Privacy Notice

Spodus is sold to businesses in the United States. This notice covers our website at spodus.com, the Spodus Cloud application, and the email we send you about your account.

It does not cover third-party sites we link to, or software you choose to connect to Spodus. Those have their own policies and we don’t control them.

A CRM holds two very different things, and your rights differ between them. It’s worth being precise about this rather than blurring it.

Data about you, our customer. Your name, work email, company, billing details, support messages, and how you use the product. We decide what to do with this, which makes us responsible for it. Everything in clauses 3 through 12 is about this data.

Data you put into the product. The contacts, deals, invoices, tickets and files your team loads into Spodus. That information is generally about other people, and it is yours, not ours. We only handle it on your instructions, to provide the service. See clause 13.

Account information. Name, work email address, password (stored hashed, never in readable form), company name, and role. Provided by you at signup.

Billing information. Plan, billing contact, billing address, and payment history. We never see or store your full card number. Card details go directly to Stripe on their own hosted checkout page; we receive only a token, the card brand, and the last four digits.

Usage and device data. Pages viewed, features used, approximate location derived from IP address, browser and operating system, and timestamps. Used to keep the service running, debug problems, and understand which features earn their keep.

Support and sales correspondence. What you write to us, and what we write back, including anything you send through the contact form.

Security and audit logs. Sign-ins, IP addresses, permission changes and administrative actions, kept so that you and we can reconstruct who did what.

• To provide the service — creating your workspace, authenticating you, syncing what you asked us to sync.
• To bill you — processing subscriptions, sending receipts, chasing failed payments.
• To support you — answering questions and investigating faults you report.
• To keep the service secure — detecting abuse, rate-limiting, investigating incidents.
• To improve the product — understanding in aggregate which features get used.
• To comply with law — tax records, and responding to lawful requests.

We also send occasional product email about things like new features and service changes. Every one of those has a working unsubscribe link. Email about your account itself, billing failures, security notices, breach notifications, is not optional while you hold an account, because you need to receive it.

We think these are worth stating as commitments rather than leaving to inference:

• We do not sell personal information, and we never have.
• We do not use your business records to train machine-learning models, ours or anybody else’s.
• We do not buy contact lists or enrich your data from third-party brokers.
• We run no advertising or tracking pixels — not inside the application, and not anywhere on this website.

Our own website analytics are cookieless. We set no cookie, store nothing in your browser, and never follow you to another site. What we record, on our own server, is the page you asked for, the date and time, the country, region and city our network places your connection in, the site or advert that sent you, and the broad type of device, operating system and browser you used. Moving between pages of this site does not always fetch a fresh page from us, so a small script in your browser reports the path of the page you moved to. It sends that path and nothing else; everything else in this paragraph is read from the request itself, exactly as it is for a page you open directly.

So that we can tell one reader from forty page refreshes, we also store a short code derived from your IP address and your browser’s description of itself. It is a one-way cryptographic hash: we cannot turn it back into your address, we do not store it next to your name or your account, and we do not share it with anyone. The key it is mixed with is a deployment secret rather than anything about you, and it would stop meaning anything if that secret ever changed. We delete these records entirely after 400 days.

The application itself sets a small number of strictly necessary cookies, the ones that keep you signed in and protect forms against cross-site request forgery. The product does not work without them, so they are not subject to a choice.

We share personal information with the service providers that help us run Spodus. Each one is listed by name, with what it does and where it runs, on our sub-processors page. Each is bound by a written agreement to process data only on our instructions.

Beyond those, we will disclose information only:

• when you tell us to, for example by connecting a third-party integration;
• to our professional advisers, such as lawyers and accountants, under a duty of confidence;
• where we are legally required to, and where we are permitted to tell you, we will; and
• to an acquirer, in the event of a merger, acquisition or sale of assets. If that happens, this notice continues to apply to your information until you are told otherwise, and you’ll be told before anything changes.

