ERP1. Website storage and your choices
The website stores spona.website.consent in first-party localStorage to remember your privacy choice for up to 180 days. It contains the policy/provider version, choice time, expiry, language and category choices; no account identifier is added. Accept and reject choices use the same duration. The record expires on the next visit or while the page is active; the browser may retain expired bytes until the site runs again or you clear storage. Expired, missing, malformed or outdated records do not enable optional services. If storage is unavailable, the choice applies to the current page session and the site may ask again on reload. Necessary preference storage is used to honour your choice, not to advertise. When you select a website language, spona.website.language remembers that choice in first-party localStorage for up to 180 days, with the language, save time and expiry only. You can change it using the language switcher or remove it by clearing site storage. On a homepage visit without an explicit language, we use your saved choice first, then a country code supplied by Cloudflare from your connection, or your browser language if that code is unavailable. This feature does not request precise device location or store your IP address in the language preference. Explicit language links remain available.
2. ERP authentication
The API sets a first-party HttpOnly cookie named token for authenticated sessions. The source sets no explicit cookie expiry, so browser session handling applies; restoring a browser session may preserve it. The dashboard and command centre also use spona.session in sessionStorage and localStorage to maintain and restore sign-in. Session storage normally lasts for the tab session; local storage has no automatic expiry in the reviewed implementation. Logout clears these client-side records and the current server session. Clearing browser storage alone does not establish that every server session has been revoked. When manual Irish invoice issuance is enabled, the ERP stores the exact confirmed invoice request in first-party sessionStorage under spona.ireland.issue.* before sending it. It contains the selected company and customer references, dates, descriptions, amounts, tax-treatment choice, review digest and request identifier. For enabled itemised domestic VAT, it also contains the declared customer VAT status, the supporting note, each line’s classification and supporting note, and the confirmed scope declarations. For enabled cross-border ordinary B2B services, it also contains the declared business-status evidence type, check and validity dates, external proof references, location and receiving-establishment notes, any non-EU tax or trade reference and independent check, per-line classification and destination-taxability notes, and confirmed scope declarations. Spona records your review; this is not an automated VAT-registration verification. The key is scoped to the company and a digest of the current session; the sign-in token is not copied into this record. This supports an explicit retry of the same request after an interrupted response, reducing duplicate invoices. Nothing is resent automatically. The record is removed after confirmed success, a definite pre-issue review refusal or a login-session change, including logout. Otherwise it lasts for the tab session, which browser session restoration may preserve. Closing the invoice form does not remove an unresolved request. This is requested transaction recovery, not analytics or marketing. If storage cannot be used, the ERP does not send a new issuance request. Before clearing unresolved recovery data or starting in another tab, check issued invoices or contact support; clearing browser storage does not cancel an invoice already created on the server. When the Irish credit-note preview is enabled, the same recovery approach uses spona.ireland.credit.* for the confirmed credit request: company and original invoice references, date, language, reason, selected net reductions or full remaining reversal, review digest and request identifier. Its key also includes the original invoice. Credit recovery is removed after confirmed success, an explicit stale-review refusal or a login-session change; other outcomes retain the request for an explicit retry during the tab session. This does not record a cash refund or cancel a credit note already issued. When Irish refund recording is enabled, spona.ireland.refund.* (including spona.ireland.refund.batch.*) stores the exact confirmed recording or correction request in first-party sessionStorage before submission. It contains company and originating invoice references, payment or batch references, allocations, amounts and fees where applicable, reason, correction date where applicable, review digest and request identifiers. Keys include a digest of the current session and company; whole-bank recovery also includes the invoice, while batch recovery is available across invoices in that company. The sign-in token is not copied into these records. Requests are retried only when you explicitly choose to retry. Confirmed success, an explicit stale-review refusal or a login-session change removes the saved request; uncertain outcomes retain it for the tab session, which browser restoration may preserve. Before clearing an unresolved request or using another tab, check refund history: clearing browser storage does not undo a recorded refund or correction. If recovery storage cannot be used, the ERP does not submit a new request. This is transaction recovery, not analytics or marketing, and does not execute a bank payment. When the saved Irish service-review pilot is enabled, spona.ireland.saved-review.