Spensa - Privacy Policy

The controller for data processing carried out by Spensa for its own purposes is Spensa Ges.m.b.H., Jungstraße 15/6/18, 1020 Vienna, Austria. You can contact us at hello@spensa.ai.

Spensa has not appointed a data protection officer. Data protection requests can be sent to the contact address above.

Spensa acts as controller for account administration, website operation, billing, security, support, service communication, optional product analytics, and optional measurement of its own advertising.

For personal data that customers upload, enter, or generate while using the service for their own restaurant operations, Spensa usually acts as processor. This includes staff, supplier, invoice, POS, inventory, scheduling, order, and document data. In that role we process personal data on the customer's instructions and under the Data Processing Agreement at /data-processing-agreement.

The service may process data relating to customer administrators, organization members, establishment staff, supplier contacts, customer support contacts, and people named in uploaded or received business documents.

We receive data directly from users, from customer administrators, from documents and files uploaded or emailed into Spensa, from connected operational workflows, from payment and security providers, and from technical logs generated when the service is used.

Account and authentication data: names, email addresses, usernames, roles, permissions, password hashes, login events, invitation data, and session-related technical data.

Customer operational data: organization and establishment data, staff records, supplier contacts, products, orders, order emails, delivery notes, invoices, POS uploads, menu and recipe data, inventory records, schedules, availability, time-off records, shift requests, notes, and attachments.

Billing and contract data: billing contacts, plan data, subscription status, invoices, payment status, and payment provider references.

Support, security, and technical data: messages and attachments sent to Spensa by email, in-app forms, or WhatsApp; WhatsApp profile names and phone numbers; message delivery metadata; device and browser data; IP addresses; timestamps; request logs; error reports; performance data; abuse-prevention tokens; and consent preferences.

Optional analytics data: product usage events and account or organization identifiers processed only if analytics consent is given.

Optional marketing data: visited pages of the public website, referrer, ad click identifiers, browser and device data, IP addresses, cookie identifiers, and the fact that a demo request was sent, processed only if marketing consent is given.

We process personal data to provide and maintain the service, authenticate users, manage organizations and establishments, support restaurant workflows, process documents, send transactional emails, provide billing, respond to support requests, keep the service secure, comply with legal obligations, and improve the product.

For Spensa as controller, processing is based on contract performance or pre-contractual steps, legitimate interests in operating and securing a B2B software service, consent where requested for optional analytics, marketing measurement, or comparable technologies, and legal obligations such as accounting and tax retention.

For customer-controlled operational data, Spensa processes the data on the customer's documented instructions. The customer is responsible for choosing the correct legal basis for its own staff, supplier, and document processing.

Spensa uses automated extraction and AI-assisted processing to read documents, classify attachments, suggest matches, support analytics, and assist users in working with restaurant data.

These functions are assistive. Outputs can be incomplete or incorrect and must be reviewed by users before they are relied on. Spensa does not use these systems to make decisions that produce legal or similarly significant effects for individuals within the meaning of Art. 22 GDPR.

Organization members can connect an external AI assistant, such as ChatGPT or Claude, to Spensa. Each connection is approved by the member in Spensa, is limited to one organization and to the member's existing permissions, and grants either read-only or read and write access. When the assistant calls Spensa on the member's behalf, Spensa returns only the operational data needed for the request, such as products, suppliers, orders, invoices, inventory, recipes, or tasks, and performs only the requested changes. Files shared from the assistant are processed like other uploads. Spensa does not receive the assistant conversation beyond the inputs sent to Spensa.

The provider of a connected assistant receives this data as a recipient chosen by the customer and processes it under its own terms and privacy policy; it is not a Spensa subprocessor. Spensa stores the connection, its granted access and timezone, and a record of each operation with its outcome to prevent duplicate changes, enforce limits, and keep the service secure. Files staged for an assistant are deleted after 24 hours and generated downloads after 7 days. Connections expire after 30 days, after which the connection and its operation records are deleted. Members and organization administrators can disconnect a connection at any time under Settings > Account > Connected apps.

We share personal data only where needed to provide, secure, bill, support, or improve the service, or where required by law. This includes hosting, database, storage, cache, email, WhatsApp messaging, payment, security, analytics, error monitoring, OCR, and AI providers.

