1. Who we are
Specky ("we", "us") is a specification-driven project management platform operated by:
Spark IT Mariusz Iskra, sole proprietorship registered in Poland Address: ul. Malownicza 9, 72-006 Mierzyn, Poland · Tax ID (NIP): 8581726552 · EU VAT: PL8581726552 Contact: support@specky.app
For data you provide when creating an account and using Specky's website, we act as the data controller under the EU General Data Protection Regulation (GDPR).
For content your organization uploads to Specky (project specifications, documents, tasks) that contains personal data of third parties, we act as a data processor on behalf of your organization. This processing is governed by our Data Processing Agreement (DPA), available at https://specky.app/legal/dpa.
2. What data we collect
Account and organization data (we are controller):
- Name, email address, password hash
- Organization name, role within the organization
- Plan, billing status, and usage counters (e.g., number of AI analyses used)
- Login timestamps, IP addresses, and security logs
Customer content (we are processor):
- Documents and specifications you upload (PDF, DOCX, Markdown, and other supported formats)
- Audio recordings and their transcriptions, where you use recording features
- Requirements, tasks, comments, and project data created in Specky
- Questions you submit to the AI assistant and the answers generated
Recordings and consent. Where you use recording features, you (or your organization) decide what and whom to record. Many jurisdictions — including several U.S. states such as California, Florida, Illinois, and Pennsylvania — require the consent of all parties to a recorded conversation. Obtaining those consents is your responsibility as controller of that content; see Section 5 of our Terms of Service. We process recordings and transcriptions only on your instructions.
Payment data: we do not collect or store your payment card details. Payments are processed by Paddle as Merchant of Record (see Section 5). We receive only subscription status, plan, and non-sensitive billing metadata.
Analytics: we use Google Analytics on our marketing website and Mixpanel within the application to understand how our website and product are used and to improve them. These tools process usage and device data and may set cookies or similar identifiers. Where required by law, they are activated only after you consent via our cookie banner (see Section 11). Advertising conversion measurement: on our marketing website we use Google Ads conversion tracking to measure whether a visit from one of our ads leads to a sign-up; it runs only after you consent via our cookie banner. We do not use remarketing, personalized-advertising, or audience-sharing features, and we do not sell or share this data (see Section 9).
3. How and why we process your data (legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service (accounts, projects, AI analysis) | account data, customer content | Art. 6(1)(b) — contract |
| Billing and subscription management | account data, billing metadata | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligations |
| Security, abuse prevention, audit logs | security logs, IP addresses | Art. 6(1)(f) — legitimate interest |
| Transactional email (invitations, notifications, alerts) | email address | Art. 6(1)(b) — contract |
| Service observability, debugging, and quality improvement | AI operation inputs/outputs, technical identifiers | Art. 6(1)(f) — legitimate interest |
| Website and product analytics (Google Analytics, Mixpanel) | usage data, device/browser data, cookie identifiers | Art. 6(1)(a) — consent |
| Advertising conversion measurement on the marketing website (Google Ads) | usage data, device/browser data, cookie identifiers | Art. 6(1)(a) — consent |
| Product improvement based on aggregated, de-identified usage | aggregated metrics | Art. 6(1)(f) — legitimate interest |
| Marketing communication (only if you opt in) | email address | Art. 6(1)(a) — consent |
We do not sell personal data and we do not share it for cross-context behavioral advertising. We do not use personal data to build advertising profiles or to target you with ads; with your consent, we measure whether a visit from one of our ads leads to a sign-up (Google Ads conversion measurement, see Sections 2 and 11). See Section 9 for these statements in the terminology of U.S. state privacy laws.
4. AI processing — what actually happens to your content
Specky's core features rely on large language models (LLMs) and embedding models. In the interest of transparency, this is the actual processing flow:
- Document analysis. When you upload a specification and start an analysis, the document text is sent to one or more of our AI providers (Anthropic, OpenAI — see Section 5) via their APIs to extract requirements, classify their scope, and detect gaps.
- Embeddings and semantic search. Fragments of your documents and requirements are converted into numerical vector representations (embeddings) and stored in our vector database to enable semantic search. Embeddings are stored on our EU infrastructure.
- AI assistant (chat). Your questions, together with relevant fragments of your project content, are sent to an LLM to generate an answer. Answers are marked as AI-generated.
Your content is not used to train AI models. Both of our AI providers are used under their commercial/API terms, which prohibit or exclude training on customer content:
- Anthropic: under its Commercial Terms of Service, Anthropic may not train models on customer content submitted through the API.
- OpenAI: data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in (we do not opt in).
Provider-side retention for abuse monitoring. Independently of training, AI providers may temporarily log API inputs and outputs for a limited period (typically up to 30 days) solely to detect abuse and enforce their usage policies, after which they are deleted. We do not control these logs; they are governed by each provider's terms.
