Privacy policy

Data controller

Mathieu Marteau, sole proprietorship (entrepreneur individuel, EI), 23 boulevard de Cambrai, 59100 Roubaix, France — support@spunto.net.

What we process, and why

• Your account: email address, name and picture (from Google if you sign in with Google), hashed password (if you choose one), signup IP address (to limit free trials per address). Basis: performing the contract; for the IP, our legitimate interest in preventing abuse.
• What you put in the service: project configuration, secrets (encrypted), sandbox contents, agent conversations and their attachments, support messages. Basis: performing the contract.
• Billing: workspace name, payer email, credit and invoice history. Card details are entered at Stripe and never reach us. Basis: performing the contract and our accounting obligations.
• Technical logs: requests received (including the IP address), sandbox measurements and events. Basis: our legitimate interest in running and securing the service.
• Performance and error monitoring (OpenObserve, self-hosted): page views, load times, browser errors and console, and session recordings in which text, input fields and images are masked, tied to your account when you are signed in. Basis: our legitimate interest in detecting and fixing failures.
• Product analytics (PostHog): page views, journeys and browser errors, tied to your account when you are signed in. Basis: our legitimate interest in understanding and improving the product.
• Waitlist: the email address and what you tell us about your use, until we let you in.

We sell no data and run no targeted advertising.

With whom

• OVH (France): hosting of the website, the API, the database and our OpenObserve; OVH (Canada): Spunto Cloud sandbox machines.
• Google Cloud (Belgium, European Union): agent conversation archives and database backups; Google: sign-in with Google.
• Stripe: payments and invoices.
• PostHog (servers in the European Union): product analytics.
• Services you connect yourself (GitHub, Google Cloud, agent publishers, MCP servers…) receive what you send them, under their own policies.

Transfers outside the European Union go to Canada (European Commission adequacy decision) and, for Stripe, Google and PostHog, to the United States under the Data Privacy Framework.

For how long

• Account and content: as long as the account exists; deleted when the workspace or account is deleted.
• Invoices and credit entries: 10 years (accounting obligation).
• Technical logs, performance monitoring and analytics: as long as useful for operations, at most 12 months.
• Database backups: a rolling 14 days.

Cookies

• session: keeps you signed in (30 days). Required for the service.
• _oo_s (OpenObserve): identifies the browsing session for performance and error monitoring; a session lasts at most 4 hours (15 minutes of inactivity end it), the cookie is kept for a year.
• PostHog (cookie and local storage ph_*): the analytics described above.

Your rights

You can access your data, correct it, erase it, get it in a readable format, object to processing based on our legitimate interest or ask for it to be restricted, by writing to support@spunto.net. We answer within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).