If marketing consent is given on the public website, Meta Platforms Ireland Limited and OpenAI receive marketing data as described in section 10. They are not Spensa subprocessors.

The current customer-facing subprocessor list is available at /subprocessors. Customer data is not sold.

Some providers process personal data in the EU or EEA. Others may process data in third countries, including the United States. Where required, Spensa uses adequacy decisions, standard contractual clauses, transfer impact safeguards, or comparable lawful transfer mechanisms.

PlanetScale PostgreSQL and Upstash Redis are configured in EU regions for production database and cache processing.

Marketing data received by Meta and OpenAI after marketing consent may be transferred to the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework.

Account and customer operational data is generally retained for the term of the customer relationship and then deleted or returned according to the contract and the Data Processing Agreement, unless longer retention is required by law or needed to establish, exercise, or defend legal claims.

Billing, accounting, and tax-relevant records are generally retained for seven years under Austrian business and tax retention rules, and longer where a pending proceeding requires it.

Resolved WhatsApp support conversations and their attachments are deleted after 12 months. Unresolved support conversations remain available until they are resolved. Other security logs, error reports, support records, consent records, and backups are retained for limited periods based on operational, security, legal, and recovery needs.

Spensa uses necessary cookies and local storage for login, security, language selection, consent preferences, and core application functions. These are required to provide the requested service.

Cloudflare Turnstile processes technical signals, such as IP addresses, TLS fingerprints, user-agent headers, site keys, and associated origins, to distinguish people from bots and protect Spensa against abuse. Further information is available in the Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/.

Optional product analytics, including Mixpanel, are used only after analytics consent. You can reject optional analytics, accept it, or change your preference later through the privacy settings link.

Sentry is used for error and performance monitoring on the basis of Spensa's legitimate interest in keeping the service secure and reliable. Sentry Session Replay, broad page unmasking for replay capture, and richer browser user context are used only after analytics consent.

Spensa advertises on Instagram and Facebook (Meta) and in ChatGPT (OpenAI). To measure which ads lead to demo requests, the public website uses the Meta Pixel and the OpenAI Measurement Pixel only after marketing consent. Without this consent, neither pixel is loaded and no data is sent to Meta or OpenAI. Marketing consent is off by default.

After marketing consent, the pixels set cookies, such as the Meta _fbp cookie for up to 90 days, and send the marketing data listed in section 4 to Meta and OpenAI. When a demo request is sent, a conversion event with a random event identifier is sent. Spensa does not send the contents of the demo request form, such as your email address, to these providers. The pixels are not used in the Spensa application after login.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act (TKG 2021). You can withdraw marketing consent at any time through the privacy settings link. The pixels then stop sending data; you can delete cookies already set in your browser settings.

For the collection and transmission of data through the Meta Pixel, Spensa and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, are joint controllers under Art. 26 GDPR based on the Meta Controller Addendum: https://www.facebook.com/legal/controller_addendum. Meta is responsible for its further processing: https://www.facebook.com/privacy/policy. OpenAI processes the data it receives under its own privacy policy: https://openai.com/policies/privacy-policy.

Subject to the legal requirements and limits of the GDPR, data subjects may request access, rectification, erasure, restriction, portability, and objection. Where processing is based on consent, consent can be withdrawn at any time with effect for the future.

Requests can be sent to hello@spensa.ai. If Spensa processes the relevant data as processor for a customer, we may forward the request to the customer or ask the data subject to contact the customer directly.

Data subjects also have the right to lodge a complaint with a supervisory authority. In Austria, complaints can be submitted to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at.

Customers and their administrators are responsible for ensuring that they are allowed to upload, enter, email, and process personal data in Spensa. This includes staff data, supplier contact data, invoice data, POS data, scheduling data, and any personal data contained in documents or attachments.

Customers must provide required notices to their own staff, suppliers, and other affected individuals and must configure access rights appropriately.

Spensa uses technical and organizational measures designed to protect personal data, including access controls, tenant separation, encryption in transit, controlled storage access, logging, monitoring, backups, and internal confidentiality obligations.

No system is completely secure. Customers must also protect their own accounts, devices, permissions, and exported files.

We may update this Privacy Policy when our service, providers, or legal requirements change. The current version is published on this page.

Questions about privacy or data protection can be sent to Spensa Ges.m.b.H., Jungstraße 15/6/18, 1020 Vienna, Austria, or hello@spensa.ai.