ERP1. Intended scope and activation
Spona intends to develop product analytics, anonymised benchmarks, AI training and evaluation, marketing and financing-partner collaboration. These are distinct purposes, not an unlimited data licence. This notice defines conditions for future activation; it does not state that all these uses currently operate. Each programme needs an identified controller, data categories, legal basis, recipients, duration and safeguards before it starts. The customer may authorise use of content it owns but cannot consent on behalf of employees, contacts or other individuals without lawful authority.
2. Product analytics and research
Use the minimum events and attributes needed to understand feature adoption, reliability and user experience. Where legitimate interests are proposed, document the specific benefit, necessity, less intrusive alternatives, reasonable expectations and balancing of individual rights; provide the applicable objection route. Obtain prior consent for non-essential browser access where required even if subsequent processing has another GDPR basis. Research is not a universal exemption. Cross-module linkage, employee-level analysis and new purposes require a fresh assessment and updated information before use. Core business reporting is designed to use authoritative server records rather than optional navigation events: registrations and verification, persisted business records and financing workflow outcomes. Reports must state which sources and historical coverage are actually available; this notice does not assert that every funnel is already implemented. Browser measurement remains separately consented and cannot be silently reclassified as necessary operational processing. Do not infer distinct users or company adoption from resetting random browser identities. Existing ERP employee-activity features remain subject to the separate safeguards in the Privacy Notice. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact [email protected] for access, objection or deletion requests; collection can be suppressed for the company while a request is handled.
3. Anonymous benchmarks and commercial datasets
Spona may retain, combine, license and publish genuinely anonymous statistics for research, product development and commercial benchmarking within the Terms’ safeguards. The process must remove reasonably foreseeable identification, linkage and reconstruction risks and protect confidential business information. Approve dataset provenance, permissions, cohort thresholds, outlier treatment and release tests before distribution; do not invent a numeric threshold as a guarantee of anonymity. Retest when datasets are combined or external information changes. Raw customer records and pseudonymous identifiers are not anonymous commercial outputs.
4. AI training and evaluation programmes
AI inference, model evaluation and model training must be distinguished. For a separately approved training programme, a signed schedule must identify the model and provider, training purpose, data scope and sources, intellectual-property permission, lawful basis, retention, recipients, transfers, opt-out or withdrawal process where applicable and how rights can be honoured in datasets and models. Use genuinely anonymous or synthetic inputs where feasible. Do not include payroll, identity documents, special-category records or confidential customer content by default. Consent, where relied on, must be specific and freely given, with no loss of core ERP access for refusal. A legitimate-interest route requires a documented case-specific assessment; these terms do not predetermine the outcome. No training permission is activated by a general terms checkbox.
5. Marketing and financing collaboration
Service messages needed to operate an account are separate from promotional messages. Marketing programmes must identify channels and recipients and comply with applicable electronic-marketing rules, including consent where required and a simple, free unsubscribe. Do not enrich marketing audiences with customer-controlled employee, salary or client records under the ERP processing licence. Financing disclosures must be limited to relevant application and transaction data and the disclosed recipient’s purpose; a partner’s independent marketing requires its own lawful arrangement. Consent choices must be granular and recorded by purpose and version, and changes must reach downstream recipients where required.
6. Planned Analytics & BI features
Planned capabilities include traffic-source and campaign analysis, landing-page and device/approximate-country breakdowns, new/returning browser measurement and engagement; registration, verification and activation funnels; feature adoption, user journeys, company cohorts and retention; financing submission, review, signature and recorded-payout funnels; configurable reports, exports, anomaly alerts and data-quality diagnostics. Later proposals include click/scroll heatmaps, session replay, feature experiments and voluntary surveys. Some reporting components are already implemented; listing a feature here does not mean its collection is enabled or that historical data exists. Each release must identify its actual data sources, purpose, controller/processor roles, lawful basis, access and retention. Campaign and referral inputs must be allowlisted and stripped of personal data; approximate location must not be presented as precise tracking. Cross-domain attribution or linkage to an account/company requires a separately assessed and disclosed method, not silent identity stitching. Operational funnels must use authoritative records and distinguish unknown, incomplete and immature cohorts. Browser visits alone do not establish account activation, employee productivity, creditworthiness or financing approval.
