Avant Digital Inc
Sparklets Subprocessors.
Effective date: August 8, 2026
The short version
- Sparklets uses third-party providers to operate Emma, host the service, process AI requests, support calls and voice, connect user-authorized powers, and handle billing.
- Not every provider receives data for every user. Processing depends on enabled features, connected powers, and user requests.
- For core AI model providers, Sparklets uses paid, commercial, or production API routes and available no-training controls where supported by the provider and account configuration.
- Disabled, fallback, or beta providers receive no data unless that provider is enabled for a feature, account, or requested workflow.
- We use provider data-processing terms, contracts, or equivalent safeguards where available and continue to track provider evidence internally.
The full policy below is the binding version.
1. How To Read This Page
This page lists third-party service providers and subprocessors that may process Sparklets user data to provide the service. It includes production providers and feature-dependent providers where a feature or account setting may route data to that provider. If a feature is not enabled for your account, the related provider does not receive your data through that feature.
See our Privacy Policy and AI Processing Notice for more detail about data categories and user controls.
2. Provider List
| Provider | Purpose | Data |
|---|---|---|
Google Gemini AI reasoning | Assistant reasoning, generation, extraction, document understanding, and task execution. Used through paid/API routes where configured. Google states paid Gemini API prompts and responses are not used to improve products, while limited logging may apply for safety, security, and legal purposes. | Messages, task context, profile context, memories, connected-service excerpts, files, transcripts, and outputs as needed. |
OpenAI AI reasoning | Model routing, assistant generation, fallback reasoning, and selected transcription or multimodal workflows where enabled. Used through API/business routes where configured. OpenAI states business/API inputs and outputs are not used for model training by default unless the customer opts in; retention and optional zero-data-retention eligibility vary by endpoint and account. | Messages, task context, transcripts, files, outputs, and relevant connected-service excerpts. |
Anthropic AI reasoning | Agent reasoning, planning, delegation support, and model fallback where routed. Used through commercial/API routes where configured. Anthropic commercial terms state Anthropic may not train models on Customer Content from the Services; route and account evidence is tracked internally. | Messages, task goals, profile and memory context, connected-service excerpts, transcripts, and outputs. |
Google Search via Gemini grounding Search grounding | Grounding model responses with web search where needed. Used only when a request requires current or external information. | Prompt-derived search queries, names, locations, business names, and task facts relevant to the lookup. |
Twilio Calls and communications | Phone numbers, inbound and outbound calls, call status, and telephony routing. Used when phone features are enabled or a user requests call handling. | Phone numbers, call metadata, call audio, status callbacks, and related task context. |
LiveKit Realtime voice and meetings | Realtime call and meeting rooms, voice transport, monitoring, and session control. Used for live voice and meeting features. | Realtime audio, room metadata, call or meeting context, transcripts, and event metadata. |
Deepgram Speech-to-text | Live transcription and speech recognition. Used when speech recognition is enabled. | Audio streams, transcript text, timing data, and related session metadata. |
Cartesia Text-to-speech | Speech generation for Emma voice experiences. Used when configured for voice output. | Text to be spoken, voice settings, generated audio, and session metadata. |
Hume / ElevenLabs Text-to-speech and voice | Feature-specific or fallback voice generation where enabled. Feature-dependent. Disabled providers receive no data unless enabled for the feature or account. | Text to be spoken, voice settings, generated audio, and session metadata. |
Supabase Database and storage | Primary application database, storage, authentication-adjacent records, task state, memories, files metadata, and account data. Credentials for supported integrations are encrypted at the application layer in addition to platform controls. | Account data, messages, tasks, memories, files metadata, transcripts, billing records, credentials ciphertext, audit records, and operational data. |
Clerk Authentication | Account creation, sign-in, sessions, identity, and account lifecycle. Used for identity and access management. | Name, email, phone where provided, authentication identifiers, session metadata, and account events. |
Vercel Hosting | Hosting the Sparklets web application and server-side web routes. Platform logs are minimized and content logging is gated off in production where configured. | Request metadata, logs, app runtime data, build metadata, and operational diagnostics. |
Google Cloud Cloud infrastructure | Agent runtime, Cloud Run execution, Cloud Tasks, Pub/Sub, Secret Manager, and related infrastructure. Used for backend execution and infrastructure. | Runtime payloads, secrets, task metadata, Gmail Pub/Sub notification metadata, logs, and operational data. |
