The short version
- You can work in Spanner from an AI app of your own, such as Microsoft 365 Copilot or Claude. Nothing connects unless you allow it.
- A connected app can read and change your Spanner documents, within the AI permissions set in Spanner.
- What Spanner sends back goes to the AI app's provider, under your organisation's agreement with them. A connection on your PC doesn't pass through us. A cloud connection passes through our service, which doesn't store the commands or their results.
- No AI credits are used: your AI app's own model does the work.
- Whether your data may go to that app, and checking its work, is your organisation's decision. This page gives you what you need to make it.
What an AI app can do in Spanner
When an AI app connects, Spanner gives it its instructions and the commands it can use. The app can then read the documents you have open, including products, fixtures and sales figures, and make changes, such as building or editing planograms and importing data.
- Spanner's AI permission settings limit what it can do with settings and files, and which folders it can search. Deleting files and searching network folders are off unless you turn them on.
- Changes go into your undo history, so you can step back through them.
Spanner's own AI chat works differently: there, we provide the AI model. See Using Spanner's AI chat.
Two ways to connect
spanner-mcp, which talks to Spanner through files on the same PC, so commands and results don't reach us.
Teal: Spanner's own AI chat, the only part that uses a model we provide.
Whichever route an app uses, Spanner also fetches its AI instructions and command list from our service.
On your PC
Your AI app, such as Claude Desktop, starts Spanner's MCP connector (spanner-mcp) on the same PC. Spanner asks whether to allow the app for this session.
- Commands and their results pass between the app and Spanner on your PC. They don't reach us.
- Spanner fetches its AI instructions and command list from us. For that it sends your organisation's licence reference, an access code and Spanner's version, and nothing from your documents.
Through our cloud service
Microsoft 365 Copilot, and AI apps that connect over the internet, reach Spanner on your PC through our cloud service. You give the app the session key that Spanner shows you.
- Copilot: your administrator first asks us to link your Microsoft tenant to your Spanner organisation. Copilot asks you to confirm each change before it's made.
- Other AI apps use a connector key that we issue to your organisation.
IT teams: see Setting up Spanner in Microsoft 365 Copilot.
What our cloud service sees and keeps
- Commands and their results pass through our service, but aren't stored.
- We keep a record of each connected session, with your saved merchandising rules so the AI app can follow them, for up to 10 days.
- Our logs record which commands ran, how long they took and how much data came back, but not the content.
- Connector keys are stored only in scrambled (hashed) form.
Our privacy policy gives the full details. Our data processing terms cover any personal data that passes through.
Your AI app's provider
Your conversation, and whatever Spanner sends back to the app, go to the company that runs the app's AI model: Microsoft for Copilot, Anthropic for Claude, and so on. That can include product lists, planogram details, sales figures and images of your planograms. The provider handles it under your organisation's agreement with them, not under ours.
Before you connect, check that provider's terms, in particular:
- where it processes your data;
- whether it can use your data to train its models (business plans usually rule this out, but some personal plans allow it);
- how long it keeps your conversations.
What's yours to manage
- Whether your data may go to the AI app. That depends on your own AI policies, your contracts with retailers and data providers, and any personal data involved. Licences for syndicated data, such as NielsenIQ or Circana data, often limit who it can be shared with.
- Which AI apps your people use, and on which plans.
- The AI permissions set in Spanner.
- Checking the app's work before you rely on it or share it. That includes product placement rules (such as for HFSS and age-restricted products), fixture load limits and retailers' requirements.
- Backups. Undo is not a backup.
- Session keys and connector keys. Keep them secret, and tell us straight away if one may have been exposed.
Ending a connection
- On your PC: a connection lasts until Spanner or the AI app closes. To stop an app connecting, decline when Spanner asks, or remove Spanner from the app's settings.
- Through our cloud service: the connection closes when Spanner closes, or after a period of inactivity. You can ask us to unlink your Microsoft tenant or cancel a connector key at any time.
- For your whole organisation: each connection on a PC has to be allowed in Spanner on that PC, and your IT team controls which AI apps are installed. We link Microsoft tenants and issue connector keys only when your organisation asks.
The legal side
Using the connectors is covered by the Spanner licence (EULA), so there's nothing extra to sign. Where personal data passes through our cloud service, our data processing terms apply. This page explains how the connectors work and what you should be aware of. It doesn't add to the EULA.
Questions? Email enquiries@catmantoolkit.com.