Privacy Policy

Last updated: October 26, 2026

My Creativity Box, Inc., a Delaware corporation ("Spok", "we", "us") operates the Spok platform at spok.vc. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and profile picture via Google OAuth. We do not store your Google password.

Content You Provide

We store the data you create within the Service: companies, notes, documents, investments, LP records, and other fund-related content. This is your data and you retain full ownership.

Email Data

If you use our email agent feature (forwarding emails to agent@app.spok.vc) or Gmail import, we process email content to extract company information, contacts, and attachments. Email content is processed and stored within your fund's data.

Google User Data

Spok's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to raw Google data and to anything Spok derives from it, such as classifications, extracted fields and summaries.

You choose which Google permissions Spok gets. Each one has its own Connect button in Spok, and you can grant one without the others. Signing in with Google gives Spok your name, email address and profile picture.

  • Gmail, read-only (gmail.readonly). Spok reads your messages and attachments to match email to the companies and investors in your fund, show it on their records, file attachments such as pitch decks in data rooms, and sort inbound pitches. Spok never changes, labels, moves or deletes your Gmail messages.
  • Gmail, send (gmail.send). Spok sends a message from your address only after you write, edit or approve it and confirm the recipient in Spok. Spok never uses this permission for bulk, marketing or background mail.
  • Gmail, drafts (gmail.compose). When you ask Spok to draft outreach for a deal, it creates one draft per recipient in your Gmail Drafts folder, then checks each draft to learn whether you sent or deleted it. You review and send each draft yourself; Spok never sends them. These drafts are the only items Spok creates in your mailbox.
  • Google Calendar, read-only. Spok reads events on your primary calendar: the last six months when you connect, then new changes. It keeps only events that include people outside your fund team, and stores each event's title, description, time, those attendees, location and meeting link so the meeting appears on the matching investor or company record. Spok reads no other calendar and never changes your calendar.
  • Google Drive, read-only (drive.readonly). Spok reads only the Drive folder you paste into a company's data room, including its subfolders, up to 25 files per import. It downloads supported files, converts Google Docs, Sheets and Slides to PDF, and copies them into that data room. Google describes this permission as access to all your Drive files. Spok never lists, searches or reads any other part of your Drive, and never changes your Drive. Changing sharing in Drive after an import does not remove the copies in Spok.

Spok stores imported email, attachments, meeting records and Drive copies in your fund's workspace: text in Spok's database and files in private file storage, both hosted on Fly.io and encrypted at rest. Members of your fund with access to those records can see them.

Spok uses Google data only to provide and improve the features above for you. Spok does not use it for advertising, does not sell it, and does not use it to develop, improve or train generalized AI or machine-learning models. Spok shares Google data only with the AI providers listed in section 3, to run these features, and with its hosting, database and file-storage providers. No Spok employee reads your Gmail, Calendar or Drive content except with your permission, to investigate security or abuse, or when the law requires it.

Spok encrypts your Google access and refresh tokens at rest and keeps them only while the connection is active.

You can stop Spok's access at any time. In Settings, Email, press Disconnect on your Google account card to stop Gmail and Calendar access, or Disconnect under Google Drive to stop Drive access. Spok then revokes its token at Google. You can also remove Spok's access at myaccount.google.com/permissions. Disconnecting stops new access. It does not delete what Spok already imported.

To delete what Spok imported:

  • Email. A general partner or operations member of your fund can press "Delete all email data" in Settings, Email. This deletes the fund's imported Gmail messages and attachments.
  • Data-room documents. Delete documents, including Drive copies and filed attachments, from the company's data room.
  • Your account. Delete it in Settings, Profile. This deletes your account and your Gmail and Calendar connections. If you confirm, it also deletes any fund where you are the only general partner, along with that fund's records. If the fund has other partners, the fund keeps its records.
  • Calendar meeting records, and anything else. Email hendrik@nzvc.co.nz and ask us to delete them.

Usage Data

We use PostHog for product analytics. It records the pages you view, your clicks and page load times. We may also collect error logs and performance metrics to improve the Service.

2. How We Use Your Information

  • To provide and maintain the Service.
  • To process your Content through AI features (research reports, document extraction, email classification).
  • To send transactional emails (account notifications, billing).
  • To improve the Service based on aggregate usage patterns.
  • To comply with legal obligations.

3. AI Processing

Spok's AI features read your Content, including email, attachments, meeting details and Drive documents, to classify, summarize and extract information. Some of this runs automatically: when Spok imports new email, it analyzes each message and classifies each thread without you starting it. Other features, such as research reports and the chat assistant, run when you use them.

Spok sends your Content to these AI providers:

  • Anthropic (Claude models). Spok uses it for email insights, thread classification, document classification and extraction, research reports and most other AI features. Spok sends these requests first to its own gateway server, which runs them on Spok's Claude subscription accounts. When the gateway does not answer, Spok sends them through Anthropic's API.
  • Fireworks AI (open models such as Kimi and GLM). Spok uses it for the chat assistant and as a fallback for the features above when Claude does not answer.
  • OpenRouter (open models such as DeepSeek, GLM and Kimi). Spok uses it for thread classification and as a fallback for the features above. Spok lets OpenRouter use only hosts that keep no copy of the data and do not train on it, and excludes hosts based in China.
  • Google (Gemini API). Spok uses it to analyze each imported Gmail message, identify the company or investor it concerns and extract its key points.

Each provider receives only what the feature needs, and only to run that feature for you. Their terms for this use bar them from training models on your data.

4. Data Sharing

We do not sell your personal data. We share it only in these cases:

  • With AI providers as described above, to deliver AI features.
  • With infrastructure providers (hosting, database, file storage) and our product analytics provider (PostHog) as necessary to operate the Service.
  • When required by law, court order, or governmental authority.
  • With your consent, such as when you use share links to share company profiles externally.

5. Data Security

  • All data is encrypted in transit (TLS 1.2+) and at rest.
  • Multi-fund data isolation ensures complete separation between funds.
  • Role-based access control (GP/Ops roles) limits data visibility within your organization.
  • We conduct regular security reviews of our infrastructure and codebase.

6. Cookies

We use essential cookies for sign-in (session management). Our product analytics provider, PostHog, stores an identifier in a cookie and in your browser's local storage. We do not use advertising cookies.

7. Data Retention

Spok keeps your Content until you delete it or your account is deleted. Section 1, under Google User Data, lists what you can delete yourself and what each deletion covers. For anything else, email hendrik@nzvc.co.nz and ask us to delete it.

8. Your Rights

You have the right to:

  • Access your data at any time through the Service.
  • Correct inaccurate data.
  • Delete your account. This deletes your account and your Gmail and Calendar connections. If you confirm, it also deletes any fund where you are the only general partner, along with that fund's records. If the fund has other partners, the fund keeps its records.
  • Ask us to delete data you cannot delete yourself, by emailing hendrik@nzvc.co.nz.
  • Object to processing of your data.

9. International Data Transfers

The Service is hosted on infrastructure that may process data in multiple regions. We ensure appropriate safeguards are in place for any international data transfers.

10. Children's Privacy

The Service is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email at least 30 days in advance.

12. Contact

Questions about this Privacy Policy? Contact us at hendrik@nzvc.co.nz.