The short version
- These terms form part of the Spanner End-User License Agreement (EULA). They apply when your organisation uses one of our services in which we handle personal data for it.
- Your organisation decides what data it sends. We handle it only to provide the service, and keep it only as long as our privacy policy says.
- We use the sub-processors listed below, and we tell you before we add one.
- These are the terms that Article 28 of the UK GDPR requires between an organisation and the companies that process personal data for it.
1. When these terms apply
These terms are between Productive Insights Ltd ("we", "us") and the organisation that holds a Spanner licence under the EULA ("you"). They apply when we process personal data on your behalf in providing:
- the AI chat in Spanner;
- the cloud connection for Spanner's AI connectors: the Spanner agent for Microsoft 365 Copilot, and the Spanner MCP connector when an AI app connects to Spanner through our cloud service;
- support, when you send us files or data so that we can help you.
They don't apply to the Spanner MCP connector when it runs directly on your PC, because your data doesn't reach us then. They also don't cover data we handle for our own purposes, such as licence records, where we are the controller and our privacy policy applies.
2. Who does what
You are the controller of the personal data, and we are your processor.
3. What we process
| Service | What we do with the data | How long we keep it |
|---|---|---|
| AI chat | Pass your messages, images and the parts of your documents a task needs between Spanner, our AI service and the AI provider that runs the model you choose, and pass the results back. | In memory only: discarded an hour after the last message, and after four hours at most. |
| Cloud connection for AI connectors | Pass commands and their results between your AI app and Spanner on your PC. Keep a record of each connected session, with your saved merchandising rules, so the AI app can follow them. | Commands and results aren't stored. Session records: up to 10 days. |
| Support | Use the files and data you send us to help you. | Until we have finished helping you, then deleted. |
- Personal data: whatever personal data your organisation includes, such as the names and contact details of your staff and business contacts.
- People it relates to: your staff and users, your business contacts, and anyone else whose personal data you include.
- Purpose and duration: providing the service to you, for as long as you use it.
4. Your instructions
We process the personal data only on your documented instructions, unless the law requires us to do otherwise. If it does, we'll tell you first unless the law forbids that. The EULA, these terms and your use of our services are your instructions. We'll tell you if we think an instruction breaks data protection law.
5. Confidentiality and security
Everyone we authorise to process the personal data is bound by a duty of confidentiality.
We take appropriate technical and organisational measures to protect the personal data, as Article 32 of the UK GDPR requires. These include encrypting it in transit, limiting access to people who need it, storing connector keys only in scrambled (hashed) form, and closing cloud connections after a period of inactivity.
6. Sub-processors
You give us general authorisation to use these sub-processors:
| Sub-processor | What for | Where |
|---|---|---|
| Microsoft (Azure) | Hosting our AI service and cloud connection | United Kingdom [confirm, including the database] |
| Microsoft (Microsoft 365) | Email, when you send us files for support | [confirm] |
| The AI providers on our AI models page | Running the AI models used by the AI chat | As shown for each model |
We'll tell you before we add or replace a sub-processor, by updating this page or the AI models page and, if you ask us to, by email. That gives you the chance to object. If you object and we can't resolve it, you can stop using the service concerned.
We impose data protection obligations on each sub-processor that give at least the protection these terms require. In practice these are the sub-processors' own data processing terms. We remain responsible to you for how they perform.
7. Data outside the UK
Where a sub-processor processes personal data outside the UK, the transfer is covered by UK adequacy regulations, such as the UK–US data bridge, or by appropriate safeguards, such as the UK International Data Transfer Addendum, in that sub-processor's terms.
8. Help, breaches and deletion
Help. Taking into account the nature of the processing, we'll help you respond to people exercising their data protection rights, and help you meet your obligations on security, breach notification, impact assessments and consulting the Information Commissioner. We may charge our reasonable costs for help that takes significant time.
Breaches. We'll tell you without undue delay after we become aware of a personal data breach affecting personal data we process for you.
Deletion. When you stop using a service, we'll delete the personal data we process for you in it, unless the law requires us to keep it. Most of it is deleted much sooner, as section 3 shows.
9. Audits
We'll make available the information you reasonably need to show that we comply with these terms. We'll allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice and at your cost.
10. Your obligations
You decide what personal data your organisation sends to our services. You are responsible for having a lawful basis for it, and for telling the people concerned how you use it.
11. Changes to these terms
We may update these terms, and the date at the top shows the current version. Changes can't reduce the protection that Article 28 of the UK GDPR requires. To be told about changes by email, write to enquiries@catmantoolkit.com.