Privacy Policy

Last updated: April 19, 2026

Privacy is not a feature we added at the end. It is the reason Carnation Spark exists. This Privacy Policy explains in plain terms what data we collect, how we handle it, and the binding commitments we make about your meeting recordings and transcripts. We operate under British Columbia’s Personal Information Protection Act (PIPA).

What Information We Collect

Website Visitors

When you browse carnationspark.com, we may collect:

• Contact form data: your name, email address, company name, and message content
• Log data: IP addresses temporarily retained in server and CDN access logs
• Analytics data: anonymized page view and session data, only with your consent

Service Customers

When you submit audio files for transcription or meeting intelligence:

• Audio files: the recording you upload, which may contain voices of multiple participants
• Transcripts and meeting notes: the processed output we deliver back to you
• Order data: your name, email address, and any project notes you provide with your submission

We do not collect payment card information directly — payment is handled by the platform through which you order (e.g., Fiverr).

Binding Data Commitments

The following commitments are not aspirational — they are binding operational policies:

1. 24-hour auto-delete: Audio files and transcripts are automatically deleted within 24 hours of delivery to you. No exceptions, no retention for internal review.
2. No AI training: Your audio, transcripts, and meeting content are never used to train, fine-tune, or evaluate any AI model, by us or any third party.
3. No third-party AI APIs: Transcription processing uses private compute infrastructure (see Security Measures below). Your audio is never sent to OpenAI, Google AI, Amazon Transcribe, AssemblyAI, or any other third-party AI API.

How We Use Your Information

• Contact form data: to respond to your inquiry
• Order and audio data: to deliver your requested transcription or meeting intelligence output
• Analytics (with consent): to understand how visitors use the site

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Data Subprocessors

We rely on the following third-party services to operate this website and deliver the service. Each may process personal data, including at infrastructure outside British Columbia (primarily the United States):

• Cloudflare - website hosting, CDN, DDoS protection, and form protection via Cloudflare Turnstile. Cloudflare processes request data including IP addresses at US and international edge nodes. See cloudflare.com/privacypolicy.
• Google Analytics 4 - optional website analytics, active only with your consent. No audio or transcript data is shared with Google. See policies.google.com.
• Google Workspace - email delivery for contact-form submissions. Order confirmations and delivered transcripts are routed through Google’s email infrastructure. See policies.google.com.
• RunPod - US-based GPU compute infrastructure used to run transcription processing. Audio files are transferred to RunPod compute instances for processing, then deleted from RunPod infrastructure upon completion. RunPod does not retain customer data beyond the active compute session. See runpod.io/privacy.

As required under BC PIPA, we disclose that your personal information may be processed or stored outside of British Columbia, primarily in the United States, by the subprocessors listed above. When audio is processed via RunPod, it is transferred to US servers for the duration of processing and deleted immediately after.

Security Measures

We take the following technical measures to protect your data:

• Private compute: Transcription runs on private GPU instances, not shared public cloud AI APIs. Your audio does not pass through any service that could log, retain, or train on it.
• Encrypted transit: All data transfers (uploads, downloads, API calls to compute) use TLS encryption in transit.
• Encrypted at rest: Files stored temporarily awaiting processing are encrypted at rest.
• Automated deletion: The 24-hour deletion cycle is automated, not manual. It does not depend on a human remembering to delete files.

Retention Periods

Your Rights Under BC PIPA

You have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent (where processing is consent-based)
• Request deletion of your personal information

Note: given the 24-hour auto-delete for audio and transcripts, most service data will already be deleted before you have the chance to request it. For other data, use the contact form.

If you are unsatisfied with our response, you may contact the BC Office of the Information and Privacy Commissioner at https://www.oipc.bc.ca/.

Meeting Participant Privacy

If you are a participant in a recorded meeting whose audio was submitted to Carnation Spark by someone else, and you wish to exercise your privacy rights regarding your voice data, please use the contact form. Given the 24-hour auto-delete policy, audio is very likely already deleted by the time any concern is raised. We will confirm deletion status upon request.

Cookies

See our Cookie Notice for details on cookies used by this site.

Changes to This Policy

We may update this policy periodically. The “last updated” date reflects the most recent revision. Material changes will be noted at the top of the updated policy.

Contact

For privacy questions, data requests, or concerns:

Carnation Spark Victoria, BC, Canada