Privacy notice
Last updated 26 October 2026
Who we are
sespre.com and the Sespre service are run by Bebob Builder Oy (business ID 2491403-4), c/o Regus Itis, Itäkatu 1-5 D 217, 00930 Helsinki, Finland. We are the controller for the personal data described here, except where the section Data in a customer's instance says otherwise. Questions about privacy: privacy@sespre.com.
Who this notice covers
- Visitors: people who read this website.
- People who contact us through the contact form.
- People who book a meeting through our booking page.
- Users of the Sespre service: people who sign in to the Sespre hub, where customers manage their people and instances, or to a Sespre instance.
- People whose data is in a customer's instance, such as contacts, employees or invoice recipients in the systems a customer connects.
What we collect and why
| Who | Data | Why |
|---|---|---|
| Visitors | Standard request logs kept by our hosting provider, such as IP address, browser type and the page requested. If you send the contact form, your IP address is also held in memory for up to ten minutes to limit how often one address can send it. | To run and protect the website |
| Visitors | Visitor statistics: the page you read, the site that sent you, your browser, operating system, device type and country. Your IP address and browser's user agent are used only to compute a salted hash that changes every day, and are not stored. | To count visits and see which pages are read |
| People who contact us | Name, work email, company and your message, plus the language and address of the page you sent the form from | To answer your enquiry and keep track of our conversation |
| People who book a meeting | Name, email and the meeting time you choose on our booking page | To hold the meeting with you |
| Users of the hub | Name, work email, password hash, the Workspaces you belong to and your role in each, sign-in sessions, and an audit log of changes you make, with the IP address and browser of each request | To give you an account, keep it secure and show customers who changed what |
| Hosted instances | Health, version, connector status, row counts and usage figures that each instance reports to the hub. These reports have a fixed format and hold no business data and no free text. | To run, license and support the instances |
You can browse this website without telling us who you are. Name, work email and company are needed to send the contact form; without them we cannot reply.
To keep spam out, your browser solves a small computing puzzle from our own server before the contact form sends. The puzzle holds no personal data, and no other service and no cookies are involved.
Data in a customer's instance
Each customer has its own Sespre instance. The instance holds the data the customer syncs from the systems it connects, such as its accounting, CRM and project tools, and the chats, dashboards and reports of its users. This data can include personal data, for example the names and contact details of customers, suppliers and employees.
- The customer is the controller of this data. It decides which systems to connect and what to sync. Questions about this data go to the customer first.
- If we host the instance, we process this data only for the customer, on its instructions, as our processor terms say (data processing agreement). We do not use it for our own purposes, and we do not use it to train AI models.
- If the customer runs the instance in its own cloud, we have no access to this data.
The connection to a system such as an accounting service uses a credential the customer creates in that system. The customer can revoke the credential there at any time.
Legal bases
- To run and protect the website. We use request logs and IP addresses based on our legitimate interest in running and protecting the website.
- To count visits. We collect visitor statistics based on our legitimate interest in knowing how the website is used (GDPR Article 6(1)(f)). We see only aggregated statistics, never individual visitors.
- To answer business enquiries. We use contact form details based on our legitimate interest in answering the enquiries businesses send us.
- To hold meetings. We use booking details based on our legitimate interest in meeting businesses that ask to talk with us.
- To run the service. We use hub account data and instance reports to perform our contract with the customer you work for, and based on our legitimate interest in keeping the service secure.
We do not make decisions about you based solely on automated processing.
Who we share data with
- Our hosting provider, UpCloud, in Finland, runs the servers for this website and the hub, and keeps their request logs.
- Our email sending provider, in the European Union, delivers contact form submissions to our company mailbox and the hub's invitation emails.
- Plausible Insights OÜ, in Estonia, provides our visitor statistics and stores them in the European Union. Its script is served from sespre.com, and your browser sends page views to sespre.com, which passes them on to Plausible.
- Proton AG, in Switzerland, runs our meeting booking page and our calendar. The "Book a meeting" links open Proton's booking page in a new tab; nothing loads from Proton until you click one. Switzerland has an adequacy decision from the European Commission.
- Hosted instances run with cloud and AI model providers in the European Union. The data processing agreement says how we choose them and how customers hear about changes.
The website uses no other services: no advertising, and no scripts, fonts or other files loaded from other sites. Where personal data is processed outside the European Economic Area and no adequacy decision covers it, the transfer relies on the European Commission's Standard Contractual Clauses or another safeguard the GDPR allows. To obtain a copy of the applicable safeguards, email privacy@sespre.com. We do not sell personal data.
How long we keep it
- Contact form details: 24 months after our last contact with you, unless you ask us to delete them sooner.
- Meeting bookings: 24 months after our last contact with you, unless you ask us to delete them sooner.
- Hub accounts: as long as you belong to a Workspace, and up to 90 days after the customer's agreement ends.
- Hub audit log: 24 months after each entry, unless the law requires longer.
- Data in a hosted instance: as long as the customer's agreement lasts, then deleted within 30 days, as the data processing agreement says.
- Visitor statistics: kept only in aggregated form, which does not identify you, for as long as we use Plausible.
- Request logs: as long as our hosting provider keeps them under its own retention periods.
Your rights
You can ask to access, correct or delete your personal data, or object to its processing. Email privacy@sespre.com. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live.
Cookies and browser storage
This website sets no cookies and stores nothing in your browser. The hub and Sespre instances set one cookie that keeps you signed in; it is needed for the service to work.
Our visitor statistics work without cookies or browser storage and do not follow you across other websites. We use no advertising or tracking.
Children
Sespre is a service for businesses and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@sespre.com and we will delete it.
If the company changes hands
If Bebob Builder Oy or Sespre is merged, acquired or sold, personal data may pass to the new owner, who must keep protecting it as this notice describes.
Changes
We post changes here and update the date at the top.