Sespre
Contact us

Terms of service

Last updated 26 October 2026

1. Who these terms are between

These terms are between Bebob Builder Oy (business ID 2491403-4), c/o Regus Itis, Itäkatu 1-5 D 217, 00930 Helsinki, Finland ("we", "us"), and the organisation that uses Sespre ("the customer", "you"). Sespre is for businesses only. The person who accepts these terms confirms that they may bind the customer.

If you and we sign an order or another written agreement, it applies together with these terms. Where they conflict, the signed agreement wins, then the data processing agreement, then these terms.

2. Words we use

  • Service: Sespre, including the hub, the instance software and our support.
  • Hub: the web application where customers manage their Workspaces, people and instances.
  • Instance: one customer's own copy of the Sespre software, with its own database. A hosted instance runs in our cloud environment in the European Union. A self-hosted instance runs in your own cloud account.
  • Connected system: a third-party service, such as an accounting, CRM or project tool, that you connect to your instance.
  • Customer data: the data your instance syncs from connected systems, and the chats, dashboards, reports and other content your users create in it.

3. The service

Sespre syncs data from your connected systems into your instance, answers your users' questions about it with an AI model, and shows the query and rows behind each answer. We may improve and change the service. If a change removes a feature you rely on, we tell you in advance.

Unless an order says otherwise, the service has no fee and comes with no service level. If an order sets fees, you pay them as the order says, plus value added tax, within 14 days of the invoice date.

4. Your accounts and users

  • You decide who in your organisation gets access, and you keep their sign-in details safe.
  • You are responsible for what your users do in the service.
  • Tell us at once if you think someone used your account without permission.

5. Connected systems

  • You choose which systems to connect. The connection uses a credential, such as an API key, that you create in the connected system and give to your instance.
  • You confirm that you may connect each system and let Sespre read its data under that system's own terms.
  • The instance reads only the data the connector needs and stores the credential encrypted in your instance. Sespre does not change data in a connected system unless you start an action that does so.
  • You can stop a connection at any time: remove it in your instance, or revoke the credential in the connected system. When you remove a connection, your instance deletes its credential.
  • Connected systems are run by third parties. We are not responsible for their availability, their data or changes to their interfaces, and their own terms apply to your use of them.

6. Customer data

  • Customer data is yours. You give us the right to process it only to provide the service to you.
  • We do not sell customer data, use it for our own purposes, or use it to train AI models.
  • In a hosted instance, we process customer data as your processor under the data processing agreement below.
  • In a self-hosted instance, customer data stays in your cloud account and we have no access to it. You are responsible for that account, its security and its backups, and for your contract with the AI model provider you choose.
  • The hub receives only account data and instance reports with a fixed format, never customer data. Our privacy notice describes the personal data we hold as controller.

7. AI answers

Answers come from an AI model and can be wrong or incomplete. Each answer shows the query and rows it used so that you can check it. Check important answers before you act on them. Sespre does not give accounting, tax, legal or financial advice.

8. Acceptable use

Do not use the service to break the law or the rights of others, to attack or overload the service or a connected system, to get around its limits or security, or to process data you have no right to process. We may suspend access that puts the service, other customers or a connected system at risk. When we do, we tell you why and restore access when the risk is gone.

9. Software and rights

We and our licensors own the service and its software. During your agreement, we give you a non-exclusive, non-transferable right to use the service, and for a self-hosted instance, to install and run the instance software in your own cloud account for your own business. Do not resell the service, or copy, modify or reverse engineer the software, except where the law allows it. If you send us feedback, we may use it without any duty to you.

10. Confidentiality

Each party keeps the other's non-public business information confidential and uses it only for this agreement. This does not apply to information that is public, that the receiving party already had or created on its own, or that the law requires it to disclose.

