Spscommerce

SPS Commerce Privacy Notice — User-Focused Overview

*Last updated: June 2025. This is a summary, not legal advice.*

1. Data Collection and Use

SPS collects “Personal Information,” meaning information that can directly or indirectly identify an individual. The Notice does not provide a detailed list of all data fields, but indicates that information may come from:

• Websites, mobile and web applications, customer platforms, and other digital services
• Marketing activities, including emails, advertisements, social media, and online interactions
• Cookies, pixels, session-replay tools, and similar technologies
• Third-party analytics tools, which may collect IP addresses and browsing activity
• Information you submit when requesting products, services, resources, or support

SPS says it uses data to:

• Provide, operate, secure, and improve its Services
• Personalize content and user experiences
• Analyze engagement, traffic, and usage patterns
• Conduct marketing and analytics
• Meet contractual, legal, regulatory, and business requirements
• Prevent fraud and improve security

Its legal bases may include consent, contract performance, legitimate interests, and legal obligations.

Cookies and session replay

SPS uses tracking technologies for website functionality, analytics, and marketing. Session-replay tools may record interactions such as clicks and time spent on pages. SPS states these tools do not capture communications in transit or sensitive personal data, but the Notice does not explain in detail how sensitive data is identified or excluded.

Where legally required, a cookie-management tool allows users to accept or reject non-essential cookies. Elsewhere, users may need to manage cookies through browser settings.

Retention and security

Data is retained only as long as necessary for stated purposes or legal requirements, but no specific retention periods are provided. SPS describes encryption, secure storage, and other “industry-standard” safeguards, but no security system is guaranteed to prevent breaches.

2. User Rights

Depending on location and applicable law, users may have the right to:

• Access their Personal Information
• Correct inaccurate or incomplete data
• Request deletion
• Restrict processing
• Receive or transfer data in a portable format
• Object to legitimate-interest processing or direct marketing
• Withdraw consent for future processing
• Complain to a data-protection regulator

Requests should be sent to privacy@spscommerce.com and should include identifying and contact information plus details of the request. SPS may verify identity, and legal exceptions may limit or defeat a request. Marketing emails may be opted out of through SPS or the stated contact address.

SPS says it does not knowingly collect information from children under 13 and will delete it if discovered.

3. Third-Party Sharing

SPS says it does not sell Personal Information to third parties. It may nevertheless share data with:

• Hosting, analytics, marketing, and other service providers
• SPS affiliates and subsidiaries
• Lawyers, accountants, insurers, and other professional advisers
• Law enforcement, courts, regulators, or government authorities
• Parties involved in a merger, acquisition, sale, or other business transfer

Sharing may be based on consent, a contract, legal requirements, or SPS’s legitimate business interests. The Notice does not identify specific vendors or explain all contractual safeguards; users must contact SPS for sub-processor information. Vendor lists may change.

International transfers may use GDPR Standard Contractual Clauses or adequacy decisions where applicable.

4. AI/ML Training

The Notice does not state whether Personal Information is used to train artificial-intelligence or machine-learning models. It mentions analytics, personalization, and service improvements, but those statements should not be interpreted as either permission or a prohibition on AI training. Users seeking certainty should request clarification from SPS.

5. Key User Obligations and Restrictions

The principal stated obligation is practical: if you do not agree with the Notice, you should stop using SPS websites, products, and Services. Users should also:

• Review cookie settings and opt out where available
• Provide sufficient information to verify privacy requests
• Monitor policy updates and marketing preferences

The Notice does not impose detailed confidentiality, acceptable-use, or data-submission obligations.

6. Liability and Disputes

This Privacy Notice contains no express limitation of liability, warranty disclaimer, governing-law clause, arbitration requirement, or dispute-resolution procedure. It also does not promise a particular security outcome or specify compensation for misuse or breaches. Applicable law, other SPS agreements, and mandatory privacy rights may control these issues.

SPS states it will notify affected individuals of breaches as required by law, including information about the incident and recommended protective steps.

7. Changes to the Notice

SPS may update the Notice periodically. For material changes, it says it will post a notice on its website. It encourages users to review the Notice frequently, but does not promise email or individual notification, nor specify how long change notices will remain visible.

Terms of Use Overview

*Last updated: March 23, 2026*

> Important limitation: The Terms incorporate SPS’s separate Privacy Notice, but that notice is not included here. Therefore, the specific categories of personal data collected, retention periods, legal bases, and privacy-rights procedures cannot be determined from this document alone.

