Privacy Policy - BillMax

iSpark’s Privacy Policy

Last Updated: October 23, 2026

This Privacy Policy (the “Policy”) describes how iSpark Group Inc. (“iSpark,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our website (billmax.com), our mobile application (the “App”), and our related products and services (collectively, the “Services”). This Policy replaces all previous versions.

We provide a software platform used by Internet Service Providers (“ISPs”) and other communications and utility providers (collectively, “Customers”), and by the employees, contractors, and field technicians that our Customers authorize to access the Services on the Customer’s behalf (“Authorized Users”). Because of this our role differs with regard to the personal information we collect and process. Please read the section “Our Roles: Controller and Service Provider/Processor” below, because it determines which parts of this Policy apply to you.

Before accessing or using the Services, please ensure that you have read and understood our collection, storage, use and disclosure of your personal information as described in this privacy policy. By accessing or using the Services, you accept the practices described in this Policy.

1. Our Roles: Controller and Service Provider/Processor

iSpark acts in two distinct capacities depending on whose information is involved:

(1) As a business / controller. iSpark determines the purposes and means of processing personal information, and this Policy governs how we handle it in two contexts:

Website, account, and marketing activity. When you visit our website, create an account, communicate with us, or we market our Services to you, iSpark determines the purposes and means of processing your personal information. In these situations, we are acting as a “business” or a “controller,” and this Policy governs how we handle that information.
Authorized User App-level information. In hosted deployments, when an Authorized User accesses the Services through the App on behalf of a Customer, iSpark collects certain information directly from and about that Authorized User (such as login credentials, device information, location while the App is in active use, and photos submitted through the App) in order to operate the App itself. iSpark determines the purposes and means of this App-level collection, and this Policy governs how we handle it. In self-hosted deployments, this information is transmitted directly from the App to the Customer’s servers. See “Information We Collect and Use Through the App” below.

(2) As a service provider / processor. When our Customers, or their Authorized Users on the Customer’s behalf, use the Services to manage the Customer’s own subscribers, customers, leads, or related records (“Subscriber Data”), iSpark processes that Subscriber Data only on behalf of, and under the instructions of, the relevant Customer. In these situations, the Customer is the “business” or “controller,” and iSpark is a “service provider” or “processor.” We process Subscriber Data solely to provide the Services and as permitted by our written agreement with the Customer.

If you are a subscriber or other end customer of one of our Customers, and your information was entered into the Services by that Customer or its Authorized Users, that Customer (not iSpark) is responsible for its own privacy practices with respect to your information. Privacy rights requests about that information should generally be directed to the Customer you do business with. We will assist our Customers in responding to such requests as required by law and our agreements.

2. Deployment Models

Customers use the Services either hosted by iSpark or self-hosted on the Customer’s own infrastructure. In a self-hosted deployment, Subscriber Data and information transmitted by the App (such as job photos and authentication requests) goes directly to the Customer’s servers, not to iSpark. The Customer is solely responsible for the hosting, security, retention, and breach notification of that data. iSpark accesses it only when the Customer grants access for support, and then only as a service provider/processor.

3. What Personal Information We Collect

We must collect basic information that identifies you as an individual (“personal information”) to transact business with you, your business, or your employer. We may collect the following categories of personal information, depending on how you interact with us:

Category	Examples	Collected?
Identifiers	Name, postal address, email address, telephone number, IP address, account username, unique online identifiers, device identifiers	Yes
Customer records	Billing and payment information, company name, job title, contact details, content of support communications	Yes
Commercial information	Subscription and product records, services purchased or considered, transaction history	Yes
Internet/network activity	Browsing and usage data, log data, cookie and similar-technology data, referring pages, search terms	Yes
Services Specific data	Device data (manufacturer, model, IP address), Application data (version, date of activation, update status), serial numbers of equipment recorded in asset inventory	Yes
Authentication information	API key, technician username, technician password	Yes, where applicable
Geolocation data	Location of the device using the App for service location and navigation	Limited — see below
Professional/employment information	ISP affiliation and professional role	Yes
Electronic information	Activity logs	Yes, where applicable
Sensitive personal information	See “Sensitive Personal Information” below	Limited — see below

‍We do not intentionally collect Social Security numbers, driver’s license numbers, biometric data, or precise geolocation through our public website. To the extent such data is entered into the Services by our Customers in the course of their business, we process it as a service provider/processor under our agreements, not for our own purposes.