Service observability and quality. We operate a self-hosted observability tool on our EU infrastructure that records the inputs and outputs of AI operations (prompts and generated responses) together with technical identifiers (such as organization and project identifiers). We use this data solely to operate, monitor, debug, secure, and improve the functioning and quality of Specky's own processes — for example, to diagnose failed analyses and refine our internal prompts and pipeline. This data is hosted on our EU infrastructure, is not used to train any AI models, and is not shared with or sold to third parties. It is retained for a limited period (see Section 7) and then deleted.
We review our AI providers' data-use terms periodically and will update this policy if their commitments change.
5. Subprocessors and recipients
We use the following subprocessors. The current list, including any changes, is always available at https://specky.app/legal/subprocessors; DPA customers are notified of changes 30 days in advance.
| Provider | Purpose | Location of processing |
|---|---|---|
| Hetzner Online GmbH | hosting of application, databases, file storage, embeddings, observability, backups | Germany (EU) |
| Anthropic Ireland, Limited / Anthropic, PBC | LLM API (document analysis, requirement extraction, chat) | EU contracting entity; processing may occur in the USA |
| OpenAI | LLM / embeddings API | USA |
| Paddle | Merchant of Record — payments, invoicing, tax | UK / EU / USA |
| cal.pl | transactional (system) email delivery and marketing-website hosting | Poland (EU) |
| Google Ireland Limited / Google LLC (Google Analytics) | marketing-website analytics | EU / USA |
| Mixpanel, Inc. | in-product analytics | EU data residency (analytics data is stored on Mixpanel's EU servers); Mixpanel, Inc. is US-based, so access from the USA cannot be excluded |
Primary data storage (databases, uploaded files, embeddings, and AI observability data) is located exclusively in the European Union (Germany). AI providers receive document content transiently for processing, as described in Section 4.
We may also disclose data where required by law (e.g., to public authorities upon a valid legal request).
6. International transfers
Where processing involves providers in the United States, transfers are safeguarded by:
- the EU–US Data Privacy Framework (DPF), where the provider is certified, and
- Standard Contractual Clauses (SCCs) incorporated into each provider's data processing agreement, as a parallel or fallback mechanism,
- supplementary measures where applicable (encryption in transit, minimization of transferred content).
Copies of relevant transfer safeguards can be requested at support@specky.app.
7. Data retention
| Data | Retention |
|---|---|
| Account and organization data | for the duration of the account, then deleted within 30 days of account deletion |
| Customer content (documents, tasks, embeddings, transcriptions) | for the duration of the account; deleted within 30 days of account deletion or earlier upon deletion within the product |
| AI observability data (prompts and responses in our self-hosted tool) | hosted on our EU infrastructure; retained up to 30 days, then deleted |
| Billing records held by us | as required by tax and accounting law (in Poland, generally 5 years from the end of the relevant tax year) |
| Security and audit logs | up to 12 months |
| Backups | encrypted backups are rotated; deleted data leaves the backup cycle within a maximum of 35 days |
After a subscription ends without account deletion, your data is retained in read-only mode so you can export it or reactivate; the account deletion rules above apply when you delete the account.
8. Your rights
Under the GDPR you have the right to: access your data; rectify it; erase it; restrict processing; data portability; object to processing based on legitimate interest; and withdraw consent at any time (where processing is based on consent), without affecting prior processing.
To exercise these rights, contact support@specky.app. We respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl), or the authority in your EU member state.
If you are an end user whose data was uploaded to Specky by an organization (e.g., your employer or contractor), that organization is the controller of that content; please direct requests to them. We will assist them in fulfilling your rights as required by our DPA.
Non-EU users: depending on your jurisdiction, you may have similar rights (e.g., under the UK GDPR). We honor access, correction, and deletion requests from all users regardless of location. If you are a resident of a U.S. state, see Section 9.
9. United States state privacy rights
This section applies to residents of U.S. states with comprehensive privacy laws — including California (CCPA as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comparable statutes. We provide these disclosures and honor these rights for all U.S. users, regardless of whether a given statute's applicability thresholds currently apply to us. Terms such as "business", "service provider", "sell", "share", and "sensitive personal information" have the meanings given to them in the CCPA/CPRA.
We do not sell or share personal information. We do not sell personal information for monetary or other valuable consideration, and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined by the CCPA/CPRA and comparable state laws. We have not sold or shared personal information in the preceding 12 months, and we do not knowingly sell or share the personal information of consumers under 16 years of age. We do not use personal information for profiling that produces legal or similarly significant effects.
