About this agreement
This agreement is between Spondo, Shoreditch Exchange, Senna Building, Gorsuch Place, London E2 8JF ("we"), and the organisation that uses Spondo ("you"). It forms part of our terms of service, or of any separate agreement you've signed with us, and applies whenever we process personal data for you. It meets Article 28 of the UK GDPR and the EU GDPR. If you'd like a countersigned copy, or want us to sign yours instead, email security@getspondo.com. Where this agreement and the terms differ on personal data, this agreement wins.
Roles
You're the controller of the personal data you send to Spondo, and we're your processor. "Personal data", "processing", "personal data breach", "data subject" and "supervisory authority" mean what they mean in the UK GDPR and EU GDPR.
Your instructions
We process personal data only on your documented instructions: these terms, this agreement, and how you set up and use Spondo (which tools and systems you connect, and what you turn on). We'll tell you if we think an instruction breaks data protection law. If the law makes us process data any other way, we'll tell you first, unless the law forbids that.
Our people
Only people who need it to run or support Spondo can reach your personal data, and each is bound by confidentiality. Today that's Spondo's two founders. Inside your account, they can only look while support access is on, read-only: during the design-partner phase that's from the start, as the terms say, until your owners or admins turn it off.
Security
We protect your personal data with the technical and organisational measures in Annex 2, as Article 32 requires, and keep them up to date. We can improve them, but won't reduce the overall level of protection.
Sub-processors
You authorise the sub-processors in Annex 3. We'll give you at least 30 days' notice, by email to your account owners, before adding or replacing one. If you object on reasonable data protection grounds, we'll work with you to resolve it; if we can't, you may end your use of Spondo before the change takes effect. Each sub-processor is bound by a written contract with data protection obligations at least as protective as these, and we remain responsible to you for its work.
Where data is processed
Your personal data is stored in the EU (Frankfurt). We won't transfer it outside the UK and EEA, or let a sub-processor do so, unless an approved safeguard covers the transfer: an adequacy decision or regulation, or the EU Standard Contractual Clauses with the UK Addendum.
Helping you
Taking into account what Spondo does and the information we hold, we'll help you respond to people exercising their rights (access, correction, erasure, restriction, portability and objection), and with security, breach notifications, data protection impact assessments and consultations with a supervisory authority. If a request about your data comes to us directly, we'll pass it to you and won't answer it ourselves unless you ask us to.
Personal data breaches
We'll notify your account owners, and any contact you've named to us, without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting your data. We'll tell you what we know: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and what we've done and propose to do. Where we don't yet know everything, we'll send what we have and follow up as we learn more. We keep a record of every personal data breach, its effects and the action taken.
Deletion at the end
When your use of Spondo ends, we delete your personal data within 30 days, or sooner if you ask, unless the law requires us to keep it. Before then you can export your journals and reports, or ask us for a copy of your data. Deleted data ages out of our hosting provider's backups within 7 days and can't be restored after that. We'll confirm deletion in writing on request.
Audits
We'll give you the information you reasonably need to show that we meet this agreement, including answering security questionnaires and sharing our hosting provider's certifications. If that isn't enough, or a supervisory authority requires it, you may audit our compliance once a year, on 30 days' notice, during business hours, at your own cost, and under confidentiality, by yourself or an independent auditor who isn't our competitor.
Liability and law
Each of our liability under this agreement is subject to the limits in the terms, except where the law doesn't allow it to be limited. This agreement lasts as long as we process personal data for you, and is governed by the law of England and Wales.
Annex 1: Processing details
- Subject matter and purpose: reporting and accounting for your organisation's AI tool costs by person, team and project, and preparing month-end journals for your accounting software.
- Duration: while you use Spondo, then until deleted as above.
- Nature: collecting, storing, organising, analysing and deleting.
- Data subjects: your staff and contractors who use AI tools, and your users of the Spondo app.
- Personal data: work emails, names and AI tool usernames; AI usage tied to them (cost, token counts, model, session ID, timestamp, share of plan limit used); repository, folder and branch names, which can contain people's names; app users' name, email, hashed password, and each login session's IP address and browser; and personal data in invoices you upload.
- Never collected: prompts, responses, code, file contents or names, full paths, git remote URLs, commit messages, terminal commands or credentials.
- Special category data: none intended. Don't send it.
Annex 2: Security measures
- Data minimisation by design: usage counts and project labels only, cut to an allowlist of fields before storage.
- HTTPS (TLS 1.2 or later) on every connection.
- Third-party tokens, billing keys, single sign-on client secrets and two-factor secrets encrypted with AES-256-GCM before they reach the database, with keys held only in the host's secret store. Passwords stored hashed; telemetry tokens stored only as SHA-256 hashes.
- Connections to your systems use the narrowest access available, read-only where the provider offers it, and your admins can revoke any of them at any time.
- Every record carries its organisation's ID, and every query is scoped to it.
- App logins with two-factor authentication or single sign-on (OIDC), rate-limited attempts and signed, HTTP-only session cookies.
- Production access limited to the founders, with MFA on hosting, database and code accounts. Support access to your account only while it's on (from the start during the design-partner phase, until you turn it off), read-only and logged.
- Managed PostgreSQL with point-in-time recovery, in Render's Frankfurt region.
- Written policies for information security, vulnerability management with fixed remediation timelines, incident response, business continuity, and data retention and deletion.
Our security page describes these in more detail.
Annex 3: Sub-processors
- Render: hosting and managed database, Frankfurt, EU. Holds SOC 2 Type II and ISO 27001.
- Resend: account emails such as password resets and invitations, EU region. Receives only the recipient's address and the email.
- PostHog: product analytics, masked session replay and error tracking, EU cloud. Knows users by an internal ID, never their email, with every input and all on-screen text masked.