When you use the App, you have the option to use address and direction (“GPS”) features that require the collection and processing of geolocation data. To use these features, you must consent in the App to sharing your location. We collect your location only while the App is open and in active use. We use it to provide mapping and navigation features and, when an Authorized User chooses to record a service location, to capture that location for the Customer’s records. We do not collect your location when the App is closed or running in the background, and we do not use location data to monitor attendance, work hours, or productivity.

4. Sensitive Personal Information

The definition of “sensitive” personal information varies from jurisdiction to jurisdiction, but it generally includes personal financial account information, precise geolocation, government identifiers, and health information. In our role as a business/controller (our website, App, and account administration), we generally do not collect sensitive personal information. To the extent we do, it is in order to provide the Services.

Authorized Users have the option of enabling the App to collect and process their geolocation data from their mobile device in order to use the mapping and navigation features in the App and to record service locations, as described in “Information We Collect and Use Through the App” below.

We do not collect sensitive personal information for the purpose of inferring characteristics, selling, or sharing and we do not use or disclose it beyond the purposes permitted by law.

In our role as a service provider/processor, our Customers may input information that qualifies as sensitive (for example, financial account information relevant to commercial transactions). We process that information only on the Customer’s instructions and only to provide the Services. We do not sell it or use it to build profiles.

5. How We Collect Personal Information

We collect personal information from:

you directly, when you register, contact us, or use the Services;
your device and browser, automatically, through cookies and similar technologies;
our Customers, who input information into the Services;
service providers; and
publicly available sources and our business partners and affiliates.

If any content or information that you upload to or store on the Services contains personal information of other individuals, you must be legally permitted to share the personal information with iSpark.

6. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to operate the Services, remember your preferences, and understand usage. You can manage cookies through your browser settings.

We use the following cookies, pixels, and similar technologies as follows:

Type	Explanation
Strictly Necessary Cookies	Essential to enable you to use the Services
Performance Cookies	Collect information about how users use the Services and help improve the Services
Functionality Cookies	Allow us to remember what choices you make (e.g., your username, language, or the region you are in) to provide enhanced, more personal features

7. Information We Collect and Use Through the App

In addition to the Subscriber Data our Customers and their Authorized Users input into the Services, the App itself collects the following information from and about our Authorized Users (for example, field technicians). In hosted deployments this information is transmitted to iSpark; in self-hosted deployments it is transmitted to the Customer’s servers instead:

Account and authentication information, such as login credentials and technician username. These credentials are stored locally on the Authorized User’s device using the operating system’s secure storage (Apple Keychain / Android Keystore) and are transmitted only to authenticate the Authorized User’s requests.
Device information, such as device model, operating system version, and unique device identifiers.
Location information, but only while the App is open and in active use (foreground only), and only for two purposes: (i) mapping and turn-by-turn navigation, which the App hands off to the mapping application already installed on the device (the App does not contain a third-party mapping library); and (ii) when an Authorized User chooses to record a service location, the App reads the device’s GPS coordinates and transmits them to the Customer’s account record, for example for the Customer’s Federal Communications Commission (FCC) broadband reporting. Only a recorded service location leaves the device or is stored. We do not collect an Authorized User’s location when the App is closed or running in the background, and we do not use location data to monitor attendance, work hours, or productivity.
Camera and photos, when an Authorized User chooses to capture job-related photos (for example, of completed work or equipment) for upload to the Customer’s account record. Camera access requires the Authorized User’s permission and can be granted or revoked at any time in device settings.
Diagnostic logs generated through the App’s operation, to support troubleshooting. These logs are stored locally on the Authorized User’s device, are not transmitted automatically, and are automatically deleted after approximately seven days. An Authorized User may choose to export and send a log file manually (for example, to our support team); if they do, we receive only that log. The App does not include third-party analytics, advertising, or tracking software.

We use this information solely to operate, secure, and support the App. The App does not use information for advertising, marketing, profiling, or cross-app tracking, and we do not sell it. Denying a device permission (such as location or camera) will limit the related feature but will not prevent an Authorized User from using the rest of the App.

