Spyral — Privacy Policy (EU/EEA)

This Privacy Policy explains how Spyral (“Spyral”, “we”, “us”) collects, uses, discloses and protects personal data when providing the Spyral platform for document intelligence, annual accounts and bookkeeping workflows, and related services to professional firms.

This English version is the authoritative text. Any translation is provided for convenience only; in case of conflict, the English version prevails.

Who We Are and How to Contact Us

Spyral operates a cloud-based, multi-tenant platform used by professional firms to organise, analyse and file documents. Our services are directed at business customers in the EU/EEA, with a focus on Luxembourg and the wider Benelux region.

Privacy and Data Protection Contacts

• Privacy and data protection: privacy@spyral.lu
• General enquiries: contact@spyral.lu
• Security incidents: security@spyral.lu

We have not appointed a Data Protection Officer, as we are not required to do so under GDPR Article 37. Privacy enquiries are handled through the contacts above.

Right to Lodge a Complaint

Under GDPR Article 77, you may lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement. In Luxembourg this is the Commission nationale pour la protection des données (cnpd.public.lu). We would appreciate the opportunity to address your concern first, at privacy@spyral.lu.

Scope and Role Under GDPR

This Privacy Policy applies to:

• Visitors to www.spyral.lu and related websites
• Representatives, employees, contractors and end-users of Spyral's business customers who access the platform
• Individuals who contact us by email or through support channels, or whose personal data we process in connection with our services

Spyral's Role Under GDPR

• As Data Processor:For customer content processed through the platform — the documents a firm uploads or connects, and everything derived from them — Spyral acts as a processor on the documented instructions of the customer firm, which is the controller.
• As Data Controller: For account administration, billing, service communications, support records, website operation, security monitoring and marketing to business contacts, Spyral acts as an independent controller.

Where Spyral acts as processor, the customer firm decides what is uploaded, who may access it, and how long it is kept. Requests from individuals about that content are directed to the firm.

Categories of Personal Data Processed

Google API Services — Data Collection, Use and Disclosure

How the Google Drive Integration Works

Spyral does not connect to a customer's Google Drive account in the background and does not browse or index a Drive. Instead, a user opens the Google file picker inside Spyral and selects specific files. Google grants Spyral access to those individual files only, for the purpose of importing them.

Google API Scope Requested

• https://www.googleapis.com/auth/drive.file— a per-file scope that grants access only to files the user has explicitly selected or that were created by Spyral. It does not permit access to any other file in the user's Drive.

This is the narrowest scope that supports the feature. Spyral does not request broad Drive read access, does not request Gmail or calendar access, and does not request any scope that Google classifies as restricted.

How Spyral Uses Google Drive Data

Files imported through the Google file picker are treated exactly like uploaded files and are used only to:

• Extract text and make the document searchable within the customer's own workspace
• Classify the document and extract its attributes
• Link it to the companies and people it refers to, within the customer's own directories
• Provide grounded, cited answers when a user asks a question about their own documents
• Feed the customer's bookkeeping and annual accounts workflows

Google API Services User Data Policy Compliance

Spyral's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use Requirements

• Limited to user-facing features: Google user data is used only to provide the user-facing features described above.
• No unauthorised transfers: Google user data is not transferred to third parties except as necessary to provide those features, for security purposes, to comply with applicable law, or as part of a merger or acquisition with prior user notice.
• No human access without consent: Personnel do not read Google user data unless the user has specifically asked us to look at particular content, it is necessary to investigate abuse or a security incident, or it is required by law.
• Binding on all parties: Employees, contractors and successors are bound by these requirements.

Explicit Prohibitions Regarding Google User Data

Spyral does not:

• Sell Google user data
• Use Google user data for advertising of any kind, including retargeting or interest-based advertising
• Use Google user data to determine credit-worthiness or for lending purposes
• Provide Google user data to data brokers or information resellers
• Use Google user data to train or fine-tune any AI or machine learning model

Disconnecting Google Drive

Because access is granted per file at the moment of import, there is no standing background connection to revoke. Users may nevertheless review and remove any Spyral authorisation at myaccount.google.com/permissions. Files already imported into the workspace remain there as customer content and can be deleted from within Spyral like any other document, or by request to privacy@spyral.lu.

Purposes and Legal Bases

We process personal data only for specified, explicit and legitimate purposes, and do not further process them in a manner incompatible with those purposes (GDPR Article 5(1)(b)).

