Last updated 16 September 2026
This explains what personal data we hold about the people who use HoopoeHQ, why we hold it, and who else sees it.
The public website may offer an AI assistant powered by ElevenLabs. Its external widget loads only when you choose to open it. ElevenLabs receives connection information, including your IP address, and processes the messages you send and audio if you choose voice. The widget receives your browser’s time zone so it can discuss meeting times.
AI replies can be incorrect. Please do not share confidential client information. If you ask to arrange a call, the details you confirm are used to create the booking and invitation. You can contact hello@hoopoehq.com instead. See ElevenLabs’ privacy policy for information about its processing.
Sparked FM Ltd (company number 16960222, registered office 6 Chesterfield Drive, Burton Joyce, Nottingham, NG14 5EQ, United Kingdom) is the controller of the data described here, and is registered with the Information Commissioner's Office under ZC170119.
There is an important distinction. For the accounts of agencies who buy HoopoeHQ, we are the controller. For the content inside a workspace, including your clients' details and messages, the agency is the controller and we are a processor acting on their instructions. That relationship is set out in the data processing agreement.
Account data. Your name, email address, a hash of your password (never the password), your two-factor secret if enabled, and your role.
Content you create. Requests, comments, tasks, attachments, deliverables and the timeline of changes to them.
Billing data. Your plan and subscription status. Card details are handled by Stripe and never reach our servers.
Operational data. Records needed to run the service, such as when a token was last used, so that a compromised token can be spotted and revoked.
To provide the service you have asked for, which is the performance of our contract with you. To keep the service secure and to prevent misuse, which is our legitimate interest. To meet our legal obligations, including keeping financial records.
We do not sell personal data and we do not share it for advertising. We use the following providers to run the service, each of them bound to process data only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Replit | Application hosting and uploaded file storage | United States |
| Neon | Managed PostgreSQL database | Depends on the deployment region |
| Stripe | Payment processing and subscription billing | United States and Ireland |
| Resend | Transactional email (invitations, password resets, notifications) | United States |
| Anthropic | Optional AI features: drafting a ticket from pasted text, and thread summaries. Only the text you submit to those features is sent. | United States |
Where a provider is outside the UK, transfers are made under the safeguards permitted by UK data protection law.
Account and content data are kept while the account is open. When an account is closed we delete it after a short recovery window, except where we must keep financial records for longer. An expired trial becomes read only rather than being deleted, so nobody loses a history they still need.
You can ask for a copy of your data, ask us to correct or delete it, object to processing, or ask us to restrict it. If the data sits inside an agency's workspace, the agency controls it and we will pass your request to them.
Write to josh.harris@thesparkedgroup.com. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.
We set a session cookie so that you stay signed in, and a preference for your light or dark theme. Both are necessary for the service to work as you asked, and we do not use advertising or analytics cookies.
Each client workspace is isolated from every other, enforced on the server rather than in the interface, and covered by automated tests. Passwords are stored only as hashes and two-factor authentication is mandatory for staff accounts. Access to files is checked on every request rather than relying on an unguessable link, and traffic is encrypted in transit. There is a fuller account on the security page.
Some of the providers above are in the United States. Where personal data goes to a country without a UK adequacy decision, the transfer is made under the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by UK data protection law.
We do not make decisions about you by automated means that produce a legal or similarly significant effect. The optional AI features draft and summarise text for a person to review; they do not decide anything on their own, and your content is not used to train models.
If this policy changes we will update the date at the top of the page, and where the change is material we will tell account holders by email before it takes effect.