8. How We Use Personal Information

iSpark uses the personal information we collect as a business/controller for the following purposes:
‍

Purpose	Explanation
To provide the Services	Create and administer accounts, authenticate users, deliver new features, process payments, and provide customer support
To communicate with you	Send service, security, billing, and administrative messages and responses to inquiries
To operate and improve	Analyze usage, diagnose and fix problems, develop new features, and ensure reliability and security
For security and fraud prevention	Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity, and protect our users, employees, and systems
To comply with the law	Meet legal, regulatory, tax, and investigative obligations, as well as respond to lawful requests from public authorities.

We use the information we receive from our Customers as a service provider / processor solely to provide the Services and as permitted by our written agreement with the Customer. Unless we notify you separately, we do not process your personal information for profiling in furtherance of “decisions that produce legal or similarly significant effects” as such term is defined under applicable law.

9. How We Disclose Personal Information

We disclose personal information to the categories of third parties described below in order to operate our business, provide our services, and comply with our legal obligations. We do not authorize these recipients to use your personal information for their own independent purposes except as described in this policy.

Within iSpark. We may share information within iSpark, and with our employees as necessary, for internal management and administrative purposes or where necessary for the performance or conclusion of our contractual obligations to you or for your benefit.

Customers. The personal information entered or generated in the App by an individual user (such as appointment updates, provisioning changes, photos, and recorded service locations) is connected to and integrated with the other Services we provide to that user’s employer, our Customer. Therefore, that information is disclosed to the respective Customer.

Service providers and processors. We share personal information with vendors that process data on our behalf and under our instructions, including:

Cloud hosting and infrastructure providers: to store data and host our Services.
Integrations: to incorporate the functionality of third-party technologies with the Services.
Payment processors: to process transactions and prevent payment fraud.
Analytics providers: to understand how users interact with our services and to improve them.
Customer support and communications vendors: to respond to inquiries and send service-related marketing messages (e.g., email, SMS, and helpdesk platforms).
Security and fraud-prevention services: to protect our systems and detect malicious activity.
Backup and disaster recovery providers: to back up Services data, including Subscriber Data, for both hosted and self-hosted deployments.
Professional advisors: including legal, accounting, audit, and insurance providers, as needed.

Corporate transactions. We may disclose personal information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, in which case personal information may be transferred to the successor entity.

Legal compliance and protection. We may disclose personal information to law enforcement, regulators, courts, or other government authorities where required by law or legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell personal information.

10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to provide the Services, comply with our legal, regulatory, tax, accounting, and reporting obligations, resolve disputes, and enforce our agreements. Retention of information processed in our service-provider/processor role is governed by our agreements with the relevant Customer. The App also caches Subscriber Data locally on an Authorized User’s device to support offline use in the field. That cached data is retained only as long as needed for offline functionality and is removed as described below. Diagnostic logs generated by the App are retained locally on an Authorized User’s device for approximately seven days before automatic deletion. An Authorized User can also clear cached App data at any time by logging out of the App, and uninstalling the App removes the App’s locally stored data from the device entirely. In hosted deployments, we also maintain system and operational logs for security, troubleshooting, and audit purposes. These logs may contain personal information in readable form where that information is the content of a transaction being recorded, such as names, postal addresses, email addresses, and telephone numbers. Certain categories of sensitive information, including payment card numbers, bank account numbers, government identification numbers, dates of birth, driver’s license information, security question answers, and passwords, are masked, encrypted, or replaced before being written to these logs. We retain these logs only as long as reasonably necessary for the purposes described above. For self-hosted deployments, these logs are generated and retained entirely within the Customer’s own environment. iSpark has no access to them and no retention obligation with respect to them.

11. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, including access controls, encryption, and monitoring. This includes safeguards on Authorized Users’ devices: the App uses the operating system’s secure storage facilities to protect authentication credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a breach of security safeguards affecting personal information, we will notify affected individuals and regulators as required by applicable law, including, as applicable, state breach-notification laws and, for Canadian residents, the notification and record-keeping requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA). In self-hosted deployments, the Customer is responsible for the security of its own environment and for breach notification.

12. Your Privacy Rights

Depending on your state of residence within the United States, you may have some or all of the following rights with respect to personal information we process about you as a business/controller:

Right of access and portability. The right to obtain access to your personal information and to receive that personal information.

Right to correct. The right to correct inaccurate personal information.

Right to delete. The right to obtain the deletion of your personal information.