Where we rely on legitimate interests, we have carried out a balancing assessment and will provide a summary on request. You may object to such processing under Article 21.

Tenant Isolation and Access Control

Each customer firm occupies its own logical tenant. Isolation is enforced at two independent layers, so that a single mistake at one layer does not expose data:

• Application layer: Every request is authenticated, checked against the acting user's permissions, and scoped to their tenant before any data is read.
• Database layer: The database independently enforces tenant boundaries under a least-privilege service account. A query that fails to identify its tenant returns no rows rather than another tenant's rows — it fails closed.
• Automated verification: Both layers are checked automatically before any change reaches production. A change that would introduce a query without a tenant boundary cannot be released.

Within a firm, access is further restricted by role and by document visibility, which the firm's administrators configure. Documents can be made available to the whole firm, to a project team, to a restricted group, or to named individuals. Permissions are default-deny: a user receives only what their role grants.

We describe these controls in terms of what they guarantee rather than how they are built. No security architecture is infallible, and we make no claim that breach is impossible. Details sufficient for a security review are available to customers under a confidentiality agreement.

Access by Spyral Personnel

Spyral personnel do not access customer content in the ordinary course of operating the service. Access occurs only where:

• The customer asks us to investigate a specific problem
• It is necessary to respond to a security incident
• It is required by law or by a valid order from a competent authority

Such access is limited to what is strictly necessary and is performed by named personnel bound by confidentiality obligations. User actions in the application are logged, and the administrative access paths used for maintenance are restricted and enumerated. Customers subject to professional secrecy obligations can ask us to agree in writing that any such access happens only under their supervision.

AI Processing, Retrieval and Transparency

How AI Features Work

Spyral uses large language models, embedding models and vision models to read documents, classify them, extract structured information and answer questions. These models are operated by a specialist AI infrastructure provider engaged by Spyral as a sub-processor and bound by a Data Processing Agreement. Spyral does not develop foundation models of its own.

When a user asks a question, the sequence is:

• Retrieval: The platform searches only within the asking user's own tenant, and only across documents that user is permitted to see, to find the passages most relevant to the question.
• Generation: Those passages and the question are sent to the model, which produces an answer grounded in them.
• Citation: The answer is returned with links to the source documents so the user can verify it.

Safeguards

Transparency under the EU AI Act

Spyral's AI features are not high-risk AI systems under Regulation (EU) 2024/1689 (the AI Act), and Spyral does not engage in any practice prohibited under Article 5. On transparency:

• Surfaces where you interact with an AI system are presented as such, and carry a notice at the point of use that responses may be inaccurate and should be verified.
• AI output is labelled in the interface and carries citations to the source documents it was drawn from, so that any assertion can be traced back and checked.

We document what each AI feature does, what it is suitable for, and where human review is required. That documentation supports a customer's own obligations under the AI Act; it does not discharge them.

Limitations of AI Output

AI output can be incomplete, out of date or wrong. It must not be relied on without independent verification, and human oversight is required for anything used in a filing, a client deliverable or a decision with consequences. Spyral provides tools that make verification practical — citations, confidence flags and review queues — but the professional judgement remains the user's.

Data Sharing and Sub-Processors

Spyral does not sell personal data and does not share it for advertising. Personal data is shared only with the following categories of recipients, and only to the extent necessary:

Categories of Sub-Processor

• Cloud hosting and application delivery — running the application and serving requests
• Managed database and object storage — storing documents and structured data
• AI inference infrastructure — running the language, embedding and vision models described above
• Transactional email delivery — sending invitations, verification codes and notifications
• Payment processing — handling subscription payments; Spyral does not receive or store full card details
• Error monitoring and infrastructure services — diagnosing faults and enforcing rate limits
• Electronic signature — only where the customer uses the signature workflow

Every sub-processor is engaged under a written contract meeting GDPR Article 28(3), is bound to confidentiality and to security measures no less protective than our own, and is assessed before we engage it.

Current list.A current list of sub-processors, giving each one's name, role, and processing location, is maintained and provided to customers and prospective customers on request to privacy@spyral.lu. Customers are notified in advance of any intended addition or replacement of a sub-processor and may object on reasonable data protection grounds, as set out in the Data Processing Agreement.

Professional Advisers

External auditors, legal counsel and security testers may access data where necessary for their engagement. All are bound by confidentiality obligations.

Authorities and Legal Disclosure

• We disclose personal data to authorities only where required by law or by a valid, binding order
• We assess each request for legality and proportionality and challenge those that are overbroad or invalid
• Where legally permitted, we notify the affected customer before disclosing
• We disclose only the minimum data necessary to comply
• We do not grant any government direct or unsupervised access to customer data, and we have not built any facility for such access

International Data Transfers

EU processing by default. Customer content is hosted and processed within the European Union, and AI inference for the production service is performed on EU infrastructure. Customer content is not routinely transferred outside the EEA.

Where a transfer occurs.A limited number of operational functions — for example support correspondence or error diagnostics — may involve access from, or storage in, a country outside the EEA. Where that happens we rely on an adequacy decision under GDPR Article 45 where one is available, and otherwise on the European Commission's Standard Contractual Clauses under Article 46, supported by a transfer impact assessment and by supplementary technical and organisational measures where the assessment calls for them.

Customers may ask which transfer mechanism applies to any specific sub-processor at privacy@spyral.lu.

Security Measures

We implement technical and organisational measures appropriate to the risk, as required by GDPR Article 32. These include the following.

Encryption

• In transit: All traffic between users, the platform and third-party services is encrypted with current TLS. HTTP Strict Transport Security is enforced.
• At rest: Databases and object storage are encrypted at rest by our infrastructure providers using AES-256.
• Application-level encryption for secrets: Two-factor authentication secrets and third-party access tokens are additionally encrypted with AES-256-GCM under dedicated keys before storage, so that they remain protected independently of storage-layer encryption.

Authentication and Access Control

• Passwords are hashed with bcrypt and per-user salts; plaintext passwords are never stored or logged
• Optional two-factor authentication using time-based one-time passwords (TOTP)
• Sessions are held in cookies that are HTTP-only, Secure and same-site restricted, with a limited lifetime
• Users can review active sessions and sign out of all devices; changing a password or signing out everywhere invalidates existing sessions immediately
• Attribute-based permissions with default-deny, enforced on every request

Application Security

• Cross-site request forgery protection on all state-changing requests
• A content security policy, clickjacking protection, MIME-sniffing protection and a restrictive permissions policy on all responses
• All input validated against strict schemas at every boundary
• Rate limiting on authentication, upload and AI endpoints, with the cost-sensitive limits failing closed
• Uploaded files validated by content, not only by file extension
• Error responses carry a reference code rather than internal detail, so that diagnostics never leak system information to a user or an attacker

Monitoring and Audit

• Security-relevant actions are recorded with the acting user, IP address, user-agent and timestamp
• Errors and anomalies are monitored continuously with automated alerting
• Administrative and cross-tenant operational access paths are restricted and enumerated, and any change to them is checked automatically before release

Security Assurance

On request, and under a confidentiality agreement, we provide customers with a description of our technical and organisational measures sufficient to complete a vendor security assessment, and we make available the information needed to demonstrate compliance with our processor obligations, as GDPR Article 28(3)(h) requires.

Data Retention and Deletion

Retention is limited to what is necessary for the purposes described above and for compliance with legal obligations. The periods below are the ones we actually operate.

We do not claim instantaneous or forensically irreversible erasure. Deletion removes data from the live service within the periods above; provider backups expire on their own schedules. On request we will confirm in writing once deletion is done.

Your Rights Under the GDPR

• Access (Article 15): Confirmation of whether we process your data, and a copy of it
• Rectification (Article 16): Correction of inaccurate or incomplete data
• Erasure (Article 17): Deletion, where one of the grounds in Article 17(1) applies
• Restriction (Article 18): Restriction of processing while a dispute is resolved
• Portability (Article 20): Receipt of data you provided, in a structured, commonly used, machine-readable format
• Objection (Article 21): Objection to processing based on legitimate interests, and an absolute right to object to direct marketing
• Withdrawal of consent (Article 7(3)): Withdrawal at any time, without affecting processing already carried out
• Automated decision-making (Article 22): As set out above, we do not carry out solely automated decision-making with legal or similarly significant effects

Exercising Your Rights

If your data is in a customer's workspace (we are the processor): contact the firm that holds it. They are the controller and decide the outcome. We assist them promptly, as required by GDPR Article 28(3)(e).

If we are the controller— your account, our correspondence with you, marketing: write to privacy@spyral.lu. We respond within the one month allowed by Article 12(3), and where a request is complex or where we have received a number of them, we extend by up to the two further months that Article also allows, telling you within the first month and explaining why. There is no charge unless a request is manifestly unfounded or excessive.

