Overview

DataSpring ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service, in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

Data Controller

DataSpring is the data controller for personal data collected through our website and service. For questions about this policy or to exercise your privacy rights, contact us at privacy@dataspring.app.

Information We Collect

Account Information

When you create an account, we collect your name, email address, and organization name. If you sign up through a third-party service (like Google), we receive basic profile information from that service.

Usage Data

We collect information about how you use DataSpring, including queries you run, dashboards you create, and features you use. This helps us improve our service and provide support.

Your Business Data

DataSpring stores your business data. On a schedule you set, we extract records from the source systems you connect — your CRM, your accounting system, your HR and scheduling system, your ordering platforms — and keep them in a data warehouse we operate for you, in Google Cloud's europe-west1 region in Belgium, for as long as you are a customer. Each customer has their own datasets and their own service identity, and that identity is the only principal permitted to read them.

You decide what is extracted and from where. The pipelines that define which systems are read, which endpoints and fields are taken and on what schedule are yours: you author them in DataSpring's pipeline language, and where we write one for you during onboarding we do it on your documented instructions. That makes you the controller of the data in the warehouse and us your processor of it, throughout.

The service is not intended for special category data — health, biometrics, trade union membership and the rest of GDPR Article 9. You must not configure a pipeline that extracts it without first agreeing the additional measures with us in writing. The case to watch is an HR source: an absence reason is usually health data. We ask about this at onboarding.

That data is yours. You are its controller and we process it only to provide the service to you; we do not use it to train models, to build benchmarks, or for any purpose of our own. What we hold, how it is protected and how it is deleted is set out in the data processing agreement, which is the document to read if you are assessing us as a processor.

If you have connected your own data warehouse instead, we query it at run time and the storage described above does not apply to that data.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contract: Processing necessary to provide our service to you (account management, query execution, dashboard features)
Legitimate Interest: Processing for service improvement, security, and fraud prevention
Consent: Marketing communications (you can withdraw consent at any time)
Legal Obligation: Where required by applicable law

How We Use Your Information

To provide and maintain our service
To authenticate you and manage your account
To communicate with you about your account and service updates
To send marketing communications (with your consent)
To improve and develop new features
To ensure security and prevent fraud
To comply with legal obligations

Data Security

We implement appropriate technical and organizational measures to protect your information:

All data in transit is encrypted with TLS
Data at rest is encrypted by Google Cloud with Google-managed keys
Each customer has their own service identity and their own datasets, and that identity is the only principal permitted to read or write them. Separation between customers is enforced by Google Cloud's access control rather than by our application code
Ad-hoc SQL runs as a separate read-only identity, so the database itself refuses any write or any reach outside the datasets it may see
The credentials you give us for your source systems are held in Google Secret Manager and are readable only by your own service identity. Our control plane can create, rotate and delete them but cannot read them, and they never pass through the context of a language model
Role-based access control, enforced on the server
Access to your data is attributable in Google Cloud's audit logs
Employee confidentiality obligations

We hold no third-party security certification. There is no SOC 2 report and no ISO 27001 certificate, and we will say so to anyone who asks rather than imply otherwise.

We make no claim to a security testing programme or a documented security training programme, because we have neither. What we have is the set of controls above, and they are mechanical: each is enforced by Google Cloud rather than by our own code, your data is pinned to europe-west1, and we do not offer customer-managed encryption keys. Those controls are accompanied by an automated test suite that runs in continuous integration and again before every push, and that fails the build when the operations we expose, or the files generated from them, drift from what is checked in.

Data Retention

We retain your account information for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes (such as tax records or dispute resolution).

Your business data in the managed warehouse is retained for as long as you are a customer. Retention in the raw layer follows the source system rather than a fixed clock of our own, because the point of that layer is to hold history the source system no longer holds; we will delete specific records from it on your instruction. On termination you have thirty days to request an export, and we complete deletion within thirty days after that — together with the credentials, the configuration workspace and the service identities that served it. The data processing agreement describes exactly what deletion removes.

Your Rights

Under GDPR, you have the right to:

Access: Request a copy of the personal data we hold about you
Rectification: Correct inaccurate or incomplete information
Erasure: Request deletion of your personal data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Restriction: Request that we limit how we use your data
Objection: Object to processing based on legitimate interests
Withdraw Consent: Where processing is based on consent, withdraw it at any time

To exercise these rights, contact us at privacy@dataspring.app. We will respond within 30 days.

Cookies and Local Storage

We use minimal browser storage for essential functionality:

Authentication tokens: Stored in IndexedDB to keep you logged in (essential)
Session data: Temporary data in sessionStorage for features like invitation flows (essential)

We use no tracking cookies and no third-party analytics. There is no analytics, error-tracking or advertising script in either the website or the application, and both serve their typefaces themselves rather than from a font CDN, so loading a page sends your IP address to no third party. The sub-processors page lists what remains in the path.

Third-Party Services

We use third-party service providers to help deliver our service. These "sub-processors" are bound by data protection agreements and process data only as instructed by us.

View our complete list of sub-processors at dataspring.app/sub-processors.

International Data Transfers

Your business data in the managed warehouse is stored and processed in the European Union (Google Cloud europe-west1, Belgium) and we do not transfer it outside the EEA in the ordinary course of running the service. Where a transfer does occur, we rely on:

The EU Standard Contractual Clauses, which our data processing agreement incorporates by reference
Adequacy decisions where one applies to the country concerned

The residual exposure we do not pretend away is that our infrastructure provider has a US parent, and that a small number of supporting services — notably the authentication service holding sign-in identifiers, which is account data and not warehouse data — are global rather than EU-resident. The DPA sets out the transfer impact assessment in short form.

Business Customers

If you use DataSpring through your employer or organization, that organization is the data controller for data processed through their account. Please refer to your organization's privacy policy for information about how they handle your data.

For business customers, we offer a Data Processing Agreement (DPA) that governs how we process data on your behalf.

Children's Privacy

DataSpring is not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and (for registered users) sending an email notification.

Complaints

If you have concerns about how we handle your data, please contact us first at privacy@dataspring.app. We will work to resolve your concerns.

You also have the right to lodge a complaint with a supervisory authority. If you are in the EU, you can find your local authority at edpb.europa.eu.

Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

Email: privacy@dataspring.app

Privacy Policy

This is an unreviewed draft