ERP1. Intended scope and activation
Spona intends to develop product analytics, anonymised benchmarks, AI training and evaluation, marketing and financing-partner collaboration. These are distinct purposes, not an unlimited data licence. This notice defines conditions for future activation; it does not state that all these uses currently operate. Each programme needs an identified controller, data categories, legal basis, recipients, duration and safeguards before it starts. The customer may authorise use of content it owns but cannot consent on behalf of employees, contacts or other individuals without lawful authority.
2. Product analytics and research
Use the minimum events and attributes needed to understand feature adoption, reliability and user experience. Where legitimate interests are proposed, document the specific benefit, necessity, less intrusive alternatives, reasonable expectations and balancing of individual rights; provide the applicable objection route. Obtain prior consent for non-essential browser access where required even if subsequent processing has another GDPR basis. Research is not a universal exemption. Cross-module linkage, employee-level analysis and new purposes require a fresh assessment and updated information before use. Core business reporting is designed to use authoritative server records rather than optional navigation events: registrations and verification, persisted business records and financing workflow outcomes. Reports must state which sources and historical coverage are actually available; this notice does not assert that every funnel is already implemented. Browser measurement remains separately consented and cannot be silently reclassified as necessary operational processing. Do not infer distinct users or company adoption from resetting random browser identities. Existing ERP employee-activity features remain subject to the separate safeguards in the Privacy Notice. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact connect@spona.io for access, objection or deletion requests; collection can be suppressed for the company while a request is handled.
3. Anonymous benchmarks and commercial datasets
Spona may retain, combine, license and publish genuinely anonymous statistics for research, product development and commercial benchmarking within the Terms’ safeguards. The process must remove reasonably foreseeable identification, linkage and reconstruction risks and protect confidential business information. Approve dataset provenance, permissions, cohort thresholds, outlier treatment and release tests before distribution; do not invent a numeric threshold as a guarantee of anonymity. Retest when datasets are combined or external information changes. Raw customer records and pseudonymous identifiers are not anonymous commercial outputs.
4. AI training and evaluation programmes
AI inference, model evaluation and model training must be distinguished. For a separately approved training programme, a signed schedule must identify the model and provider, training purpose, data scope and sources, intellectual-property permission, lawful basis, retention, recipients, transfers, opt-out or withdrawal process where applicable and how rights can be honoured in datasets and models. Use genuinely anonymous or synthetic inputs where feasible. Do not include payroll, identity documents, special-category records or confidential customer content by default. Consent, where relied on, must be specific and freely given, with no loss of core ERP access for refusal. A legitimate-interest route requires a documented case-specific assessment; these terms do not predetermine the outcome. No training permission is activated by a general terms checkbox.
5. Marketing and financing collaboration
Service messages needed to operate an account are separate from promotional messages. Marketing programmes must identify channels and recipients and comply with applicable electronic-marketing rules, including consent where required and a simple, free unsubscribe. Do not enrich marketing audiences with customer-controlled employee, salary or client records under the ERP processing licence. Financing disclosures must be limited to relevant application and transaction data and the disclosed recipient’s purpose; a partner’s independent marketing requires its own lawful arrangement. Consent choices must be granular and recorded by purpose and version, and changes must reach downstream recipients where required.
6. Planned Analytics & BI features
Planned capabilities include traffic-source and campaign analysis, landing-page and device/approximate-country breakdowns, new/returning browser measurement and engagement; registration, verification and activation funnels; feature adoption, user journeys, company cohorts and retention; financing submission, review, signature and recorded-payout funnels; configurable reports, exports, anomaly alerts and data-quality diagnostics. Later proposals include click/scroll heatmaps, session replay, feature experiments and voluntary surveys. Some reporting components are already implemented; listing a feature here does not mean its collection is enabled or that historical data exists. Each release must identify its actual data sources, purpose, controller/processor roles, lawful basis, access and retention. Campaign and referral inputs must be allowlisted and stripped of personal data; approximate location must not be presented as precise tracking. Cross-domain attribution or linkage to an account/company requires a separately assessed and disclosed method, not silent identity stitching. Operational funnels must use authoritative records and distinguish unknown, incomplete and immature cohorts. Browser visits alone do not establish account activation, employee productivity, creditworthiness or financing approval.
7. Safeguards before advanced measurement
Heatmaps and replay are not authorised by general Terms acceptance or the existing module-visit choice. Before launch, provide purpose-specific information and obtain any required consent; introduce granular controls and a stop mechanism. Exclude sensitive screens and block inputs, credentials, uploaded documents, messages, payroll and identity/verification data before transmission; masking after capture alone is not sufficient. Do not promise complete masking without testing the actual implementation. Limit replay access, audit access and exports, define a short justified retention period and complete a data-protection impact assessment where required. Experiments must identify assignment identifiers and outcomes, avoid sensitive profiling and not change contractual financing terms or make automated eligibility decisions under an analytics permission. Survey participation is voluntary; explain any link to account records and discourage confidential or sensitive information in free text. New providers, recipients, transfers or materially broader purposes require updated information and fresh consent where necessary. No roadmap entry activates these features or grants a blanket licence to collect data.
Insights AI Summary — optional paid processing
When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA.
Spona AI — invoice and guide questions
When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards.