Spark Driver

"Sensory Information, such as information from camera and microphone access (e.g., audio and video recordings, ambient light sensor information), photographs (e.g., profile photos), and device movement (such as device orientation and acceleration). ... Device Information, Device Identifiers, and Other Online Identifiers, such as account login information, MAC address, IP address, cookie IDs, mobile ad IDs, operating system version, phone carrier and manufacturer, phone line type, application installations, and push notification tokens."

The app collects ambient light sensor data, device acceleration/orientation, microphone audio, camera video, installed applications list, and a wide range of device identifiers — much of which goes beyond what a delivery driver app needs for core functionality.

"Geolocation, such as data about the location of your device, which may be imprecise (e.g., inferred from your device's IP address). If you provide your consent, this data may be precise. ... Geolocation Data (Including Precise Geolocation Data) [is disclosed to]: Companies within our corporate family; Permissive Service offer providers; Vendors for business operations; Law enforcement, courts, or other legal or governmental bodies; Third parties with whom we are legally required to share; or Business partners in a corporate transaction."

The app collects precise geolocation data and shares it broadly with corporate affiliates (e.g., Sam's Club), business partners, vendors, and law enforcement, creating a wide distribution of drivers' real-time location data.

"We may disclose your personal information with other retail and non-retail companies (e.g., Sam's Club) within our corporate family for them to use in ways that are consistent with this Privacy Statement. ... Vendors for Business Operations: We disclose personal information about you to vendors to perform services on our behalf. These vendors include without limitation: Payment facilitation services; Companies that help us operate and improve our products and services; Companies that manage insurance claims, comply with our legal obligations, or provide other administrative services."

Personal information is shared across Walmart's entire corporate family and an open-ended list of vendors described 'without limitation,' giving broad latitude for third-party data sharing.

"We will keep the personal information we collect about you for as long as necessary to carry out the purposes set forth in this Privacy Statement or any other notice provided at the time of data collection, but no longer than as required or permitted under applicable law or internal policy. We dispose of the information we collect in accordance with our retention policies and procedures."

The retention period is vaguely defined as 'as long as necessary' with no specific timelines provided (except for Illinois biometric data). Internal retention policies are referenced but not disclosed, making it impossible for users to know when their data will be deleted.

"We may obtain and combine personal information from different sources, types of technology, and devices. ... Our corporate affiliates may also provide us with the personal information described above to prevent fraud and ensure the integrity and security of our business, the Spark Driver Program, and the Spark Driver App."

Walmart combines personal information across multiple sources, devices, and its corporate family (including Sam's Club and other affiliates), enabling cross-service profiling of drivers.

"We will provide notice of significant updates, but please check our Privacy Statement periodically for changes. We will always post the date our Privacy Statement was last updated at the top of the Notice."

Walmart can update the privacy statement at any time, with notice only for 'significant' changes and no requirement for user consent — continued use of the app implies acceptance of new terms.

"If we cannot verify your identity, we will notify you, and your request(s) to access, request, or delete your personal information may not be processed. Any requests may be denied if we have reason to believe they are fraudulent. ... To do so, we may ask that you log into your account or provide us with your: First name*, Middle initial, Last name*, Address*, Email address, Phone number."

Deletion requests can be denied if Walmart cannot verify identity, and the verification process requires providing extensive personal information. There is no simple self-service deletion option — drivers must go through a multi-step verification process potentially involving third-party identity services.