7. Safeguards before advanced measurement
Heatmaps and replay are not authorised by general Terms acceptance or the existing module-visit choice. Before launch, provide purpose-specific information and obtain any required consent; introduce granular controls and a stop mechanism. Exclude sensitive screens and block inputs, credentials, uploaded documents, messages, payroll and identity/verification data before transmission; masking after capture alone is not sufficient. Do not promise complete masking without testing the actual implementation. Limit replay access, audit access and exports, define a short justified retention period and complete a data-protection impact assessment where required. Experiments must identify assignment identifiers and outcomes, avoid sensitive profiling and not change contractual financing terms or make automated eligibility decisions under an analytics permission. Survey participation is voluntary; explain any link to account records and discourage confidential or sensitive information in free text. New providers, recipients, transfers or materially broader purposes require updated information and fresh consent where necessary. No roadmap entry activates these features or grants a blanket licence to collect data.
Insights AI Summary — optional paid processing
When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA.
Spona AI — questions and optional financial explanations
When the relevant Spona AI feature is enabled for your workspace, OpenAI processes questions you choose to submit about invoices, permitted guides, procurement comparisons, cash timing, selected Work stage costs or Sales and Work planning. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Where available, GPT explanations of procurement comparisons and cash timing are optional. Spona first shows the question, language and exact summary facts that would be sent. Nothing is sent to OpenAI to prepare this preview; sending starts only when you choose Send to GPT. Procurement facts can include recorded prices, quantities, comparison periods, counts and calculated differences from your company's own accepted-order history. Cash facts can include the plan period, missing-evidence counts, projected balances and dates, the payment-history comparison and, if selected, the receipt amount, dates and calculated effects of your temporary scenario. These are financial data. Company, customer and supplier names, invoice numbers, record identifiers, complete invoice lists, source documents and the full cash curve are not automatically added. Spona calculates the figures; the explanation does not change records or save the scenario. A calculation or scenario does not guarantee a future outcome. Earlier questions and answers are not included in these requests. Where available, optional Work cost explanations use the currently selected stage. Spona shows your question and exact stage facts in your chosen language before you choose Send to GPT; preparing the preview sends nothing to OpenAI. Facts can include original EUR stage values, recorded costs, reviewed remaining commitments and additional estimates, expected cost, budget differences, indicative margin, review date, coverage and overhead settings. Aggregate recorded costs may include invoice, purchasing or payroll allocations. These financial data are not guaranteed anonymous. Names, record identifiers, individual invoice or payroll details, detailed purchase lines, notes, source documents, full records and history are not automatically added. Spona calculates the figures; GPT explains the supplied stage evidence without changing records, calculating a new hypothetical scenario or guaranteeing final company profit. Earlier questions and answers are not included in Work requests. Where available, optional Sales and Work planning explanations use the source you selected. Spona shows the exact question, language and summary facts before you choose Send to GPT. Preparing a plan, temporary target comparison or preview makes no OpenAI request. Sales facts can include the selected months, scope and currency, recorded won and open deal totals, manually weighted pipeline values, missing-data counts and, if you compared a target, that temporary target and the supported calculated difference. Manual weights are recorded assumptions, not guaranteed chances of winning. Work facts can include the selected months, planning date, original EUR stage values before VAT, scheduled values, counts and values requiring date review and, if you compared a target, that temporary scheduled-value target and its calculated difference or surplus. Work values describe recorded plans, not agreed contracts, remaining effort, revenue, cash or capacity. These are financial data and are not guaranteed anonymous. Names, record identifiers, individual deal or stage rows, full lists, private costs, source documents and earlier questions or answers are not automatically added. Sales and Work facts are kept separate. Spona calculates the figures; GPT explains the reviewed evidence and possible read-only next steps without changing records, saving targets or guaranteeing future outcomes. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. Invoice and guide modes can keep the current draft and answer when you close the panel or move between screens. Closing the panel clears the optional procurement-comparison question and answer, and the cash view including its temporary scenario and question. Changing the selected comparison, cash assumption, company, language or access can also clear the affected context. Closing the panel also clears the Work question, preview and explanation. Refreshing or opening stage evidence, navigating away, or changing the stage, company, language, session or access clears that temporary Work context. If source evidence changes, a new preview is required before further use. Closing or leaving the planning view, refreshing, opening source evidence or changing the company, language, session or access also discards the temporary planning question, preview and answer. Editing its source, months, scope, currency, target or question invalidates the affected preview and answer. A fresh preview is required for changed planning evidence. Clear conversation removes panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact [email protected] for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact [email protected] for the applicable provider information and transfer safeguards.
