Privacy Policy

ZparX Marketing is a marketing agency based in Huntsville, Alabama, operating the website at zparx.com. Jeremy Sparks is the person responsible for the data described here. You can reach us at Jeremy@zparx.com.

This policy covers two different things, and they are worth keeping apart: what we collect from visitors to this website, and what our internal admin tools access from our own connected accounts. The second one is not about you at all — it is here because Google requires us to describe it publicly.

The contact form. Your first and last name, email address, company name if you give one, and whatever you write in the message. It is delivered to us as email through EmailJS, a third-party form-delivery service. We use it to reply to you and to talk about working together.

The chat assistant. If you open the chat widget, the conversation is sent to our server so the assistant can answer, and the transcript is stored. What people actually ask is how we learn which questions the site fails to answer. We store a one-way salted hash of your IP address — enough to stop one visitor flooding the endpoint, not enough to identify you — and never the address itself. Your side of the conversation also stays in your browser tab (sessionStorage) so it survives a page change; closing the tab clears it.

Advertising and measurement. This site loads the Meta Pixel, which tells Meta that a browser visited a page here. We use it to measure and target our own advertising. It is Meta's technology operating under Meta's terms; you can limit it in your Meta ad preferences or with a content blocker.

If you become a lead through one of our ads. Ad lead forms collect what the form says they collect, and carry their own consent language about being contacted — including by an automated calling agent where that applies. That consent is the basis for the call, it is recorded with the lead, and declining it means a person contacts you instead.

We do not sell your personal information, and we do not share it with anyone except the service providers named here who process it on our behalf.

Our internal admin application connects our own Google account — Jeremy's — so that scheduling lives in one place. It is used by ZparX staff only; it is not a product for clients or visitors, and no visitor to this website is ever asked to connect a Google account.

Scope. The application requests exactly one Google scope, calendar.events. That permits reading, creating, updating and deleting events on the calendar of the account that granted it. It does not permit listing other calendars, changing sharing or permissions, reading Gmail, Drive, contacts, or anything else. We request no broader scope.

How it is used. To show the connected account's own upcoming events inside our admin tool, and to create, reschedule or cancel events on it. Calendar data is read when the tool is used and is not copied into any other system, not used for advertising, not sold, not shared with any third party, and never used to train generative AI or machine-learning models.

How it is stored. The OAuth refresh token is held server-side in our Supabase database, encrypted at rest, in a table that is readable only by the server process — never by any browser and never by any client. Event contents are not warehoused; they are fetched for display and discarded.

Limited Use. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking it. The connection can be revoked at any time from inside our admin tool, or from Google Account → Third-party apps. Revoking deletes our stored token and ends all access immediately.

Enquiries and the emails they turn into are kept while we are talking and for as long as we have a business relationship, because that is the record of what was agreed. Chat transcripts are kept so we can improve what the site says. Client records are kept for as long as we work together and afterwards where tax, accounting or contractual obligations require it.

If you would like us to delete what we hold about you, email Jeremy@zparx.com and we will, except where we are required to keep something — in which case we will tell you what and why.

We keep this list short on purpose, and it is complete as of the date above: Supabase (database and application backend), Netlify (website hosting), EmailJS (contact-form delivery), Resend (transactional email), Meta (advertising and the pixel), Google (calendar, as described above), OpenRouter (the language model behind the site assistant), and Retell AI (the voice agent that calls ad leads who have consented to be called).

Each of them processes data on our instructions for the purpose named. If we add one, this list changes.

You can ask us what we hold about you, ask for it to be corrected or deleted, ask us to stop emailing you, and opt out of pixel-based advertising through your browser or your Meta ad preferences. Email Jeremy@zparx.com and a person will answer.

This site is not directed at children, and we do not knowingly collect information from anyone under 13.

When what we do changes, this page changes with it and the date at the top moves. We do not quietly re-scope an existing permission: widening what our tools may access requires granting the new permission explicitly, which is a decision made in the open rather than a line edited into a policy.