Privacy notice

What the pilot is for

The pilot checks managed sign-in, account permissions and the internal consultancy workflow. It starts with no client or job records. Public sign-up, team access and real business-data imports are not enabled for this phase.

The identity and security information described below is used to identify the authorised owner, protect access and investigate problems. A wider rollout requires a confirmed privacy basis, retention schedule and tested removal process for the data that rollout will use.

Information handled

• Microsoft sign-in: the application requests the openid and profile scopes. Microsoft supplies identity claims which the server validates, including the tenant and user object identifiers. Those identifiers are matched to an explicit account record with a display name, role and access scope.
• Session and security records: the server keeps short-lived sign-in state, session records, timestamps and limited audit events such as sign-in outcomes and access denials. The connection address is used temporarily in memory to limit excessive authentication requests. Infrastructure providers may process their own connection and security records.
• Records entered in SPEK: Enabled forms can save clients, contacts, enquiries, jobs, tasks, activity and corrections, evidence links, billing preparation, reviewed time, private notes and plans, preferences, suggestions, General chat messages, library and course metadata, learning records, an operational people directory, and owner-only company initiatives with milestones, evidence and change history. Records carry account attribution and relevant history. Private notes and plans are restricted to their account in the application. General chat and published library or course entries are designed for authorised team users when team access is enabled. Do not put real client, personnel, financial or other confidential business material into this owner pilot before its separate data-admission checks are complete.

The application does not receive or store your Microsoft password. Microsoft tokens are handled during sign-in and are not retained in the application database or given to browser code. No mailbox, calendar, SharePoint, HubSpot, Xero, AI or device source is connected by this sign-in.

Source connections

Separately approved source connections can read selected metadata from HubSpot or Microsoft 365. Connections are private to the owner. Observations and access tokens are kept in server memory; local disconnect controls persist. Source records are not imported into SPEK or changed automatically. Installing this code, or signing in with Microsoft, connects no business source. A local disconnect stops this application from reading; it does not revoke permissions at the source provider.

Where information is processed

The pilot is hosted on SPEK's approved IONOS server in the UK. Microsoft processes authentication using its own services. A UK application server does not mean that all provider processing takes place only in the UK. See Microsoft's privacy statement and IONOS's privacy information for their information.

The application uses HTTPS, individual account mappings and restricted server files. Authorised server administrators and infrastructure providers may have technical access. These controls do not make the pilot anonymous or prevent all possible access. There is no automatic external publication, outgoing messaging or business-source sharing in this release.

Essential cookies and browser storage

__Host-spek-oidc binds a sign-in attempt to the browser for up to five minutes. __Host-spek-session supports the signed-in session for up to eight hours; server access can end earlier, including after 30 minutes of inactivity, Microsoft token expiry or an access change. Both cookies are Secure, HttpOnly and restricted to this host.

The application does not store client records in browser storage and includes no advertising or analytics trackers. Your browser and Microsoft sign-in have their own separate settings and cookies. Clearing SPEK's cookies signs this browser out but does not erase server records.

Retention, access and removal

Expired sign-in attempts and sessions are rejected; stored expired entries are cleaned up during later sign-in activity. Sign-out revokes the current SPEK session. Operational records and audit history do not yet have an automatic retention or deletion schedule, and there is no self-service account-erasure screen. Removing an account mapping blocks access; it does not erase every associated record.

Contact Paul at the address above to request access, correction, restricted use or removal, or to raise a concern. Applicable privacy rights depend on the circumstances; you may also contact the Information Commissioner's Office. Any backup copies created during acceptance must be considered when reviewing removal. A tested retention, account-closure and backup-removal process remains a gate before real business data or wider access is admitted.

Changes to the pilot

This notice describes this limited release. New source connections, data uses or access groups need their own review and an updated notice before activation. These pages are public so they can be read before signing in; they contain no account or client records.