Privacy Policy

Who is responsible

The controller for the processing of personal data on www.spread.ai is SPREAD GmbH, Eiswerk, Köpenicker Str. 40c, 10179 Berlin, Germany ("SPREAD", "we"). You can reach us about data protection at info@spread.ai.

This policy explains what personal data this website processes, why, on which legal basis, who receives it and for how long it is kept. Legal bases refer to the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Visiting the website

Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that the server needs to deliver it: IP address, date and time, the page requested, referrer, browser and operating system. Vercel processes this data on our behalf to deliver the site and to keep it secure and stable (Art. 6(1)(f) GDPR; our legitimate interest is a secure, working website). Log data is kept only briefly and then deleted.

Vercel may process data in the USA. Vercel is certified under the EU-US Data Privacy Framework; in addition we have agreed the EU Standard Contractual Clauses with Vercel.

Fonts

Our fonts are served from our own server. Your browser does not connect to Google Fonts or any other font provider.

Cookies and your consent

When you first visit, a banner asks which optional services you allow. Nothing optional runs before you decide, and rejecting is as easy as accepting. You can change or withdraw your choice at any time under "Cookie settings" at the bottom of every page; withdrawal applies from then on.

Necessary. The cookie spread_consent stores your choice for 12 months so the banner does not ask on every page. It is required to respect your decision (§ 25(2) TDDDG; Art. 6(1)(c) and (f) GDPR).
Analytics (only with your consent): Google Analytics 4 and Microsoft Clarity, see below.
External media (only with your consent): embedded videos from Vimeo and YouTube, see below.

The legal basis for the optional services is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Google Analytics 4

With your consent we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to understand how the website is used: which pages are visited, how visitors arrive (for example from a search engine or a link), how long they stay and which device and browser they use. We use the results to improve our content and the website.

Google Analytics only loads after you allow "Analytics" in the banner. Until then, and if you decline, no Google Analytics code runs and no request goes to Google.
With your consent Google sets the cookies _ga and _ga_<ID>, which hold a random identifier and expire after 2 years. Withdrawing consent deletes them.
Google Analytics 4 does not log or store IP addresses. We have switched off Google Signals and ads personalisation; the data is not used for advertising.
Analytics data is kept for 14 months and then deleted automatically.
Google acts as our processor under a data processing agreement. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

More information: Google Privacy Policy and how Google Analytics safeguards data.

Microsoft Clarity

With your consent we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). Clarity helps us understand how people use the website through aggregated behavioral metrics, heatmaps and visual reconstructions of sessions. It records interactions such as clicks, scrolling, page navigation and technical browser information. We use these insights to find usability problems and improve the website.

Clarity only loads after you allow "Analytics" in the banner. Until then, and if you decline, no Clarity code runs and no request goes to Microsoft.
With your consent Clarity may set the cookies _clck and _clsk to connect page views and sessions. Withdrawing consent clears Clarity cookies and ends tracking.
Sensitive page content is masked. Clarity recordings are visual reconstructions of page interactions, not video captured from your screen or camera.
Playback data is normally kept for 30 days. Aggregated click and heatmap data, favorited sessions and a limited sample of sessions may be kept for up to 9 months.
Microsoft processes the data as an independent controller. Data is stored in Microsoft Azure and may be transferred within the Microsoft group, including to the USA, using the EU Standard Contractual Clauses.

More information: Microsoft Privacy Statement and Microsoft Clarity privacy FAQ.

Embedded videos (Vimeo and YouTube)

Some articles contain videos hosted by Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA, or YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Until you allow "External media" in the banner, or click "Load video" on a single video, we show a placeholder and no connection to Vimeo or YouTube is made.