1. Data Collection and Usage

Information you provide

Users must provide accurate, current, and complete information when registering or submitting data. SPS may suspend or terminate access if information is inaccurate or incomplete.

The Terms also cover materials submitted through the Site or Services, including:

• Content and business data
• Feedback and suggestions
• Prompts, configurations, and inputs provided to AI Features
• Information connected to third-party systems or data sources

How SPS may use data

SPS may use data derived from your use of the Products and Services to:

• Operate and maintain its offerings
• Provide support
• Improve and enhance products and services

This use is subject to a stated limitation: SPS should not disclose your identity or confidential information unless permitted by the Terms or applicable law.

However, the Terms do not explain what data is collected automatically, such as device information, usage logs, cookies, IP addresses, or analytics data. Those details should be reviewed in the Privacy Notice.

Broad license over submissions

By submitting content, data, feedback, or other materials, you grant SPS a worldwide, royalty-free, perpetual, irrevocable, transferable, and sublicensable license to use, reproduce, modify, distribute, display, and perform those submissions for operating, improving, and promoting SPS’s business.

You retain ownership, but this license is very broad and generally cannot be revoked. Unsolicited product ideas may be used by SPS without compensation or attribution.

2. User Rights

The Terms do not provide a detailed list of privacy rights. They do provide limited practical rights:

• You retain ownership of intellectual-property rights in your submissions, subject to SPS’s broad license.
• You may opt out of promotional emails using the method provided in the email.
• You may update account information to keep it accurate.
• You may contact SPS at legal@spscommerce.com with questions.

Rights to access, delete, correct, restrict, or export personal data—and how to exercise them—must be determined from the Privacy Notice and applicable law.

3. Third-Party Sharing

The Terms do not establish a complete third-party data-sharing policy. They state that:

• SPS may disclose identity or confidential information when permitted by the Terms or applicable law.
• AI Features may use third-party tools, models, or services.
• The Site may link to third-party websites, which SPS does not control or endorse.
• Your submissions may be used by SPS under a license that is transferable and sublicensable.

The Privacy Notice should be reviewed for categories of recipients, service providers, advertising or analytics partners, international transfers, and disclosures in response to legal requests.

4. AI/ML Training

The Terms do not clearly say that customer data is used to train general-purpose AI models.

They do permit SPS to use data derived from Service use to improve and enhance its offerings. This could potentially include development or improvement of AI Features, but the document does not expressly confirm or exclude model training.

Key AI risks and restrictions include:

• Outputs may be inaccurate, incomplete, misleading, or outdated.
• Users must independently review and validate outputs.
• AI outputs are not professional, legal, financial, compliance, or safety advice.
• Users may not use AI Features as a substitute for human judgment in legally binding, regulatory, safety-critical, or high-risk decisions.
• Systematic extraction, repurposing, or training on AI outputs outside the intended Service functionality is prohibited.
• SPS retains rights in the AI technology and may use third-party models or tools.

5. Key User Obligations

Users must:

• Use the Services only for internal business purposes.
• Protect credentials and systems with commercially reasonable safeguards.
• Accept responsibility for activity under their accounts.
• Promptly report unauthorized access or security breaches.
• Comply with export-control laws.
• Protect SPS confidential information.
• Avoid unlawful use, impersonation, interference, scraping, automated access, unauthorized security testing, reverse engineering, and circumvention of content protections.
• Avoid reselling or sublicensing the Services.

6. Liability and Disputes

SPS provides the Site and Services “as is” and disclaims warranties, including accuracy, uninterrupted availability, fitness for purpose, and AI-output reliability.

SPS’s total liability is capped at the amount paid for Services during the 12 months before the event giving rise to the claim. SPS excludes liability for indirect, incidental, and consequential damages. It also disclaims responsibility for unauthorized account use and certain third-party components.

Users must indemnify SPS and related parties for claims arising from their use, breach of the Terms, or submissions.

Disputes are governed by U.S. and Minnesota law and must be brought in Minneapolis, Minnesota, within one year after the claim arises. No arbitration provision appears in these Terms.

7. Changes to the Terms

Changes become effective when posted on the Site. Material changes may be communicated by email or other reasonable methods beforehand where feasible. Continued use after an update constitutes acceptance. Users should review the Terms periodically; continued use is not an effective option if they disagree with changes.