SPONA ERP — LEGAL DOCUMENTS

2026-10-11 · 1.30

English is the governing language of the Terms to the extent permitted by law.

# Providers, retention & requests

## 1. Hosting and service providers

Hosting provider: Hetzner. Hosting location: Nuremberg, Germany. Purpose: operating the Spona website and platform infrastructure, including storage and processing needed to deliver the service. Information about Hetzner and its data-processing agreement: https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/. Other services, including separate email delivery, external file storage, backups and optional AI, require service-specific provider and location disclosures before use. Contact connect@spona.io for the register applicable to your service. A provider’s own certification does not certify the Spona application.

## 2. Retention and deletion

Retention depends on the record and purpose. Accounts are retained for service administration and closure; enquiry and support records for response, resolution and related claims; business and financing records for the agreement, instructions and applicable statutory obligations. Legal holds apply only to the necessary scope. Presence buckets and page-view records use a 90-day pruning window triggered by application activity; this is not a universal retention period for other records or backups. Website consent preferences last up to 180 days. For account export, closure, deletion or the applicable retention criteria, contact connect@spona.io. Customer-controlled personal data is returned or deleted according to the DPA, subject to lawful retention. Recovery copies must not reintroduce deleted records into normal processing.

The annual signatory-ID renewal date does not authorise indefinite storage or require automatic erasure on that date. Current and earlier copies follow the financing-record retention criteria above, including applicable legal recordkeeping and claims requirements; unnecessary copies must be reviewed for deletion under that process. Contact connect@spona.io for the period or criteria applying to your record.

## 3. Make a request

Email connect@spona.io with the subject “Privacy request”, “Data export” or “Account closure”. Include the relevant company, service and a concise description; do not send passwords, full identity documents or unrelated employee records. We may need proportionate identity and authority checks. An individual’s GDPR request and a company’s complete ERP export are different requests and may have different scopes. For records controlled by your employer or another customer, contact that organisation; the platform supports its response.

## 4. Google Analytics — website measurement

Updated 21 September 2026. Google Analytics 4 provides optional website measurement after analytics consent. The Spona - GA4 property uses the Spona - WEB stream. Its event-data retention is set to 2 months and user-data retention to 14 months, with reset on new activity enabled; aggregated standard reports are not governed by these same limits. The separate browser consent and cookie lifetime is 180 days. Google may process data outside the EEA under the applicable contractual and transfer arrangements; this service is not covered by the location of Spona’s Hetzner hosting. Information about Google processing is available at https://policies.google.com/technologies/partner-sites and https://privacy.google.com/businesses/processorterms/. Contact connect@spona.io for information about applicable safeguards or to make a privacy request.

With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox.

## 5. Native reporting and analytics retention

Native Spona browser analytics uses a separate analytics store and restricted Spona reporting access. It does not send these events to Google or PostHog through the native collector. Hetzner hosting in Nuremberg, Germany remains the stated hosting arrangement; additional providers or transfers must be disclosed before use. The 180-day browser-choice lifetime and the existing 90-day operational presence pruning rule are not deletion guarantees for the separate analytics database. Retain personal operational and analytics records only as necessary for their stated purpose, applicable obligations and limited legal holds, with a documented schedule for each dataset. Retention policy updated 21 September 2026: raw native browser events are kept for 90 days from the event date, security-event analytics copies for 180 days from the event date, and successfully delivered queue copies for 7 days from delivery. Bounded scheduled cleanup uses complete UTC days; operational session records and other audit trails have separate retention rules. Anonymous daily traffic totals, without browser, user or session identifiers, are retained for 24 months. Daily visitor counts cannot identify unique visitors across multiple days. Relevant records under a documented, time-limited legal hold are excluded from cleanup; undelivered events are investigated rather than silently deleted. Backups remain subject to the separate recovery policy. Withdrawal stops future optional collection; a separate rights request may cover retained records, subject to applicable exceptions and the ability to identify them. Contact connect@spona.io without sending passwords or unnecessary business documents. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact connect@spona.io for access, objection or deletion requests; collection can be suppressed for the company while a request is handled.

## 6. CRM record review

CRM uses the existing Spona hosting, private file storage and notification providers described in this notice. It introduces no separate CRM analytics, enrichment or mailbox provider. Authorised CRM administrators can set a review interval and company instructions, review active and archived records, record a reason for keeping them, and export review evidence. No universal CRM retention period is applied: the interval is chosen by the company, starts unconfigured and does not delete records. Export access and record access remain permission-controlled. For permanent deletion or a rights request, contact connect@spona.io so the required scope, linked records, legal obligations and recovery procedures can be assessed.

## 7. Optional Meta access and retention

Meta is an external platform selected and authorised by the company, not a provider automatically activated for every ERP account. Its applicable terms govern its own services, locations and transfers; this notice does not promise that Meta processing remains in the EU. Unfinished connection attempts and their discovery data expire after ten minutes and are purged by a scheduled cleanup running every minute while the API is available. Saved credentials remain until replaced, disconnected or invalidated during a connection check, subject to account deletion and applicable retention instructions. Disconnecting deletes Spona’s saved credential and selected accounts for that company and purpose; a minimal connection status, actor and audit history remain under the existing audit-retention rules. It does not delete Meta content or revoke other companies’ connections. Full provider-side revocation is available in Meta’s business integration settings.

## Insights AI Summary — optional paid processing

When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA.

## Spona AI — invoice and guide questions

When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request.

Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions.

Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion.

Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards.