Privacy Policy

Last updated: July 15, 2026

ERPSpan ("we", "us") is operated from Iceland and this policy is written to meet the GDPR. Questions and requests: andri@erpspan.com.

What we collect, and why

• Account data — your email address and sign-in identity, to operate your account (legal basis: contract).
• Request logs — for every API call: which API key, which data category, when, and the outcome, plus the submitted payload for write operations. This is the audit trail the service promises its users (legal basis: contract / legitimate interest). Retained while your account is active.
• ERP data in transit — the business records your application reads from or writes to a connected GP environment pass through our relay to serve your request. For this data we act as a processor on your instructions; you (or your customer) remain the controller.
• Billing data — handled by Dodo Payments as merchant of record; we store your plan and subscription status, not your card details.
• Website analytics — aggregate page analytics (Vercel Analytics), without advertising cookies.

What we deliberately do not collect

• Your ERP credentials. SQL credentials are stored only on your own server by the agent, encrypted. They are never transmitted to us.
• Your API key secrets. We store only cryptographic hashes; the secret is shown to you once and cannot be retrieved from us.

Subprocessors

Infrastructure providers that process data on our behalf:

• Supabase (database and authentication, USA/EU)
• Northflank (API hosting)
• Vercel (website hosting and analytics)
• Hetzner (demo sandbox hosting, Germany)
• Dodo Payments (payments, merchant of record)
• Google Workspace (email)

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, object to processing, and lodge a complaint with a supervisory authority (in Iceland: Persónuvernd). Email us and we will respond within 30 days. Deleting your account removes your control-plane data; request logs are deleted or anonymized within 90 days.

Changes

Material changes to this policy will be announced by email to account holders.