Privacy notice

Last updated: 20 October 2026.

Who we are

SPSync is a product of EBORACUM IT LTD, a company registered in England and Wales (company number 17237831), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. In this notice, "we"/"us" means EBORACUM IT LTD, and "SPSync" means the product in any of its editions: the desktop app, the command line, and the managed application that runs in your own Microsoft Azure subscription ("In your Azure").

You can reach us about anything in this notice at [email protected].

The most important thing: where your SharePoint data goes

SPSync reads the SharePoint lists you choose and writes them to a database you own and control. In every current edition (the desktop app, the command line, and In your Azure), SharePoint list content passes from Microsoft Graph, through the SPSync engine running on your own machine, server, or your own Azure subscription, into your own database. We do not receive it, store it, or have any way to see it. There is no SPSync-operated server that your list data passes through, and no copy of it is kept anywhere we control.

The one exception, described precisely because it is the one place this could ever be different: our earlier, directly-hosted private preview (invite-only, not open to new customers) does not currently have a live deployment, so no SharePoint data is processed through it today. If and when a tenant on that preview is deployed, SPSync's own infrastructure in Microsoft Azure would process the SharePoint data that tenant chose to replicate, on its instructions, as its processor. See the data processing agreement for what that means. If you are on that preview and move to a current edition, this exception would not apply to you.

Diagnostics you send us

If you use "Send diagnostics" (in the desktop app, the CLI, or by asking support to help with a failed run), you choose to upload a diagnostic bundle: app and machine details, your licence id and customer name if you have activated a licence, your replication configuration with every secret redacted, recent logs, and run history. The contents of your SharePoint lists themselves are never included, but site and list URLs and ids are, since support needs them to reproduce a failure. The "Send diagnostics" dialog itself also collects the free-text message you type describing the problem and the reply-to email address you give us so support can respond. Treat the message field as anything you type into it, since we do not filter or redact it the way the bundle's own configuration export is redacted, so avoid including anything (a colleague's name, a customer reference, a data snippet) you would not otherwise want to send us. Today, no Azure Storage account is connected, so a bundle you send is logged and discarded rather than kept at all. See the sub-processor list. Once storage is connected, a bundle will be held in Microsoft Azure, will not be publicly accessible, will be limited to the support team, and will be deleted automatically 60 days after upload. Sending diagnostics also opens a support ticket, and a hosted deployment can send you notification emails about your own runs (a failed run, a stalled schedule) if you turn those on; both use HubSpot and/or Resend to actually deliver, so see the sub-processor list for whether either is live yet.

Website and marketing data

If you submit a form on this site (downloading a resource, subscribing to the newsletter, or booking a demo), we collect what that form asks for (typically your work email address, and for some forms your name, the destination database you plan to use, or the topic of your enquiry, and for demo requests your company name and phone number), to send you what you asked for and, only if you tick the separate marketing box, occasional product emails. That box is unticked by default and every marketing email has a one-click unsubscribe. We do not run advertising cookies on this site, and analytics cookies are set only if you accept them (see the next section). Where a form is handled by a third party (HubSpot for marketing email; Microsoft Bookings for scheduling a demo), see the sub-processor list for whether that is actually live yet, since we are still switching some of these on.

Analytics cookies on this site

We use Google Analytics 4 to count visits and to see which pages people read, so we know which guides help and which need work. It runs in Google's Consent Mode, and the banner at the bottom of the page asks you first. Until you accept, Google Analytics sets no cookies and reads none.

Before you choose, and after you decline, each page still sends Google a cookieless ping. It carries the page address, the page you came from, your browser and screen type, a timestamp and the fact that you have not consented. It has no cookie identifier, so Google cannot link one page view to the next. Google uses these pings to estimate total visits.

If you accept, Google Analytics sets two first-party cookies on spsync.io: _ga and _ga_TXFLWHTN6W. Both hold a random identifier that lets it recognise a returning browser, and both expire after two years. With them in place it records the pages you view and the page you arrived from. It also records how far you scroll, which links you follow off the site, your device and browser type, and your approximate location at city level. Google works out that location from your IP address and then discards the address. Google Analytics 4 does not log or store IP addresses, and we also set its anonymize_ip option. We do not turn on any advertising feature. The ad storage, ad user data and ad personalisation signals stay denied whatever you choose.