Categories of personal information. In the preceding 12 months we collected the following CCPA categories, for the business purposes described in Section 3, and disclosed them to the service providers listed in Section 5:
| CCPA category | Examples | Source |
|---|---|---|
| Identifiers | name, email address, account and organization identifiers, IP address | you |
| Commercial information | plan, subscription and billing status, usage counters | you; Paddle |
| Internet or other electronic network activity | usage data, device and browser data, cookie identifiers, security and audit logs | collected automatically |
| Audio, electronic, and visual information | audio recordings and transcriptions, uploaded documents and other Customer Content | you (as Customer Content) |
| Professional or employment-related information | organization name, role within the organization | you |
We do not collect biometric data, precise geolocation, government identifiers, or education records, and we do not draw inferences to create consumer profiles.
Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it beyond the purposes permitted for service providers under the CCPA. Customer Content may contain sensitive data if you choose to upload it; in that case we process it solely on your organization's documented instructions and do not use it for any other purpose. Because we do not use or disclose sensitive personal information for purposes other than those permitted, the right to limit its use does not apply to our processing.
Your rights. Subject to your state's law, you have the right to: know what personal information we collect, use, and disclose; access a copy of it; correct inaccuracies; request deletion; obtain it in a portable format; opt out of sale, sharing, or targeted advertising (we do not engage in any of these); limit the use of sensitive personal information (not applicable, as explained above); and not be discriminated against for exercising any of these rights — we do not deny service, charge different prices, or provide a different level of quality on that basis.
How to exercise your rights. Email support@specky.app from the address associated with your account, or use the export and deletion features in the product. We verify requests by confirming control of the account email; for deletion requests we may ask for additional confirmation. An authorized agent may submit a request on your behalf with written permission signed by you, and we may still ask you to verify your identity directly. We respond within 45 days, extendable once by a further 45 days where reasonably necessary, and we will tell you if an extension is needed. If we deny a request, you may appeal that decision by replying to our response within 45 days; we will inform you of the outcome and, where your state provides one, of the mechanism for contacting your state attorney general.
Global Privacy Control. Our marketing website recognizes the Global Privacy Control (GPC) browser signal. Because we do not sell or share personal information, receiving a GPC signal does not change any sale or sharing practice; we nonetheless treat it as a rejection of non-essential (analytics and advertising-measurement) cookies for that browser, alongside the controls in our cookie banner (Section 11).
Recordings and all-party consent. Several U.S. states require the consent of all parties to a recorded conversation. Where recording features are used, your organization — not Specky — determines who is recorded and is responsible for obtaining every required consent, as set out in Section 5 of our Terms of Service and in our DPA.
Our role for Customer Content. With respect to Customer Content, we act as a service provider (California) or processor (other states) on behalf of your organization, which is the business or controller. We do not retain, use, or disclose that content for any purpose other than performing the services, and never for a "commercial purpose" outside our direct business relationship with the customer. If your data reached Specky through an organization, please direct rights requests to that organization; we will assist it as required by our DPA.
California "Shine the Light" (Cal. Civ. Code §1798.83). We do not disclose personal information to third parties for their own direct-marketing purposes.
10. Security
We apply technical and organizational measures including: encryption in transit (TLS), encryption of backups, tenant isolation at the application and database level, role-based access control, secrets management, audit logging, and the principle of least privilege for internal access. A detailed description of measures (TOM) is provided in Annex 2 to our DPA.
No system is perfectly secure. In the event of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and affected customers without undue delay, in accordance with GDPR Articles 33–34.
11. Cookies
Our application uses cookies strictly necessary for the service to function (session, authentication, and security), which do not require consent. In addition, subject to your consent, we use: analytics cookies and similar identifiers (Google Analytics on our marketing website and Mixpanel within the application), and advertising conversion-measurement cookies (Google Ads on our marketing website, used solely to measure whether a visit from one of our ads leads to a sign-up). We display a cookie consent banner that lets you accept, reject, or manage each of these non-essential categories separately, and you can withdraw or change your consent at any time via the “Cookie settings” link in the website footer. We do not use remarketing or cross-site behavioral-advertising cookies, and our analytics tools run with advertising and remarketing features disabled. We also honor the Global Privacy Control (GPC) signal as described in Section 9.
12. Children
Specky is a business tool intended for users aged 18 or older and is not directed at children. We do not knowingly process the personal data of children under 16.
13. Changes to this policy
We may update this policy as the service evolves — for example, when adding a new subprocessor or feature. Material changes will be announced in the application or by email at least 14 days in advance, and the subprocessor list follows the 30-day notice rule described in our DPA. Each version is identified by the version number and date above.
14. Contact
Privacy inquiries: support@specky.app General support: support@specky.app Postal address: ul. Malownicza 9, 72-006 Mierzyn, Poland
Requests under U.S. state privacy laws (Section 9) may be sent to the same address or email; we currently do not operate a toll-free telephone line, as we conduct business with consumers exclusively online.