Experience feedback
If you choose Send feedback in Help shape Spona, we receive your rating, selected topics, module or area, an allowlisted page category, interface language, optional comment and submission time. Website feedback is not linked to an ERP account. Feedback sent from a signed-in ERP workspace is linked to that account and company, as stated before submission. Please do not include passwords, personal documents or unnecessary personal or confidential information. Comments are not automatically anonymised. Authorised Spona support staff review responses and their status history to improve usability and service quality. Summary reports count submitted responses, not unique people or all customers. This feedback is not used to assess employees or financing eligibility and is not sent by this feature to Google Analytics, OpenAI or another analytics provider. Existing hosting and security processing still apply, including short-lived abuse controls using hashed identifiers. The enquiry and support retention criteria and rights-request procedure in this notice apply. Contact [email protected] for the criteria applying to your response or an access or deletion request. Sending feedback does not open a support case or promise a reply; use Help & support if you need assistance.
Optional registration source measurement
With fresh website analytics consent, Spona keeps only approved source, medium and campaign labels in first-party sessionStorage under spona.website.acquisition for up to 30 minutes since the last consented page visit. This preserves a coarse source through website navigation. A registration click carries these labels in the ERP link; it carries no visitor identifier, click identifier, original referral URL, search query or account data. Only a separate, current ERP analytics choice (spona-erp-cookies-v3) allows the labels to accompany the successful-registration event in the isolated Google frame. Both the ERP and frame validate the approved labels independently. The Google campaign configuration uses those labels; absent or rejected labels are marked unknown. It does not recover earlier unattributed registrations or join website and ERP visitor identifiers. Labels are not saved against a customer account, and operational company reports are not attributed to Google visits. Website withdrawal removes its source storage and decorated links; ERP refusal or withdrawal prevents the registration event. Earlier ERP refusals remain effective, while earlier grants require a new choice for this expanded measurement. Browser restrictions can prevent delivery. Existing Google processing, network information and cookie disclosures continue to apply.
Delivery evidence, receipt links and discrepancies
When Delivery notes is enabled, the company can retain captured issuer and customer names, delivered item quantities, optional carrier notes, exact offer-line references, private supporting files and their saved revision, and operational recovery receipts. A recipient using a confirmation link can enter a name and report a discrepancy; the company can retain the response, date, revision and private review note. An entered name is a recipient claim, not independently verified identity. A discrepancy does not confirm receipt or change delivered quantities. Anyone holding an active confirmation link can read its quantity-only delivery summary and submit the supported recipient action. Private files and company review notes are not exposed by that link. The company can explicitly revoke or replace link access; disabling the add-on alone does not withdraw previously issued delivery links. Link changes do not erase existing receipt, response, revision or audit evidence. Current company and action permissions control private access and downloads. Removal of a file association excludes it from ordinary use while retaining original bytes and provenance under the existing customer-directed retention, rights and deletion procedures. The customer determines lawful purposes, required recipient notices and applicable recordkeeping instructions. Capacity limits and abuse controls do not set legal retention periods. This workflow adds no external provider or automatic external sending, makes no financial transaction and adds no private files or discrepancy text to AI context.