Your choice itself is kept in your browser's local storage under the key spsync-consent, as granted or denied. It is not a cookie and it is never sent to us. To change your mind, use "Cookie settings" at the bottom of any page and choose Decline. That turns analytics storage off again and deletes the _ga cookies from spsync.io. Clearing your browser's site data does the same and brings the banner back.

Google acts as our processor for this data under the Google Ads Data Processing Terms, which cover Google Analytics. Google deletes event-level data at the end of the retention period set on our Analytics property; Google's default is two months and the longest it allows is fourteen. Google may process the data in the United States, and Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension.

Licensing and activation data

Activating a licence on a machine sends us a one-way cryptographic hash of that machine's hardware identifier (never the identifier itself), plus the hostname, operating system and app version, so we can enforce the number of machines your licence covers and help support identify which of your machines holds a seat. We also process the licence key text itself and the order and invoice details for your quote. We do not take card payments: you pay against our invoice or purchase order, so no payment provider handles your card details.

Cloud preview sign-in

The invite-only private preview is designed to use Microsoft sign-in (via Supabase, our authentication provider) to identify you; no separate SPSync password exists. This only applies if you use that preview, and only once it has a live deployment. See the sub-processor list.

Who else processes data on our behalf

See the full sub-processor list for every company that touches data described above and why.

Legal basis and retention

Here is the lawful basis for each category of personal data described above, and how long we keep it:

• Diagnostic bundles (app and machine details, licence id and customer name, redacted replication configuration, logs, run history, the free-text message and reply-to email you give us) are processed on the basis of legitimate interests: diagnosing and fixing the problem you asked us to help with, and keeping SPSync working. Kept 60 days from upload, then deleted (see above for today's actual status). You can object to this processing at any time by emailing [email protected]; if you object before sending diagnostics, use another route to describe your problem instead.
• Website and marketing-form data (email, and where asked for, name, company name and phone number for demo requests, destination database or enquiry topic): booking a demo is performance of a contract (arranging the booking you asked for). Subscribing to the newsletter and downloading a resource are each consent: the newsletter's confirmation email is itself that consent (double opt-in, so nothing is sent until you click it), and requesting a resource download is you asking us to send it. Either way you can withdraw consent at any time by unsubscribing or emailing [email protected]. Where you additionally tick the separate marketing box on any form, that is a further, separate consent for occasional product emails, also withdrawable at any time by unsubscribing.
• Website analytics (the Google Analytics cookies and the data recorded with them) is processed on the basis of your consent. You give it through the banner and can withdraw it at any time from "Cookie settings". The cookieless pings sent before you choose or after you decline carry no identifier and are processed on the basis of legitimate interests: counting how many people visit the site. The cookies expire after two years; Google keeps event-level data for the retention period described in the analytics section above.
• Licensing and activation data (hashed hardware identifier, hostname, OS, app version, licence key text, order/subscription state) are processed as performance of a contract: issuing and administering the licence you bought or activated.
• Cloud preview sign-in (identity from Microsoft sign-in via Supabase) is processed as performance of a contract: letting you sign in to the preview you were invited to.

We keep licensing and support records for as long as needed to administer your licence and for a reasonable period afterwards for tax and dispute purposes. Website and marketing-form data you submit is kept for as long as needed to respond to it (deliver the resource, run the newsletter, or arrange the demo) and, where you gave separate marketing consent or subscribed to the newsletter, for as long as that consent or subscription stands; any of it is deleted once you unsubscribe or ask us to (see Your rights below). We keep cloud preview sign-in identity for the life of your preview account, deleting it when your access to the preview ends. Diagnostic bundle retention is covered above.

On your own machine, the desktop app keeps run history (the log of each sync run and its events) in its local control store. By default it keeps the newest 1,000 runs of each replication plus any failed or warning run from the last 90 days, and deletes older run history automatically each night. That data never leaves your machine unless you send a diagnostic bundle.

Your rights

Under UK GDPR you can ask us to confirm what personal data we hold about you, correct it, delete it, restrict or object to our processing of it, or receive a copy in a portable format. Email [email protected] and we will respond within the statutory period (currently one calendar month). You can also complain to the UK Information Commissioner's Office (ico.org.uk) at any time.

Changes to this notice

We may update this notice as SPSync changes. Material changes will be reflected here with a new "last updated" date; we do not maintain a separate change log.