Cisco Spark Supplement

Note that this page is a supplement to the Cisco Privacy Statement. In order to understand the data collection and use practices relevant for a particular site or solution, you should read both the Cisco Privacy Statement and any applicable supplement.

Collection and Use of Information

Registration Information

When you sign up to use Cisco Spark (the "Service"), we collect personal information about you, including your name, email address, and profile picture ("Registration Information"), in addition to a password ("Authentication Information"). We may also collect the name of your employer. If your registration includes Spark Call, we may collect additional Registration Information, including your desk phone number, directory extension, direct line, SIP identifier, and voicemail box number. We may also collect additional Authentication Information, including your voicemail PIN and device activation codes.

We use Registration Information to enroll you in the Service, to display your identity to other users, to notify you about features and updates, to understand how the Service is used, and to make improvements to the Service and other Cisco products and services. If you sign up for the Service using your work email address, your Registration Information will be visible to other users who have the same email domain.

When you invite other users to join the Service by providing us with their email addresses, we retain those email addresses.

User-Generated Information

We collect and retain personal information and other information you upload, provide, or create while using the Service (“User-Generated Information”), including information related to:

  • Rooms: Activity recorded in the room (such as joining or leaving), including activity related to third-party integrations, together with the date, time, person engaged in the activity, and other participants in the room
  • Messages: Message content, sender and recipients, date, time, and read receipts
  • Content shared: Files and file names, sizes, and types
  • Calls: Call participants, date, time, duration, and quality ratings that you provide. We route audio and video call content and screen sharing content between call participants but we do not retain or store the content
  • Voicemails: Voice message content, date, and time
  • Meeting invitations: Date, time, participants, and invitation content

We use this information to provide you with the Service, which includes a persistent history of your interactions with other users. You should be aware that all messages and content you share in a room, including personal information about you or others, will be available to all other participants in that room, including participants who join the room after you share messages or content.

If you choose to enable optional location-sharing, we will collect your geographic location (latitude, longitude, and city) when you send a message or share content in a room. We collect this information so that it can be shared with other users in the room.

If you use the Service on your mobile device, upon sign-up you will have the option of sharing your calendar and/or contacts with the Service mobile application. This calendar and contact information is accessed only by the application locally on your mobile device and is not shared with Cisco unless and until:

  • you interact with a contact from your mobile device contact list using the Service, in which case we collect information only about that user. The Service mobile application uses this information to make it easier for you to connect with your contacts
  • you create a room from a calendar event using the Service, in which case, we collect the information in the meeting invitation, including the date, time, duration, and meeting participants

The Service supports integrations with third-party services and applications. If you choose to add an integration, the third-party may share information and content associated with your third-party service or application account with us. We do not receive or store your passwords for these third-party services or applications, although we do store authentication tokens associated with them.

Host and Usage Information

Our servers automatically record certain information when you use the Service, including your IP address, user agent identifier, operating system type and version, client version and IP addresses along the network path ("Host Information"). If you use the Service with Spark Phone OS or Spark Room OS, we collect the MAC address of your desk phone or video endpoint. We also automatically record information about your usage of the Service, including actions taken, date and time, frequency, duration, quantity, quality, network connectivity, and performance information related to logins, clicks, messages, contacts, content shared, calls, use of video and screen sharing, meetings, voicemail, and other feature usage information ("Usage Information"). We use Host Information and Usage Information to understand how the Service is used, to diagnose problems, to respond to customer support requests, to conduct analytics and aggregate statistical analysis, and to improve the Service and other Cisco products and services.

When you use the "Send Feedback" feature of the Service or, choose to send a problem report from a device running the Spark Phone OS, or choose to send logs from a device running Spark Room OS, logs of your activity are automatically shared with us so that we can provide technical support and make product improvements. In some cases, you may be offered the option to send logs at the end of a specific call following a call failure or a low call rating within the Service. If you select the "Send Call Reports Automatically" option under Settings, your activity logs will be shared with us at the end of each call. These logs record information about the participants, date, time, duration, and quality related to your activities with the Service, as well as hashes (one-way encrypted versions) of messages you've sent or received. If your device is paired with a device running the Spark Room OS, the activity logs from the paired device will also be shared with us. These logs may pertain to other users of the paired device besides you. No content or message text that you send or receive is shared with us, unless you choose to include optional screen shots that display messages or content. The logs are stored unencrypted on your device and, together with screen shots, are sent to us using transport encryption (see next section). Your employer has the ability to share logs with us on demand from any device it administers running Spark Phone OS or Spark Room OS, or from any Spark Hybrid Services deployment that it administers.

Securing Your Information

The Service uses different kinds of encryption to protect different kinds of data in transit and in storage.

