ERP1. Hosting and service providers
Hosting provider: Hetzner. Hosting location: Nuremberg, Germany. Purpose: operating the Spona website and platform infrastructure, including storage and processing needed to deliver the service. Information about Hetzner and its data-processing agreement: https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/. Other services, including separate email delivery, external file storage, backups and optional AI, require service-specific provider and location disclosures before use. Contact [email protected] for the register applicable to your service. A provider’s own certification does not certify the Spona application.
2. Retention and deletion
Retention depends on the record and purpose. Accounts are retained for service administration and closure; enquiry and support records for response, resolution and related claims; business and financing records for the agreement, instructions and applicable statutory obligations. Legal holds apply only to the necessary scope. Presence buckets and page-view records use a 90-day pruning window triggered by application activity; this is not a universal retention period for other records or backups. Website consent preferences last up to 180 days. For account export, closure, deletion or the applicable retention criteria, contact [email protected]. Customer-controlled personal data is returned or deleted according to the DPA, subject to lawful retention. Recovery copies must not reintroduce deleted records into normal processing. The annual signatory-ID renewal date does not authorise indefinite storage or require automatic erasure on that date. Current and earlier copies follow the financing-record retention criteria above, including applicable legal recordkeeping and claims requirements; unnecessary copies must be reviewed for deletion under that process. Contact [email protected] for the period or criteria applying to your record.
3. Make a request
Email [email protected] with the subject “Privacy request”, “Data export” or “Account closure”. Include the relevant company, service and a concise description; do not send passwords, full identity documents or unrelated employee records. We may need proportionate identity and authority checks. An individual’s GDPR request and a company’s complete ERP export are different requests and may have different scopes. For records controlled by your employer or another customer, contact that organisation; the platform supports its response.
4. Google Analytics — website measurement
Updated 21 September 2026. Google Analytics 4 provides optional website measurement after analytics consent. The Spona - GA4 property uses the Spona - WEB stream. Its event-data retention is set to 2 months and user-data retention to 14 months, with reset on new activity enabled; aggregated standard reports are not governed by these same limits. The separate browser consent and cookie lifetime is 180 days. Google may process data outside the EEA under the applicable contractual and transfer arrangements; this service is not covered by the location of Spona’s Hetzner hosting. Information about Google processing is available at https://policies.google.com/technologies/partner-sites and https://privacy.google.com/businesses/processorterms/. Contact [email protected] for information about applicable safeguards or to make a privacy request. With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox.
5. Native reporting and analytics retention
Native Spona browser analytics uses a separate analytics store and restricted Spona reporting access. It does not send these events to Google or PostHog through the native collector. Hetzner hosting in Nuremberg, Germany remains the stated hosting arrangement; additional providers or transfers must be disclosed before use. The 180-day browser-choice lifetime and the existing 90-day operational presence pruning rule are not deletion guarantees for the separate analytics database. Retain personal operational and analytics records only as necessary for their stated purpose, applicable obligations and limited legal holds, with a documented schedule for each dataset. Retention policy updated 21 September 2026: raw native browser events are kept for 90 days from the event date, security-event analytics copies for 180 days from the event date, and successfully delivered queue copies for 7 days from delivery. Bounded scheduled cleanup uses complete UTC days; operational session records and other audit trails have separate retention rules. Anonymous daily traffic totals, without browser, user or session identifiers, are retained for 24 months. Daily visitor counts cannot identify unique visitors across multiple days. Relevant records under a documented, time-limited legal hold are excluded from cleanup; undelivered events are investigated rather than silently deleted. Backups remain subject to the separate recovery policy. Withdrawal stops future optional collection; a separate rights request may cover retained records, subject to applicable exceptions and the ability to identify them. Contact [email protected] without sending passwords or unnecessary business documents. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact [email protected] for access, objection or deletion requests; collection can be suppressed for the company while a request is handled.
6. CRM record review
CRM uses the existing Spona hosting, private file storage and notification providers described in this notice. It introduces no separate CRM analytics, enrichment or mailbox provider. Authorised CRM administrators can set a review interval and company instructions, review active and archived records, record a reason for keeping them, and export review evidence. No universal CRM retention period is applied: the interval is chosen by the company, starts unconfigured and does not delete records. Export access and record access remain permission-controlled. For permanent deletion or a rights request, contact [email protected] so the required scope, linked records, legal obligations and recovery procedures can be assessed.
7. Optional Meta access and retention
Meta is an external platform selected and authorised by the company, not a provider automatically activated for every ERP account. Its applicable terms govern its own services, locations and transfers; this notice does not promise that Meta processing remains in the EU. Unfinished connection attempts and their discovery data expire after ten minutes and are purged by a scheduled cleanup running every minute while the API is available. Saved credentials remain until replaced, disconnected or invalidated during a connection check, subject to account deletion and applicable retention instructions. Disconnecting deletes Spona’s saved credential and selected accounts for that company and purpose; a minimal connection status, actor and audit history remain under the existing audit-retention rules. It does not delete Meta content or revoke other companies’ connections. Full provider-side revocation is available in Meta’s business integration settings.
