The short version
- This website sets no cookies of its own and uses no analytics, advertising or tracking.
- We use the details you send us only to reply to you and to supply Spanner. We never sell them, and we don't add you to marketing lists or send newsletters.
- Spanner keeps your planograms and data on your own PC. When you use Spanner AI, the parts of your work a task needs are sent to the AI model you've chosen. We don't store your AI conversations.
- You can ask us what we hold about you, and ask us to correct or delete it, at any time.
Who we are
Cat Man Toolkit and Spanner are made by Productive Insights Ltd, a company registered in England and Wales (company number 12550741). We decide how the personal data described here is used, so we are its controller under UK data protection law.
When your organisation uses Spanner, the business data you work with, such as planograms, product libraries and sales data, belongs to your organisation. If it includes personal data, we handle it only to provide Spanner's features to your organisation, as its processor.
For any privacy question or request, email enquiries@catmantoolkit.com.
This website
Our pages set no cookies and contain no analytics, advertising or tracking code of our own.
Like any website, our web server receives your IP address and browser details when you load a page. It may keep them briefly in its logs, to keep the site secure and running.
Some parts of our pages come from other services, which also receive your IP address and browser details when your browser fetches them:
- Fonts from Google Fonts.
- Page styles and scripts from public code libraries, including jsDelivr, cdnjs (Cloudflare), Google and BootstrapCDN.
- Our partners' logos from Wix, which hosts their websites.
- Our contact form, a Google Form shown inside our pages. Google provides it and may set its own cookies when it loads.
- Demo bookings through Microsoft Bookings, which opens when you choose Book a Demo.
Links to other websites, including our social media pages, take you to sites with their own privacy policies.
When you contact us
When you email us, fill in our contact form, book a demo or ask about a trial, we receive the details you give us. These are usually your name, email address, company and role, plus your phone number and message if you include them. For a trial we also ask which retailers you plan for and how many people would use Spanner.
We use these details to reply to you, arrange demos and trials, prepare quotes and supply licences. We do this because we have a legitimate interest in answering business enquiries, or because you've asked us to take steps towards a contract.
Emails and bookings are held in our Microsoft 365 account, and contact form answers in our Google account. If you send us files for support, we use them only to help you.
Our free tools
- Online PSA viewer: your browser opens the file you choose, on your own computer. The file isn't uploaded to us or to anyone else.
- Image checker: your browser loads each image straight from the address you paste in. We don't receive the addresses or the images.
The Spanner app
Spanner runs on your own PC. Your planograms, product libraries, sales data and settings are saved where you choose, and aren't sent to us.
To activate and check your licence, Spanner contacts our licence service. It sends a code for the installation, your organisation's licence reference and the licence expiry date, and we record when each installation last checked in.
When you install or update Spanner, files download from our website and from Microsoft, which see your IP address as for any download.
Spanner AI
Spanner AI is optional. Your organisation can choose which AI models are available, and Spanner's permissions settings control what the AI may read, change or delete.
What is sent
When you use the AI chat in Spanner, your messages and any images you add are sent to the AI model you've chosen. So are the parts of your open document a task needs, such as products, fixtures and sales figures. Everything travels through our AI service, which runs on Microsoft Azure.
What we keep
Our AI service holds each conversation in memory so you can carry on where you left off. It discards the conversation an hour after your last message, and after four hours at most. We don't save your conversations, documents or images.
We record the AI credits each request uses against your organisation's account.
The AI providers
Depending on the model you choose, your request is processed by Microsoft (Azure AI Foundry, for OpenAI and Anthropic Claude models), Google (Gemini models, through Vertex AI or the Gemini API) or Amazon Web Services (Amazon Bedrock). Some models run in the UK or EU. Others are processed in the United States or wherever the provider has capacity.
We use these providers' paid business services. Under their terms they don't use your data to train their models, though they may keep it for a short time to detect misuse.
Using Spanner from Copilot and other AI assistants
You can use Spanner from Microsoft 365 Copilot, Claude or another assistant that supports MCP (the Model Context Protocol). The assistant connects to Spanner on your PC through our cloud service, using the session key Spanner shows you.
- Your conversation is handled by your assistant's provider (Microsoft, for Copilot) under your organisation's agreement with them. Spanner's commands and their results pass through our service between the assistant and your PC. We don't store them.
- Session records: when Spanner connects, we store the session key, the time, your organisation's reference and your saved merchandising rules, so the assistant can follow those rules. We delete these records once they're 10 days old.
- Microsoft 365 Copilot: Microsoft sends us a sign-in token. We read only your organisation's Microsoft tenant ID from it, to check that your organisation has Spanner. If that tenant isn't linked to a Spanner organisation, we log its ID so we can help your administrator set it up.
- Connector keys for other assistants are stored only in scrambled (hashed) form.
- Our logs record which commands ran, how long they took and how much data came back. They don't record the content.
Our cloud service also uses your IP address, held in memory for a minute at a time, to limit how many requests one address can make.
Who we share data with
We don't sell personal data or share it for advertising. These companies process data for us, under contract, to run our services:
- Microsoft: email and calendar (Microsoft 365, including Bookings), hosting for our AI and cloud services (Azure), and AI models (Azure AI Foundry).
- Google: our contact form (Google Forms), AI models (Vertex AI and the Gemini API) and web fonts.
- Amazon Web Services: AI models (Amazon Bedrock).
- Our website hosting provider, which runs the server for this website and Spanner's downloads.
We'll also share information if the law requires us to.
Data outside the UK
Some of these providers process data outside the UK, including in the EU and the United States. Where they do, the transfer is protected by safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK–US data bridge.
How long we keep data
| Information | How long we keep it |
|---|---|
| Enquiries, contact form answers and demo bookings | Up to two years after we were last in touch, unless you become a customer |
| Customer and licence records | For as long as you have a licence, then up to six years for accounting and legal reasons |
| Spanner AI conversations and images | In memory only: discarded an hour after your last message, and after four hours at most |
| Cloud session records and merchandising rules | Up to 10 days |
| Web server and cloud service logs | A short time, for security and troubleshooting |
Keeping data secure
Connections to our website and cloud services are encrypted. Only people who need access to personal data to do their job can reach it. In Spanner, AI changes go into your undo history, and cloud connections close by themselves after a period of inactivity.
Your rights
Under UK data protection law you can ask us:
- for a copy of the personal data we hold about you;
- to correct it, or to delete it;
- to restrict how we use it, or to stop using it;
- to send it to you or to another organisation in a common format.
Email enquiries@catmantoolkit.com and we'll reply within one month. If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Our website and software are for business use and aren't aimed at children.
Changes to this policy
If we change how we handle personal data, we'll update this page and the date at the top.