Privacy Policy

Who this covers

This policy describes how SparkGap LLC (“FactorMirror”, “we”) handles information when you visit factormirror.com or use the FactorMirror application. It covers both the people who sign in, including you and your colleagues, and the business records you upload for review.

If your company is the customer, your company controls the workspace and its contents; we process what is in it on your instructions. Where data-protection law distinguishes a controller from a processor, we are the controller for account and security records, and a processor for the documents and figures inside a workspace.

What we collect

Category	What it is
Account	Your email address and a one-way hash of your password (we never store the password itself). If you turn on two-factor sign-in: an authenticator secret held encrypted, and one-way hashes of your recovery codes. Confirmation and reset links are stored only as hashes, so a copy of our database cannot be replayed as a login.
Workspace	Your company name, who belongs to the workspace, each person’s role, and pending invitations.
Source documents	The files you attach to a review, including your factoring agreement or rate schedule, factor statement, invoice or AR export, and any supporting files, together with their filename, size, and content hash.
Review results	The figures and findings our analysts produce from those documents: reserve amounts, fee rates, invoice counts, the written readout, and each finding’s explanation and source reference.
Activity record	An append-only log of what happened in your workspace and who did it, including reviews submitted, findings written, members added or removed, sign-in lockouts. Owners and admins can read it in the app. It cannot be edited or deleted, by us or by you, while the workspace exists.
Technical	Your IP address and request metadata, kept in server logs and used to apply sign-in and signup limits and to investigate faults. If you arrived from a prospect link, the public filing details that link carried.
Public-site analytics (optional)	If you opt in, Google Analytics receives the public page URL without its query string, a sanitized referrer, and browser and device information. Google may derive approximate location from the request address. We do not send prospect details, form values, account fields, documents, review results, or workspace activity.

Why we use it

• To perform the review you asked for. This is the whole purpose of the source documents, and it is the performance of our contract with you.
• To run your account. Sign-in, email confirmation, password reset, workspace invitations, and notifying you when a review is delivered or needs something from you.
• To keep the service secure. Rate limits, account lockout, the activity log, and fault investigation. This is our legitimate interest in a service that is not trivially abused.
• To understand the public site, if you allow it. Consented analytics shows which public pages bring useful visits. It is not used for advertising or inside a workspace.
• To meet legal obligations where they apply, such as retaining records we are required to retain.

What we never do

• We never contact your factor, log into their systems, or identify you to them. What you send your factor, and when, is entirely your decision.
• We never sell or rent your information and run no advertising. Google Analytics runs only after you opt in, and only on public marketing and legal pages.
• We never use your documents to train machine-learning models, ours or anyone else’s.
• We never show one customer’s data to another. Tenant separation is enforced in the database itself, not only in application code, and the application connects with a role that cannot override it.

Who can see your documents

Inside your company: the members of your workspace, according to their role. Owners and admins additionally see the members list and the activity log.

At FactorMirror: the analysts who work your review. A review cannot be reconciled without someone reading the statement, so this access is inherent to the service rather than incidental to it. Every analyst action, including opening a review, changing a figure, writing a finding, and delivering, is written to your workspace’s activity log with their name against it, in the same database transaction as the change itself.

Outside: nobody, except the processors below acting on our instructions, and anyone we are legally compelled to disclose to. If we receive a demand for your data we will tell you, unless we are prohibited from doing so.

How it is protected

• Passwords are hashed with Argon2id. Session cookies, confirmation links, reset links, invitation links, and recovery codes are stored only as SHA-256 hashes.
• Two-factor authenticator secrets are encrypted at rest with a key held in the application’s environment, not in the database.
• Source documents are held in object storage under a content hash, never under a guessable name. Every download is authorized through the API against your workspace membership; storage keys are never exposed to the browser.
• Each workspace’s rows are separated by database row-level security, and the application’s database role has no privilege to bypass it. Automated tests query the tables with no filter at all and fail if another workspace’s rows appear.
• Traffic is encrypted in transit. Sessions are cookie-based, HTTP-only, and same-site.

No system is perfect, and we do not claim otherwise. If you believe an account or document has been exposed, write to [email protected] and we will investigate promptly.

Cookies

The required cookie is set when you sign in and identifies your session. It is HTTP-only, same-site, and marked secure in production. If you choose Allow analytics, Google Analytics may set its own measurement cookies on public pages. We save that choice in local storage; choosing No thanks does not load the Google tag. You can reopen Analytics settings in the footer, and turning analytics off removes its first-party cookies and reloads the page without the tag. Your browser may also keep a prospect or invitation link in session storage between the landing page and signup; it is cleared as soon as the review that uses it is submitted.

Processors

We keep the list short and use each supplier for one job. They act on our instructions under contract and may not use your data for their own purposes.

Role	Purpose
Cloud hosting and database	Runs the application and stores workspace records.
Object storage	Holds the source documents you upload, keyed by content hash.
Email delivery	Sends confirmation, reset, invitation, and review-delivery messages.
Error and performance monitoring	Records request timings and failures for operations.
Optional public-site analytics	Google Analytics measures consented visits to public pages without receiving query strings, account fields, or workspace contents.

Current vendor names are available on request from [email protected].

How long we keep it

• While your workspace exists: source documents, reviews, findings, and the activity log stay available to you. A reconciliation is worth little if last quarter’s evidence has been swept away.
• When you delete a workspace: its reviews, findings, document records, invitations, and activity log are removed immediately. We keep a small tombstone with the workspace name, who deleted it, when, and how many members and reviews it had, so we can answer questions about a workspace that no longer exists.
• When you delete your account: your sign-in credentials and two-factor secrets are removed. Reviews you submitted stay with the workspace they belong to, and the activity log continues to show that the actions happened, without naming you.
• Stored file contents are addressed by hash, so identical bytes uploaded by two customers are one object. Deleting a workspace removes your access and your metadata; the underlying object is removed on our storage retention schedule.
• Server logs are kept for a short operational period and then discarded.

Your choices and rights

You can do most of this yourself, without asking us: download every source file and a PDF workpaper for any delivered review, read the activity log, change or remove members, turn two-factor sign-in on or off, delete the workspace, and delete your account. Depending on where you live you may also have rights to access, correct, port, restrict, or object to our processing, and to complain to your data-protection authority.

To exercise anything not available in the app, write to [email protected]. We will confirm your identity before acting, and we will not treat you worse for asking.

International transfers

Our infrastructure is operated from [hosting jurisdiction: set in src/lib/legal.js]. If you use FactorMirror from elsewhere, your information is transferred there and protected by the safeguards our processor contracts require.

Children

FactorMirror is a business tool, is not directed at children, and we do not knowingly collect information from anyone under 18.

Changes

If we change this policy in a way that matters, we will email workspace owners before it takes effect and update the date at the top of this page. Continuing to use the service after that date means the new policy applies.

Contact

Privacy questions: [email protected]. Anything else: [email protected]. Post: [registered address: set in src/lib/legal.js].