* keeps the exact save, withdrawal or issuance request in first-party sessionStorage before submission. A save includes company/customer/review identifiers, expected revision, service descriptions and prices, dated business/receiving/service-location evidence references and notes, and declared VAT classifications and legal bases. Withdrawal and issuance commands contain the source revision and request identifiers; issuance also includes document language and the preparation digest. The key is bound to the company and a digest of the current session, without copying the sign-in token. Nothing is retried automatically. Confirmed success, a definite pre-write validation or refresh refusal, or a login-session change removes the record. Uncertain outcomes remain for explicit retry during the tab session, which browser restoration may preserve; closing the form does not erase them. If this storage cannot be read and checked, new writes are blocked. Before clearing an unresolved request or using another tab, check the saved review and issued invoices or contact support. Clearing browser storage does not withdraw a server review or cancel an issued invoice. This is requested transaction recovery, not analytics or marketing. When the receiving-establishment review pilot is enabled, spona.ireland.receiving-review.* separately stores the exact confirmed save, withdrawal or issuance command in first-party sessionStorage. It contains company/review identifiers, source revision and digest, request identifier and, for issuance, document language, preparation digest and confirmation. A save command for a new review or a correction also contains the customer identifier, full retained service facts, dated business and receiving VAT evidence, qualification findings, service-selection evidence, prices, tax declarations and the corrected receiving address. This preserves the exact revision requested after an interrupted response. The company/session binding, explicit-only retry, removal after confirmed success or definite pre-write validation/refresh refusal, login-session cleanup, tab-session duration and blocked writes when recovery cannot be checked follow the same rules above. Downloaded revision evidence may include business and receiving-establishment details; exported files remain under your control and are not removed by browser recovery cleanup. Residence reviews use the same recovery record and include absence findings, residence addresses, personal and occupational tie notes, and their dated evidence. Keep this information limited to what is needed for the review. Recovery cleanup does not delete retained server review or invoice history.
3. Accept, refuse or withdraw
Use Reject optional to keep optional services off, Accept all to enable only the configured and disclosed categories, or Manage choices to choose individual categories. Unconfigured categories are disabled; no advance permission is recorded for them. Close or Escape dismisses the settings panel without saving. Cookie settings remains available below the footer and in the legal centre. You can change or withdraw permission there at any time; refusal does not block navigation, calculators or contact features. Changes apply to open tabs on this same origin through browser storage events. This choice does not cover another device, browser, subdomain or ERP application, marketing email, AI training or contractual acceptance.
4. Your controls
You can clear cookies and site storage in your browser settings and sign out of the ERP. Clearing authentication data may require you to sign in again; clearing preferences resets the saved layout. On a shared device, sign out when finished. Privacy requests about server-side records should be sent to connect@spona.io or to your organisation for its ERP records; browser deletion does not delete those records.
5. Google Analytics 4 — updated 4 October 2026
Updated 4 October 2026. Spona uses Google Analytics 4 for optional measurement on spona.io and www.spona.io. Our integration loads Google only after analytics consent, with no analytics requests or denied-consent pings before that choice. It measures allowlisted public page views and clicks to open ERP registration, sign-in or an email to Spona. These clicks indicate intent, not a completed account, successful login or delivered enquiry. After renewed analytics consent, we also measure the referring website origin (without its path, query or fragment) and approved source, medium and campaign labels. Only predefined campaign labels are accepted; arbitrary URL parameters, ad click identifiers, form contents and ERP business records are excluded. Spona subdomains are excluded as acquisition referrers. This website consent does not enable Google Analytics inside the ERP. Google receives browser/device information, cookie identifiers and network information such as IP addresses. Automatic enhanced measurement and Google advertising features are disabled for this integration. Refusing analytics does not prevent use of the website or ERP. With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox.