Insights AI Summary — optional paid processing
When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA.
Spona AI — questions and optional financial explanations
When the relevant Spona AI feature is enabled for your workspace, OpenAI processes questions you choose to submit about invoices, permitted guides, procurement comparisons, cash timing, selected Work stage costs or Sales and Work planning. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Where available, GPT explanations of procurement comparisons and cash timing are optional. Spona first shows the question, language and exact summary facts that would be sent. Nothing is sent to OpenAI to prepare this preview; sending starts only when you choose Send to GPT. Procurement facts can include recorded prices, quantities, comparison periods, counts and calculated differences from your company's own accepted-order history. Cash facts can include the plan period, missing-evidence counts, projected balances and dates, the payment-history comparison and, if selected, the receipt amount, dates and calculated effects of your temporary scenario. These are financial data. Company, customer and supplier names, invoice numbers, record identifiers, complete invoice lists, source documents and the full cash curve are not automatically added. Spona calculates the figures; the explanation does not change records or save the scenario. A calculation or scenario does not guarantee a future outcome. Earlier questions and answers are not included in these requests. Where available, optional Work cost explanations use the currently selected stage. Spona shows your question and exact stage facts in your chosen language before you choose Send to GPT; preparing the preview sends nothing to OpenAI. Facts can include original EUR stage values, recorded costs, reviewed remaining commitments and additional estimates, expected cost, budget differences, indicative margin, review date, coverage and overhead settings. Aggregate recorded costs may include invoice, purchasing or payroll allocations. These financial data are not guaranteed anonymous. Names, record identifiers, individual invoice or payroll details, detailed purchase lines, notes, source documents, full records and history are not automatically added. Spona calculates the figures; GPT explains the supplied stage evidence without changing records, calculating a new hypothetical scenario or guaranteeing final company profit. Earlier questions and answers are not included in Work requests. Where available, optional Sales and Work planning explanations use the source you selected. Spona shows the exact question, language and summary facts before you choose Send to GPT. Preparing a plan, temporary target comparison or preview makes no OpenAI request. Sales facts can include the selected months, scope and currency, recorded won and open deal totals, manually weighted pipeline values, missing-data counts and, if you compared a target, that temporary target and the supported calculated difference. Manual weights are recorded assumptions, not guaranteed chances of winning. Work facts can include the selected months, planning date, original EUR stage values before VAT, scheduled values, counts and values requiring date review and, if you compared a target, that temporary scheduled-value target and its calculated difference or surplus. Work values describe recorded plans, not agreed contracts, remaining effort, revenue, cash or capacity. These are financial data and are not guaranteed anonymous. Names, record identifiers, individual deal or stage rows, full lists, private costs, source documents and earlier questions or answers are not automatically added. Sales and Work facts are kept separate. Spona calculates the figures; GPT explains the reviewed evidence and possible read-only next steps without changing records, saving targets or guaranteeing future outcomes. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. Invoice and guide modes can keep the current draft and answer when you close the panel or move between screens. Closing the panel clears the optional procurement-comparison question and answer, and the cash view including its temporary scenario and question. Changing the selected comparison, cash assumption, company, language or access can also clear the affected context. Closing the panel also clears the Work question, preview and explanation. Refreshing or opening stage evidence, navigating away, or changing the stage, company, language, session or access clears that temporary Work context. If source evidence changes, a new preview is required before further use. Closing or leaving the planning view, refreshing, opening source evidence or changing the company, language, session or access also discards the temporary planning question, preview and answer. Editing its source, months, scope, currency, target or question invalidates the affected preview and answer. A fresh preview is required for changed planning evidence. Clear conversation removes panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact [email protected] for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact [email protected] for the applicable provider information and transfer safeguards.
Optional registration source measurement
With fresh website analytics consent, Spona keeps only approved source, medium and campaign labels in first-party sessionStorage under spona.website.acquisition for up to 30 minutes since the last consented page visit. This preserves a coarse source through website navigation. A registration click carries these labels in the ERP link; it carries no visitor identifier, click identifier, original referral URL, search query or account data. Only a separate, current ERP analytics choice (spona-erp-cookies-v3) allows the labels to accompany the successful-registration event in the isolated Google frame. Both the ERP and frame validate the approved labels independently. The Google campaign configuration uses those labels; absent or rejected labels are marked unknown. It does not recover earlier unattributed registrations or join website and ERP visitor identifiers. Labels are not saved against a customer account, and operational company reports are not attributed to Google visits. Website withdrawal removes its source storage and decorated links; ERP refusal or withdrawal prevents the registration event. Earlier ERP refusals remain effective, while earlier grants require a new choice for this expanded measurement. Browser restrictions can prevent delivery. Existing Google processing, network information and cookie disclosures continue to apply.