11. Warranty and liability

  • We provide the service with reasonable skill and care. Apart from that, it is provided as it is, without other warranties.
  • Neither party is liable for indirect or consequential loss, such as lost profit, lost revenue or lost business.
  • Each party's total liability under this agreement is limited to the fees the customer paid us in the 12 months before the event that caused the claim. If the service has no fee, our total liability is limited to EUR 1,000.
  • These limits do not apply to loss caused by intent or gross negligence, or to liability that the law does not allow us to limit.

12. Term and ending

  • The agreement starts when you first use the service and lasts until one party ends it. Unless an order sets a fixed term, either party can end it with 30 days' written notice.
  • Either party can end it at once if the other party materially breaks these terms and does not fix the breach within 14 days of notice.
  • When the agreement ends, your access ends. For a hosted instance, you can export your customer data for 30 days, after which we delete the instance and its data. For a self-hosted instance, you stop using the instance software.

13. Changes to these terms

We may change these terms. We post changes here and update the date at the top. For a change that is material to you, we tell you at least 30 days before it applies. If you do not accept the change, you can end the agreement before it applies.

14. Law and disputes

Finnish law applies, without its rules on conflict of laws. The District Court of Helsinki settles disputes at first instance.

15. Contact

Questions about these terms: help@sespre.com. For help with the service, see Support.

Annex: Data processing agreement

This annex applies when we host an instance for you. It is the agreement under Article 28 of the General Data Protection Regulation (GDPR) between you as controller and us as processor.

A. Subject, duration and purpose

We process personal data in customer data to run your hosted instance: to sync data from your connected systems, store it, answer your users' questions about it and show the results. We process it for as long as the agreement lasts and until we delete it as section H says.

B. Types of data and data subjects

The personal data is what your connected systems hold and you choose to sync, and what your users enter. It usually includes names, contact details, job titles and business transactions of your customers, suppliers, employees and contacts, and the accounts and chats of your users. Do not connect special categories of personal data unless you have a legal basis for it and have told us.

C. Your instructions

We process the personal data only on your documented instructions. These terms, your configuration of the instance and your use of the service are your instructions. If we think an instruction breaks the GDPR, we tell you. If the law requires us to process data otherwise, we tell you first, unless the law forbids it.

D. Confidentiality and security

  • Only the people who need access to run the service get it, and they are bound by confidentiality.
  • Each hosted instance has its own database, storage and processes. No two customers share them.
  • Data is encrypted in transit and at rest. Credentials for connected systems are stored encrypted.
  • Access to the hosting environment needs personal accounts with two-factor authentication, and we keep logs of it.
  • We keep backups, test that we can restore them, and keep our software up to date.

E. Subprocessors

You give us general authorisation to use subprocessors. We use only subprocessors that process data in the European Economic Area or in a country with an adequacy decision, and we bind each one in writing to the same data protection duties as this annex. Before your hosted instance processes customer data, we tell you which subprocessors it uses. We tell you at least 30 days before we add or replace one. If you object on reasonable data protection grounds and we cannot solve the problem, you can end the agreement. We remain responsible for our subprocessors.

F. Help with your duties

We help you answer requests from data subjects, for example to access or delete their data, and help with security, data protection impact assessments and consultations with authorities, as far as the nature of the processing allows. If a data subject contacts us directly, we send the request to you.

G. Personal data breaches

We tell you without undue delay, and no later than 48 hours after we become aware of a personal data breach that affects your data. We give you the information we have, take steps to contain it, and update you as we learn more.

H. Return and deletion

When the agreement ends, you can export your customer data for 30 days. After that, we delete the hosted instance and its data, including backups when their rotation ends, and no later than 90 days after the agreement ends, unless the law requires us to keep it.

I. Audits

We give you the information you need to show that we meet this annex. You can audit us, or have an independent auditor bound by confidentiality do so, with at least 30 days' notice, at your own cost, and not more than once a year, unless a supervisory authority requires it or a breach gives you reason.

J. Contact

Data protection questions: privacy@sespre.com.