5a. Optional registration measurement
The ERP cookie banner offers Accept all, Reject optional and Manage preferences. Accepting analytics enables optional Spona page measurement and Google registration measurement without a separate registration checkbox or account switch. With that choice, a successful account-creation response triggers one Google Analytics sign_up event containing the language, registration method and consent notice version. It does not establish email verification, company activation or financing approval. The Google tag runs in an isolated www.spona.io frame, not in the ERP form. No name, email, password, company, account identifier or form content is passed to that frame. Google still receives browser and network information, including an IP address. Separate spona_signup-prefixed analytics cookies are configured on www.spona.io under /analytics/signup/ with a one-second lifetime and no rolling renewal. Browser restrictions may prevent measurement. The ERP stores the version, choice and time in spona.erp.analytics.consent for up to 180 days. It does not join this event to the website visitor identifier. Use Reject optional or turn off Optional analytics in Cookie preferences to refuse or withdraw. Cookie preferences is available on the ERP screen and in Settings. Existing refusals are preserved; an earlier native-only consent does not authorize Google measurement. If the choice cannot be saved, optional collection remains off. The website and ERP remember their choices separately. Registration remains available. Events already sent cannot be recalled; contact connect@spona.io for data-rights requests. Google processing and transfer information is in the Providers and retention notice.
6. Analytics cookies and withdrawal
When analytics is connected and accepted, the integration configures first-party _ga and _ga_<property suffix> cookies on the current hostname and root path, with a 180-day lifetime and rolling updates disabled. Withdrawal sets Google’s measurement-disable flag, stops our page-view listener, removes the tag and accessible _ga cookies, clears its local command queue and reloads the page to unload already executed Google code. Requests already sent cannot be recalled and withdrawing consent does not automatically erase data already received by Google. Contact connect@spona.io for a separate data-rights request. We cannot delete cookies belonging to unrelated sites or applications.
7. Native Spona website analytics
Where configured, Spona’s own website analytics starts only after analytics consent. It uses spona.analytics.anonymous in first-party localStorage for a random browser identifier, separate from the consent preference. It sends allowlisted page categories, language, timestamps, random event identifiers and the consent version to a same-origin Spona endpoint; form values and URL parameters are excluded. The identifier is pseudonymous and is not linked by this collector to an ERP account. Withdrawal stops the listener, aborts pending delivery and removes the identifier; renewed consent creates a new one. There is no persistent browser retry queue. The identifier has no independent fixed expiry in the current implementation and is removed by consent withdrawal, collector cleanup or clearing browser storage. The 180-day preference duration is not the retention period of server event records. Native Spona analytics does not require Google Analytics or PostHog. Any separately enabled third-party provider is subject to its own disclosed controls.
8. Optional ERP module visits
ERP usage measurement follows the analytics choice in the ERP cookie banner; no separate account switch is required. spona.erp.analytics.consent stores the choice, version and choice time in first-party localStorage for up to 180 days. The choice applies to this browser, not an entire company. An in-memory random identifier exists only during consented collection and resets on reload, sign-out or withdrawal. The collector sends broad Home, Work, Purchasing, Sales, Finance and Financing categories, language and event metadata; it excludes People, personal Portal and Messages routes, record IDs, query values, record contents and amounts. Moving between records in the same module does not create another consecutive module visit. Turn collection off through Cookie preferences on the ERP screen or in Settings; pending requests are aborted. Withdrawal cannot recall data already received. Refusal does not affect core access. Cookie controls do not erase separately held security or operational records.
9. Future browser technologies
The Data-use notice describes planned acquisition analysis, funnels, retention, journeys, heatmaps, replay, experiments and surveys, and their activation safeguards. This is advance information about the roadmap, not a statement that every feature is operating. Existing consent does not automatically extend to new tracking purposes or replay. Before introducing materially different browser storage or tracking, disclose its purpose, identifiers, duration, recipients and controls, and obtain fresh consent where required. No future feature is a condition of core ERP access merely because it appears in this notice.
10. Meta connection sign-in
Connecting a Meta account opens a Meta sign-in window only after you choose Connect Meta. The connection uses Spona’s existing signed-in session and temporary connection state; it does not add advertising or analytics tracking to Spona. Meta controls cookies and similar technologies on its own sign-in pages under its notices and settings. Authorising an integration is separate from accepting optional analytics cookies.