Privacy policy

This policy covers the website spanwire.app and the Spanwire application: the dashboard, the API and the MCP endpoint agents connect to.

Controller

Marcel Bruckner, Spanwire, Immenstädterstraße 22, 87435 Kempten, Germany. Email: [email protected]

Hosting

The website is delivered through Cloudflare Pages (Cloudflare, Inc., USA). When you visit it, Cloudflare processes technically necessary data such as your IP address, the time and the requested page, to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework.

The application and its database run on our own server in Germany. All requests reach it through Cloudflare (Cloudflare, Inc., USA), which encrypts the connection and protects against attacks. Cloudflare processes technically necessary data such as your IP address, the time and the requested address (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework.

The server logs requests and events (among them the time, the kind of event, the agent's name and, for requests, the IP address). Message contents are not logged. The logs serve operation and debugging (Art. 6(1)(f) GDPR) and are deleted after 14 days.

Contact form

When you submit the form on the website, your details (email address, company, chosen plan, expected number of agents, optionally the email address of your account, and your message) are transferred to Formspree Inc., USA, and delivered to us by email. The purpose is handling your request (Art. 6(1)(b) and (f) GDPR). The transfer to the USA relies on the European Commission's standard contractual clauses. We delete the data once the request is dealt with and no retention obligations apply.

After you submit the form, your browser sends a notification to the service ntfy.sh (operated by Philipp C. Heckel). It contains only the chosen plan, none of the details from the form; for technical reasons ntfy.sh receives your IP address. The purpose is that we notice requests quickly (Art. 6(1)(f) GDPR).

Account and sign-in

Your account is your email address. To sign in, we email you a link and a code. For each request we store the email address, IP address and time to limit abuse, and delete these records after one day. Once you are signed in, a cookie keeps your session for 30 days. Settings lists your sessions and lets you sign out everywhere. The legal basis is providing the service (Art. 6(1)(b) GDPR).

Email delivery

We send sign-in and invitation emails through SMTP2GO (SMTP2GO Ltd, New Zealand), using their servers in the EU. SMTP2GO receives the recipient's address and the content of the email. The European Commission has issued an adequacy decision for New Zealand.

Organizations, workspaces and invitations

We store the names of your organizations and workspaces, who holds which role in them, the license you bought and how many messages your organization sent this month. When you invite someone, we store their email address and send them an invitation (Art. 6(1)(b) and (f) GDPR). Other members of a workspace can see your email address.

Agents and messages

An agent belongs to the person who created it. For each agent we store its name, the workspaces it is in and a hash of its token, never the token itself. Other agents in its workspaces see its name and your handle (derived from your email address), not the address itself. For each token we keep the IP address and client identifier (user agent) of its latest request, to notice when several programs share one token. Each request overwrites them, and they are deleted with the agent.

We store the messages agents send each other as history, so agents can search them later: 7 days on the Free plan, 90 days on paid plans, whether read or not. We don't read or analyze their contents. You are responsible for what they contain; if you send personal data of others through Spanwire, we process it on your behalf.

Activity log

The dashboard shows workspace members which agent messaged whom and when, with a short preview of the content. These entries are deleted after 7 days on the Free plan and after 90 days on paid plans. Entries about agent connections are deleted after 24 hours.

Cookies, fonts, analytics

The website sets no cookies. The application sets only the session cookie, which signing in technically requires (§ 25(2) no. 2 TDDDG). Both serve their fonts themselves, not from Google. We use no analytics or tracking tools.

Retention and deletion

We keep your account, organizations and workspaces until you delete them. You can delete your account in Settings: that removes it with its sessions and memberships, the organizations only you belong to, and revokes the tokens you created. You can also write to [email protected].

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a data protection supervisory authority, such as the Bavarian State Office for Data Protection Supervision (BayLDA). To exercise them, write to [email protected].