In Germany. Application data and backups are hosted in Hetzner’s Nuremberg data centre, inside the EU, with Cloudflare providing DNS, TLS termination and DDoS protection at the network edge. We do not currently offer hosting in any other region, and we’d rather say that plainly than imply a choice that doesn’t exist.

• Account and workspace data — for as long as your account is open.
• After you delete your account — removed from live systems immediately. Deletion is confirmed by a link we email you, and once confirmed it cannot be undone. There is no grace period, so export anything you want to keep first.
• Backups — deleted data ages out of backup rotation within a further 14 days. We cannot surgically remove a single record from an existing backup image, so this window is a physical limit, not a preference.
• Billing and tax records — kept as long as tax law requires, currently seven years, regardless of account closure.
• Security and audit logs — kept for the life of the workspace. The log is append-only at the database level: the application cannot alter or delete an entry, which is what makes it worth anything as a record, and is also why it is not pruned on a schedule.

Encryption in transit, credentials for services you connect sealed with AES-256-GCM before storage, role-based access control, two-factor authentication, audit logging, and access limited to staff who need it. Database storage, uploaded files and backup dumps are access-controlled but not separately encrypted at rest today. The full picture, including what certifications we do and don’t hold, is on our security page. No system is perfectly secure and we won’t pretend otherwise; if something goes wrong, clause 12 explains what we do.

Some US states give residents specific privacy rights, and the thresholds vary. Rather than make you work out whether you qualify, we extend the following to every customer, in every state:

• Access — ask what we hold about you.
• Export — get your workspace data out in a portable format, at any time, without asking us first.
• Correction — fix anything inaccurate.
• Deletion — close your account and have your data removed, subject to the retention periods in clause 9.
• Opt out of marketing — unsubscribe from any product email.

Email privacy@spodus.com and we’ll respond within 30 days. We will not charge you, and we will not treat you differently for asking. If we need to verify your identity first we’ll ask for the minimum needed to be confident it’s you.

There is no “Do Not Sell or Share My Personal Information” link on this site because we do neither. See clause 5.

If personal information is compromised, we will notify affected customers without undue delay and within the timeframes required by the breach notification law of each affected person’s state, and notify regulators and consumer reporting agencies where the law requires it. Notice will describe what happened, what data was involved, what we’ve done, and what you should do. We would rather tell you early and incompletely than late and neatly.

For the records you load into Spodus, you decide what to collect and why; we simply hold and process it for you under your instructions. Our commitments about that data, including confidentiality, security, breach notification, sub-processors and deletion, live in our data processing agreement, which forms part of your contract with us.

Deciding that your own collection of that data is lawful is your responsibility, not ours. That includes obtaining any consents you need and honouring requests from the people the records describe.

Spodus is a general-purpose business system. It is not built, contracted or priced to carry certain categories of regulated data, and putting them in creates obligations neither of us has agreed to. Our terms of service prohibit uploading:

• protected health information subject to HIPAA. We do not sign business associate agreements at this time;
• consumer health data as defined by Washington’s My Health My Data Act, Nevada’s SB 370, or similar state health-privacy laws;
• full payment card numbers or magnetic stripe data;
• government-issued identifiers such as Social Security numbers, except where a feature explicitly supports them;
• biometric identifiers; and
• personal information knowingly collected from children under 13.

If your business needs to handle any of these, talk to us before you sign up rather than after. We would rather turn away a deal than let you build on a foundation we told you was safe when it wasn’t.

Spodus is a business tool sold to organisations and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, email privacy@spodus.com and we’ll delete it.

We’ll update this page when our practices change, and revise the effective date at the top. For changes that materially reduce your rights or expand what we do with your information, we’ll email account holders at least 30 days before they take effect, so you have time to object or leave.

Privacy questions, requests, or complaints go to privacy@spodus.com, or by post to:

8206 Louisiana Blvd NESte A #8845Albuquerque NM 87113

If you aren’t satisfied with our response, you can complain to your state attorney general. We’d ask you to come to us first, though; we’d rather fix it.