Data Processing — Trial Analytics

To improve Spyral, we collect anonymised usage data during your trial. No document content is ever collected.

This page describes one specific, optional processing activity. Everything else is covered by the Privacy Policy.

Legal basis and consent

We collect these analytics only after your team has given consent in the application, on the basis of consent under GDPR Article 6(1)(a). Consent is entirely optional: declining it does not restrict any feature, and you can withdraw it at any time with effect for the future. Collection stops automatically when your team moves from a trial to a paid subscription.

What we collect

  • Feature interaction events: which pages were visited, which actions were taken
  • Session metadata: a randomly generated session identifier and session duration
  • Document workflow events: upload initiated, classification triggered, classification accepted or rejected
  • AI tool usage signals: which tool was used, the length of a prompt, whether the response was accepted or dismissed
  • Error and friction signals: failed actions and retries

What we do NOT collect

  • Document content, file names, or extracted text
  • The content of AI prompts or responses
  • Data entered into forms
  • Names, email addresses, or any other direct identifier of a user
  • IP addresses

Identity protection

Your team identifier is never stored in raw form. We store a keyed HMAC-SHA-256 hash of it, computed with a server-side secret, so the analytics dataset cannot be mapped back to your account by anyone who obtains only that dataset.

To be precise about what this does and does not mean: because we hold the key, this is pseudonymisation under GDPR Article 4(5), not anonymisation. The records therefore remain personal data in our hands, we treat them as such, and the rights described in the Privacy Policy apply to them. Pseudonymisation limits the consequences of a breach; it is not a claim that the data has left the scope of the GDPR.

No cookies

These analytics are recorded server-side. No analytics cookie, tracking pixel, or third-party analytics script is used, and no data is shared with an advertising network or data broker.

Retention

Analytics events are deleted automatically 90 days after collection by a scheduled job that removes every record past its retention date.

Withdrawal and deletion

Write to privacy@spyral.lu to withdraw consent or to request deletion of the records associated with your team. Withdrawal takes effect for the future and does not affect the lawfulness of collection before it.