Right to opt out of sale: The right to opt-out of the sale of your personal information.

Right to opt out of profiling. The right to opt-out of the processing of your personal information in furtherance of decisions that produce legal or similarly significant effects, where applicable.

Right to non-discrimination. The right to non-discrimination for exercising your rights as outlined in this policy.

Right to appeal. The right to appeal a decision we make about your request, where your state provides this right.

Where we act as a service provider/processor, please direct your request to the relevant Customer (the business that controls your information); we will support that business as required by law.

If your personal information is subject to Canadian federal or provincial privacy law, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial private-sector privacy legislation. These rights include:

the right to know why we collect, use, and disclose your personal information;
the right to access your personal information and to be informed of the third parties to whom it has been disclosed;
the right to challenge the accuracy and completeness of your personal information and have it amended as appropriate; and
the right to withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice.

Our Privacy Officer, identified below, is the individual accountable for our compliance with these laws. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d’accès à l’information du Québec. We will respond to requests within the timeframes these laws require, which may be shorter than the 45-day timeframe described below for U.S. state-law requests.

13. How to Exercise Your Rights

You or your authorized agent may submit a request to exercise your rights to us using the contact information below.

To protect your information, we will take reasonable steps to verify your identity before responding, which may include matching information you provide against information in our records. We will not require you to create an account to submit a request. Authorized agents must provide proof of authorization, and we may require the consumer to verify their identity directly.

We will respond to verifiable requests within the timeframe required by applicable law, generally within 45 days, with the ability to extend by an additional 45 days where reasonably necessary and permitted, after notifying you. There is no fee for most requests unless they are excessive, repetitive, or manifestly unfounded.

If we decline to take action on your request and your state provides an appeal right, you may appeal by contacting us at privacy@billmax.com within a reasonable time. We will respond to your appeal within the period required by your state’s law (generally 45–60 days) and explain our decision.

14. Account Deletion

Authorized User accounts are created and administered by the Customer within the Services. The App does not offer public sign-up or self-service account creation. An Authorized User who wants their account deactivated or deleted should contact their employer’s system administrator, who can deprovision the account directly within the Services. Upon a Customer’s instruction, we will delete or deprovision the associated App-level credentials (such as stored authentication tokens and the App’s device identifier) based on the timeline agreed upon with that Customer.

15. Protecting Your Child’s Privacy

The Services are business tools designed for use by adult professionals in a business-to-business context and are not directed to, marketed to, or intended for use by children. We do not knowingly collect, use, or disclose personal information from children under the age of 13 (or the applicable age of consent under the laws of a user’s jurisdiction, including under 14 in Quebec) through the Services. If we become aware that we have collected personal information from a child without verification of parental consent where such consent would be required, we will take reasonable steps to delete that information as promptly as practicable.

If you are a parent or guardian and believe your child has provided personal information to us through the Services, please contact us at privacy@billmax.com, and we will investigate and, where appropriate, delete the information from our records.

16. Marketing Communications

From time to time, we may send you promotional emails, including product announcements, special offers, alerts about new features, surveys, and similar marketing content (“Marketing Communications”). Marketing Communications are separate from transactional or administrative messages we send in connection with your account, purchases, or use of our services, such as order confirmations, billing notices, and security alerts (“Service Communications”), which are not subject to the opt-out described below and which you may continue to receive even after opting out of Marketing Communications.

You may opt out of Marketing Communications at any time by (i) clicking the “unsubscribe” link included in each such email, or (ii) emailing privacy@billmax.com with “unsubscribe” in the subject line. We will process your request within 10 business days.

17. Data Transfers

We are based in the United States, and the information we process is generally stored and processed in the United States. Our service providers and sub-processors may process information in other locations. Where information is transferred across borders, we take steps to ensure appropriate protection consistent with applicable law.

18. Third-Party Links

The Services may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their policies.

19. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last Updated” date and provide notice as required by law, such as by posting on the Services or notifying you directly. Your continued use of the Services after an update indicates your awareness of the changes to the extent permitted by law.

20. Contact Us

If you have questions about this Policy or our privacy practices, or to exercise your privacy rights, contact us at:

Privacy Officer: Ellen Slezak

Email: privacy@billmax.com

Phone: +1 (817) 446-7776

Mailing address:

iSpark Group Inc.
PO Box 1947
Colleyville, Texas 76034