Self-service: Signed-in users can export their own data as a structured file, review and revoke active sessions, and delete their account, from the account settings page.

Cookies and Similar Technologies

Spyral uses only cookies that are strictly necessary to deliver the service you have requested. Under Article 5(3) of the ePrivacy Directive these are exempt from the consent requirement, which is why you are not asked to accept cookies.

• Session cookie — keeps you signed in. HTTP-only, Secure, same-site restricted.
• Two-factor verification cookie — short-lived, records that a second factor was completed.
• Sign-in state cookies — set during authentication.
• Language cookie — remembers your interface language.
• Connection state cookies — short-lived, protect the integrity of a third-party connection flow you have started.

We do not use advertising cookies, cross-site tracking, third-party analytics scripts or social media pixels on the application. Product analytics for trial teams are collected server-side under in-app consent and do not use cookies. If we ever introduce a non-essential cookie, we will ask for your consent first and will not set it before you agree.

Regulatory Framework We Operate Under

Beyond the GDPR, the following EU rules shape how the platform is built and contracted. We list them so that customers can see how our obligations meet theirs.

Children's Data

Spyral is a business tool, is not directed at children, and is not made available to them. We do not knowingly collect personal data from children. If you believe a child's data has reached us, write to privacy@spyral.lu and we will delete it.

Data Processing Agreement and Customer Responsibilities

Every EU/EEA customer enters into a Data Processing Agreement meeting GDPR Article 28(3). It covers subject matter and duration, the nature and purpose of processing, categories of data and data subjects, processing on documented instructions only, confidentiality, security measures, sub-processor authorisation and notification, assistance with data subject rights and with Articles 32 to 36, deletion or return on termination, audit rights, and transfer mechanisms. A copy is available at privacy@spyral.lu.

As controller, the customer firm remains responsible for: having a lawful basis for what it uploads; informing its own data subjects; ensuring accuracy; configuring access correctly within its workspace; carrying out a data protection impact assessment where required; setting its own retention rules; and reviewing AI output before relying on it.

Security Incidents and Breach Notification

We maintain a documented incident response process. Where a personal data breach affects customer data:

• Notification to the customer: without undue delay after becoming aware, which is the standard GDPR Article 33(2) sets
• Information provided: the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed — provided in phases if not all of it is available at once
• Assistance: we assist the customer in meeting its own notification duties to supervisory authorities under Article 33 and to affected individuals under Article 34, which is what GDPR Article 28(3)(f) requires of us. If your own regime imposes a shorter or parallel reporting duty, tell us and we will agree in writing what we need to do to support it
• Follow-up: a written summary on completion, provided on request

Report a suspected vulnerability or incident to security@spyral.lu. We aim to acknowledge reports within five business days. No guaranteed acknowledgement or remediation window is offered. We do not pursue legal action against researchers who report in good faith, act proportionately, and give us reasonable time to remediate before disclosure.

Third-Party Links and Services

Our websites and the platform may link to third-party services. This Privacy Policy does not apply to them, and we are not responsible for their practices. Where you connect a third-party service to Spyral, that provider's own terms and privacy policy continue to govern your relationship with it.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, in our practices, or in the service. The version number and date at the top of this page always identify the current text. We give reasonable advance notice of a material change — normally at least 30 days — by email to account administrators and by notice in the application. A change we are required to make by law, or one needed to address a security risk, may take effect sooner. Where a change requires consent, we will ask for it rather than assume it.

Definitions

• Personal data: Any information relating to an identified or identifiable natural person
• Controller: The party that determines the purposes and means of processing
• Processor: The party that processes personal data on behalf of a controller
• Sub-processor: A processor engaged by Spyral to carry out part of the processing
• Customer / firm: A business that subscribes to Spyral
• Tenant: The isolated workspace belonging to one customer firm
• Customer content: Documents and data uploaded, connected or generated by a customer in its tenant
• Pseudonymisation: Processing such that data can no longer be attributed to a specific person without additional information kept separately (GDPR Article 4(5))
• Google user data: Data accessed through Google APIs, being the content and metadata of files a user selects through the Google file picker

Contact

Privacy and data protection: privacy@spyral.lu

Security incidents and vulnerability reports: security@spyral.lu

General enquiries: contact@spyral.lu

Version 2.0.0, last updated 9 September 2026.