End-to-end encryption is used to protect messages and content that you share on the Service. Just prior to sending a message from your client, it is encrypted on your device. (If you have opted to share your location information, that information is also encrypted.) Messages remain encrypted until they are received by other users, where they are decrypted on those user's devices. The same process is used for content that you share, with one difference: content of certain types (PDFs and Microsoft Word documents and presentations) is briefly decrypted between you and the recipient so that it can be "transcoded" for display in a room. The results of the transcoding are also encrypted. For example, if you upload a slide presentation into a room, it will first be encrypted on your device. When we receive the presentation on our server, we will briefly decrypt it and send it to a third party, Box.net, where individual thumbnail images of each slide will be generated. Box.net will send the thumbnails and presentation back to us and will not store them. We will then encrypt the thumbnails and presentation and send them to the other users in the room. All content, transcoded content, and messages are stored on our servers in encrypted form. Push notifications sent to Android users via the Google Cloud Messaging service are end-to-end encrypted; notifications sent to iOS users via the Apple Push Notification Service may not be. Messages and content associated with integrations are encrypted within the Service and decrypted at the border with the third-party supporting the integration. Messages and content may be decrypted by your employer or the employers of those you communicate with using the Service, including by Cisco (see Sharing Your Information below).

Media encryption is used to protect the audio, video, screen sharing data, and voicemails that you transmit during a call. When you make a call, media is encrypted from your device to our servers. It is decrypted on our servers so that we can manage the call. It is re-encrypted before being sent to the other participants on the call unless they are connected via the public telephone network or do not support encryption. We do not store any call audio, video, or screen sharing data on our servers. Voicemails are encrypted from your device to our servers, decrypted to be prepared for storage, and re-encrypted in storage on our servers. Voicemails transmitted via email are not encrypted.

Transport encryption (also known as HTTPS) is used to protect all connections to and from the Service other than voice/video calls. When you register for the Service, send messages, share content, connect with third-party services or applications via integrations, send logs or screen shots to provide us with feedback, or otherwise connect to our service, we always use transport encryption.

As described above, messages, location information, content, and voicemails are stored on our servers in encrypted form, as are passwords and voicemail PINs. All other Registration Information, Authentication Information, User-Generated Information, Host Information, and Usage Information is stored on our servers in unencrypted form.

Proximity Features

The Service makes use of Cisco Intelligent Proximity features to pair your mobile device with select Cisco voice and video endpoints. See the Cisco Proximity Supplement for information about data collection associated with Cisco Intelligent Proximity features. You can turn Proximity Features off by visiting the Settings tab in your mobile client.

Mobile and Browser Permissions

The Service makes use of a number of features available on mobile device and web browser platforms to support a full-featured collaboration experience. Depending on which mobile or browser platform you use and which Service features you use, your application may request or automatically obtain some or all of the following permissions:

  • Phone, microphone, camera, and audio recording: the Service uses access to your device’s phone interface, microphone, and camera to allow you to make audio and video calls. On some devices, the mobile device platform also requires that audio recording permission be obtained so that you can make calls (although we do not record audio). The Service will only make use of these permissions when you choose to initiate or receive a call. Camera access is also used to allow you to take photos and post them into rooms
  • Screen sharing: the Service needs screen sharing permission to allow you to share your screen with other users during a call. The Service will only share the screen content that you specify and will only share it with the other users on the call
  • Calendar and contacts: As described above, the Service uses calendar and contact information to make it easier for you to connect with contacts and to schedule meetings
  • Files and photos: To make it possible for you to share files and photos with other users, the Service needs permission to access files and photos stored on your device
  • Push notifications: You can choose to allow the Service to notify you about new messages and other activity even when you do not have the Service application open. User information collected by the Service is shared with third-party push notification services and mobile operators when users allow push notifications. Message text is end-to-end encrypted when sent to Android devices but may not be end-to-end encrypted when sent to iOS devices
  • Location: The Service uses access to your device’s geolocation capabilities if you choose to enable optional location-sharing to provide your location to other users in rooms with you

Use of Cookies and Other Web Technologies

When you use the Service in your web browser, we use cookies, local storage, and other browser storage technologies to ensure that you can stay logged into the Service until you choose to log out and to improve the performance of the Service. These technologies may store Registration Information, Host Information, and/or Usage Information. Cookies are always sent using transport encryption.

Updating Your Information

You can update your name, profile picture, password, voicemail PIN, and email communications preferences at any time using the Service menu options. If your employer subscribes to the Service and includes your account in that subscription, this updating capability may be disabled.

Sharing Your Information

Unencrypted messages may be shared with third-party services and applications that you choose to integrate with and with the Apple Push Notification Service, but not with any other third parties. We may share other User-Generated information, Registration Information, Host Information, and/or Usage Information with service providers, contractors or other third parties to assist us with providing and improving the Service. The data shared may include aggregate statistics or individualized data. All sharing of information is carried out consistent with the Cisco Privacy Statement. We do not rent or sell your information.

If your employer has purchased the Service, we may share any or all of the information described in this statement with them. Your information may be subject to your employer's policies regarding their access, monitoring, deletion, preservation and export of information associated with the Service. This may include access to the keys used to encrypt or decrypt your User-Generated Information.

Similarly, if you communicate with users in other companies through the Service, the information you share with those users and the information associated with those communications may be subject to their employers' policies. If you communicate with a Cisco user through the Service, those communications, including your User-Generated Information, are subject to access, monitoring, deletion, preservation, and export by Cisco.

If your employer subscribes to the Service through a Cisco partner, we may share Host and/or Usage Information about employees' use of the Service with the partner. Employers have the option of disabling this information-sharing with Cisco partners. If a partner chooses to provide customer support for the Service, any or all of the information described in this statement may be shared with the partner.

Other

When you use the Service, you are subject to the Cisco SaaS Terms of Service.