How Spins Solutions handles business service data
This notice combines the service terms, privacy notice, retention schedule, and technology-provider disclosures for covered software and hosted services provided by Spins Solutions, LLC.
These are business services, not consumer storage services. Submit only information your organization authorizes you to share and only what is reasonably needed to use the applicable service, obtain support, or deliver a report.
Covered services
These Legal, Privacy & Data Practices apply to the following products and services provided by Spins Solutions, LLC, collectively referred to as the “Services.” Each Service has different functions and data-handling boundaries, as described below.
Signal Desk
The hosted support-operations and administration service used to manage agencies, support cases, communications, submitted support packages, and service access.
HFR Release Tracker
The locally operated release-review and tracking product. Material from HFR Release Tracker is handled by Signal Desk only when a user deliberately submits it for support or review.
Report Manager
The locally operated report-automation product, together with the Signal-hosted licensing, activation, privacy-minimized operational telemetry, and optional email-delivery features it uses.
A product or service not named above is not automatically covered by this notice. Newly covered services will be identified through an updated effective date and version.
Terms of use
Business authorization
You represent that you are authorized by your organization to access the service, open cases, select recipients, and transmit the business information and files you submit. Your organization remains responsible for deciding what information may be shared and for providing any notices or obtaining any permissions required by law, contract, or company policy.
Appropriate information
Use the Services only for legitimate business, support, release-review, and report-delivery purposes. Do not submit passwords, API keys, payment-card data, government identification numbers, export-controlled material, or information unrelated to the applicable business purpose. The Services are not designed or offered as HIPAA-compliant services; do not submit protected health information.
Acceptable use
You may not probe or bypass access controls, upload malicious content, impersonate another person or agency, interfere with service operation, use the service unlawfully, or send abusive, deceptive, or unsolicited email. We may limit, suspend, or block access when reasonably necessary to protect customers, recipients, infrastructure, or the service.
Service limitations
Security scanning, validation, delivery status, and other automated checks reduce risk but cannot guarantee that content is complete, safe, error-free, or successfully delivered. Users remain responsible for reviewing reports, confirming recipients, maintaining appropriate local copies, and following their organization’s procedures.
Disclaimers and liability
To the maximum extent permitted by applicable law, and subject to any signed customer agreement, the Services are provided “as available” without implied warranties. Spins Solutions, LLC is not responsible for indirect, incidental, special, consequential, or punitive damages arising from use of the Services, unauthorized submissions, recipient choices, local-device access, or third-party email and infrastructure services. Nothing here excludes liability that cannot lawfully be excluded. If this page conflicts with a signed agreement, the signed agreement controls.
Privacy & data practices
For customer-submitted business data, the customer organization generally determines what is submitted and why. Spins Solutions, LLC (“Spins Solutions,” “we,” “us,” or “our”) processes that information to authenticate users, operate the applicable Services, investigate support cases, deliver requested communications, secure the Services, and meet contractual or legal obligations.
Signal support data
Account names and email addresses; agency and contact records; case descriptions and status; support messages; submitted files and screenshots; diagnostic metadata and findings; and security or administrative audit events.
HFR Release Tracker data
HFR Release Tracker operates locally. Signal handles HFR diagnostic metadata, findings, or other business material only when an authorized user deliberately submits a support package, file, screenshot, or message through Signal Desk.
Report Manager data
Agency, licensed-user and installation identifiers; activation state; delivery counts, byte totals, outcomes, versions, and limited runtime events. Report names, parameters, output paths, workbook contents, recipients, subjects, and message bodies are not retained in Signal’s Report Manager operational database.
Email delivery
Resend necessarily receives recipient addresses, sender details, subjects, message bodies, and any attachment selected for email delivery. Save + Notify sends no workbook or local file path. Local Save does not send the workbook to Signal.
Security data
Signal may process IP address, browser family, operating-system family, authentication events, and salted session correlation values to secure accounts and investigate misuse. Signal does not use advertising cookies or sell customer-submitted data.
The current production support-package and evidence workflow is designed not to send customer evidence to an external generative-AI service.
Retention schedule
Retention is based on the type of record, operational need, customer instructions, security requirements, and applicable law. A legal hold, security investigation, backup cycle, failed maintenance job, or contractual obligation may extend a period described below.
| Data category | Current handling |
|---|---|
| Raw support-package archives | Scheduled for deletion after 30 days by the ingestion worker. Package metadata and support findings may remain with the case. |
| Quarantine remnants and completed ingestion jobs | Scheduled for removal after 30 days. Detected or failed content remains inaccessible while quarantined. |
| Cases, messages, notes, contacts, findings, and clean email attachments or screenshots | Retained with the support record. There is currently no automatic expiration; removal is handled through an approved customer, contractual, administrative, or legal process. |
| Detailed security connection data | IP address, browser family, operating-system family, and session correlation are redacted after 90 days. The core audit event—actor, action, target, outcome, and time—remains for accountability. |
| Report Manager operational records | License, activation, quota, and privacy-minimized delivery records remain for administration and abuse prevention. Raw runtime events have a 90-day operational target once scheduled retention maintenance is commissioned. |
| Email content handled by Resend | Resend states that email data is retained for 30 days across standard plans; Enterprise retention may differ. Signal retains only the minimized operational fields described above for Report Manager sends. |
| Backups | Deleted information may remain in encrypted or provider-managed backups until the applicable backup cycle expires, then becomes unavailable through ordinary service operations. |
Deletion from active systems does not require alteration of immutable audit history where retention is reasonably necessary for security, fraud prevention, dispute resolution, or legal compliance.
Service providers & infrastructure
Spins Solutions uses a limited number of outside providers to operate the Services. This disclosure focuses on providers that materially host or transmit customer data, not on individual software components operated within our private environment.
| Provider | Purpose and data involvement | Provider information |
|---|---|---|
| Hostinger | Provides the hosted server infrastructure used to operate Signal Desk and associated service data, logs, private evidence storage, and provider-managed backups. | Privacy policy |
| Resend | Transmits Signal support email and Report Manager notifications or attachments, including the routing and message content required for delivery. | Privacy policy Data processing addendum Subprocessors |
Other infrastructure and security components are operated within the private service environment and do not independently receive customer data as outside service providers. Provider services and terms may change; their linked notices control their own practices.
Questions, requests, and changes
Contact support@spins.solutions for questions about these practices or to request access, correction, or deletion. We may need to verify the requester and the organization’s authority before acting.
We may update this notice as the service, providers, or legal requirements change. Material changes will be identified by a new effective date and version. Continued use remains subject to the applicable customer agreement and the version presented when the service is used.