacy notice governs its collection and use of that information. If your information was provided by one of our customers, please direct requests about it to that business.
2. Information we collect
The information we receive depends on how you interact with us and which services you use. It may include:
- Contact and account information: your name, work email, company, role, account details, and information you provide when contacting us, requesting a demo, or using support.
- Customer-provided information: records, documents, communications, onboarding details, and case information that customers submit or make available through connected systems.
- Technical information: IP address, browser and device information, access times, pages visited, and service activity or diagnostic logs generated when you access our website or services.
- Business and billing information: subscription, billing contact, and transaction details when you purchase services.
3. How we use information
We use personal information to provide and maintain our services; manage accounts and customer relationships; respond to inquiries; process billing; communicate about our services; troubleshoot and improve functionality; protect against misuse and fraud; and meet legal obligations. We process information supplied by customers to support their onboarding and account-management workflows under their instructions.
Where applicable law requires a legal basis, we rely on performance of a contract, our legitimate interests in operating and securing our business and communicating with business contacts, compliance with legal obligations, or your consent, depending on the activity. Where we rely on consent, you may withdraw it at any time.
4. Identity verification
Where identity verification is part of a service you use, we or the business requesting verification may use providers such as Sumsub. Depending on the checks requested, verification may involve identity and contact details, government-issued identity documents, photos or video, biometric information derived from them, device information, and verification results. This information is used to verify identity, prevent fraud, and support applicable compliance requirements.
The verification flow will provide additional notices and request consent where required before processing. Sumsub's handling of information is described in its Privacy Notice for Service Delivery. The business requesting verification determines the checks and purposes that apply to you.
5. How we share information
We may share information with service providers that support hosting, storage, communications, billing, support, and verification; with customer-authorized users and integrations as needed to provide the service; and with professional advisers. Providers handling information on our behalf are subject to appropriate contractual obligations.
We may also disclose information when required by law, to protect rights and safety or investigate misuse, in connection with a merger, acquisition, financing, or sale of business assets, or at your direction or with your consent.
6. Cookies and third-party services
Our services may use cookies or similar technologies to maintain sessions, remember preferences, and support security. You can manage cookies through your browser settings, although disabling them may affect service functionality.
Our website loads fonts from Google Fonts and links to third-party services, including Google Calendar for meeting scheduling. These providers may receive technical information, such as your IP address, when their resources load or you visit their services. Their own privacy policies apply to their handling of information.
7. Retention and security
We retain personal information for as long as needed for the purposes described in this policy, including providing services, maintaining business records, complying with legal obligations, and resolving disputes. Retention depends on the type of information, the relationship with you or our customer, contractual requirements, and applicable law. Customer-provided information is retained and deleted in accordance with our customer agreements and applicable legal obligations.
We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure.
8. International processing
Information may be processed in countries other than the country where you live, where we, our customers, or service providers operate. These countries may have different data protection laws. Where required, we use legally recognized safeguards for international transfers, such as standard contractual clauses. You can contact us for information about safeguards relevant to your information.
9. Your rights and choices
Depending on your location and applicable law, you may have rights to access, correct, delete, or receive a copy of your personal information; restrict or object to certain processing; withdraw consent; and complain to a data protection authority. These rights may be subject to exceptions. You can opt out of promotional communications by following any unsubscribe instructions or contacting us.
To make a request, use the contact link below. We may need to verify your identity before responding. If your request concerns information processed for a business customer, contact that business directly; we assist our customers with requests as required by our agreements and applicable law.
10. Children
Our website and services are intended for business use and are not directed to children under 16. If you believe a child has provided us personal information inappropriately, please contact us so we can investigate and take appropriate action.
11. Changes to this policy
We may update this policy as our services or legal requirements change. We will post the updated policy here and revise the date above. Where required by law, we will provide additional notice of material changes.
12. Contact us
For privacy questions or requests, contact Sponge Inc. through our contact page and let us know your inquiry concerns privacy. Please do not include identity documents or other sensitive personal information in a meeting request.