Once a video loads, your browser connects to the provider. The provider receives your IP address, the page you are on and technical browser data, and may set cookies or similar identifiers and link the visit to an account you are logged in to. The providers process this data under their own responsibility: Vimeo Privacy Policy, Google Privacy Policy. Both may transfer data to the USA; Vimeo.com, Inc. and Google LLC are certified under the EU-US Data Privacy Framework.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Contact, demo and paper forms

When you send us a form (contact, getting started, or a paper download), we process the data you enter: name, business email, company, phone number if given, your message, and for papers which paper you requested. We also store the time of your request, the page and, if present, the campaign parameters in the link that brought you here (for example utm_source), so we know where requests come from. To keep the forms free of spam we use an invisible check field and limit how often a form can be sent from one connection.

Purpose and legal basis. To answer your request and, where it concerns our products, to prepare a possible contract (Art. 6(1)(b) GDPR), and our legitimate interest in following up on business enquiries (Art. 6(1)(f) GDPR).
Where it is stored. Form data goes straight into our customer relationship management system Salesforce, provided by Salesforce, Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA. An automation on Zapier (Zapier, Inc., USA) reads each new request in Salesforce to route it to the right team, and the team is notified internally through Slack (Slack Technologies, LLC, USA). All three act as our processors; Salesforce, Inc., Zapier, Inc. and Slack Technologies, LLC are certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses apply in addition.
Paper downloads. Once you send the form, the paper unlocks on the page and you download it there. We do not send you an email for it.
Marketing emails. If you tick the box to receive information and invitations from us, we store that consent, the wording you agreed to and the time (Art. 6(1)(a) GDPR). You can withdraw it at any time, for example through the unsubscribe link in every email or by writing to info@spread.ai.
Retention. We keep enquiry data as long as needed to handle it and for an ongoing business relationship, and delete it when it is no longer needed, unless statutory retention periods (for example under commercial or tax law) require us to keep it longer.

If you subscribe to our newsletter, we store your email address, your consent and the time you gave it in Salesforce and use it only to send you the newsletter (Art. 6(1)(a) GDPR). Every newsletter contains an unsubscribe link; after you unsubscribe we keep only what we need to make sure we do not email you again.

We currently send our newsletter and event invitations with HubSpot, provided by HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, as our processor. Your email address, name, company and consent are synchronised from Salesforce to HubSpot for this. HubSpot records whether an email was opened and which links were clicked, so we can see which topics interest our readers. HubSpot's parent company HubSpot, Inc. (USA) is certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses apply in addition. Some campaign pages on start.spread.ai are also still hosted by HubSpot; what you enter in a form there is stored in HubSpot and Salesforce for the purposes described in this policy.

Events, careers and other services

Event registration. Registration for our events runs on Luma (Luma AI, Inc., USA). Luma passes your registration (name, email and the answers you give) to us; we store it in Salesforce to organise the event and follow up with attendees (Art. 6(1)(b) and (f) GDPR). Luma's own privacy policy applies on its pages.
Job applications. Our careers page lists open positions from Personio. When you apply, you do so on Personio's pages (Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany), where their privacy information for applicants applies.
Blog images. Images in our blog may be delivered from the content delivery network of our content management system Sanity (Sanity AS, Oslo, Norway). Your browser then connects to Sanity's servers, which receive your IP address to deliver the image (Art. 6(1)(f) GDPR).
Links to other websites. Our pages link to other websites, for example LinkedIn or press articles. We are not responsible for their content or privacy practices; their own policies apply once you follow a link.

Recipients and transfers outside the EU

We share personal data only with the service providers named above, which process it on our behalf and under our instructions, or where we are legally required to. We do not sell personal data. Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework, or on the EU Standard Contractual Clauses.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15)
have inaccurate data corrected (Art. 16)
have your data deleted (Art. 17) or its processing restricted (Art. 18)
receive your data in a portable format (Art. 20)
object at any time to processing based on our legitimate interests (Art. 21), and to direct marketing without giving reasons
withdraw a consent at any time, with effect for the future (Art. 7(3))

To exercise them, write to info@spread.ai. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), which is responsible for us.

Security

The website is served over an encrypted connection (HTTPS). We protect the data we hold with technical and organisational measures appropriate to the risk and review them regularly.

Children

Our website is aimed at businesses. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

We update this policy when our website or the services we use change. The current version is always available on this page; the effective date at the top shows when it was last changed.