Stripe Billing | Checkout, customer portal, subscriptions, invoices, payment events, and billing records. Sparklets does not store full payment card details. | Customer name, email, billing identifiers, subscription status, invoice/payment metadata, and payment method data handled by Stripe. |
Google Workspace Connected account | Gmail, Calendar, Drive, Contacts, and related Google account powers authorized by the user. Used only when the user connects Google powers and grants relevant permissions. | OAuth tokens, email, calendar events, contacts, files selected or imported, metadata, and content needed for requested tasks. |
Microsoft Graph Connected account | Outlook, Calendar, Contacts, OneDrive, and related Microsoft account powers authorized by the user. Used only when the user connects Microsoft powers and grants relevant permissions. | OAuth tokens, email, calendar events, contacts, files, metadata, and content needed for requested tasks. |
Apple iCloud Connected account | iCloud Mail, Calendar, and related account powers authorized by the user. Used only when the user connects iCloud powers. | Account identifiers, app-specific credential data, email, calendar events, contacts where enabled, and related content. |
Connected account | Profile and posting workflows authorized by the user. Used only when the user connects LinkedIn powers. | OAuth tokens, profile data, draft or approved post content, media metadata, and publishing status. |
Telegram / WhatsApp Messaging channel | Message delivery and assistant interaction through connected messaging channels. Used only when the user connects or uses the relevant messaging channel. | Messages, channel identifiers, phone numbers where applicable, delivery metadata, bot tokens or channel credentials, and task context. |
Browserbase Browser automation | Hosted browser sessions for user-directed web tasks. Used only when browser automation is enabled or requested. | URLs, page content, browser session context, form context, and data entered or authorized by the user during a browser task. |
Firecrawl / Tavily / SerpAPI Research and web search | Search, page retrieval, research, shopping, and external information gathering. Used when a request requires external research or current web information. | Search queries, URLs, fetched page content, snippets, product or location queries, and task-derived context. |
Google Maps Maps and places | Geocoding, place lookups, travel planning, route or destination context. Used when location, travel, ride, weather, or place tasks require maps context. | Addresses, pickup and destination context, place names, and location-derived queries. |
Duffel Travel search and place resolution | Provider-backed flight offers and, only when separately enabled, stay or car offers; optional place resolution for weather fallback. Each inventory vertical is independently server-gated. Sparklets does not expose a Duffel booking, order, or payment tool through this feature. | Origins, destinations, travel dates, passenger types or child ages, cabin and carrier constraints, place names, and related travel-query context. |
FlightAware Flight schedules and status | Provider-published flight status and airline timetable lookups. Used only when commercial production rights are confirmed server-side. Coverage is provider-published and non-exhaustive. | Flight numbers, airport codes, carrier codes, travel dates, route queries, and request metadata. |
WeatherAPI.com Weather | Current conditions and forecast lookups. Used as the primary structured weather provider when configured. | Place names or coordinates, forecast horizon, and request metadata. |
MET Norway Weather fallback | Current conditions and forecasts when the primary structured weather provider cannot serve the request. Keyless fallback using attributed CC BY 4.0 weather data. | Coordinates, forecast horizon, and request metadata. |
Uber deep links Ride linking | Create user-directed ride links. Sparklets does not complete server-side Uber payments through this path. | Pickup and destination context included in the deep link. |
Zapier Connected actions | User-configured connected workflows and third-party app actions where enabled. Feature-dependent and should be enabled only with user authorization. | Task data and connected-app data routed through configured Zaps. |
Finnhub / Alpaca / Twelve Data / Financial Modeling Prep Market data | Market quotes, ticker lookups, financial data, and business briefings. Generally low personal-data risk unless combined with user task context. | Stock tickers, market-data queries, company identifiers, and task-derived briefing context. |
3. Provider Protections
Sparklets uses paid, commercial, or production API routes for core AI model processing where available. We use provider data-processing terms, contracts, or equivalent safeguards and configure no-training or limited-retention controls where supported by the provider and production tier. Some providers may retain data for security, abuse prevention, debugging, legal compliance, or service operations under their own terms.
Sparklets does not sell user data, use user data for ads, or use private user content to train a Sparklets foundation model.
4. Updates and Questions
We may update this page as providers, features, or routing change. Questions about subprocessors or privacy controls can be sent to privacy@sparklets.ai.