Privacy Policy
We collect what we need to run your services and bill for them, and nothing to advertise to you. We do not sell your data, and there are no ad or analytics trackers in Spredr.
1. Who we are
2. Controller and processor
- Your account data (who you are, how you sign in, what you pay): we decide how it is used, so we are its controller.
- Data inside what you run (your services' databases, requests, logs, your agents' memory and conversations, including data about your own users): you decide, so you are its controller and we are your processor. We handle it only to run the Service for you, as the Terms describe.
3. What we collect
From you and your sign-in provider
Your name, email address, profile picture and account ID at GitHub, GitLab or Google, when you sign in with them.
Access to the repositories you connect, through the GitHub App or GitLab authorization you grant, limited to what you choose.
What you write to us at hey@spredr.cloud, and your settings, such as language.
When you use Spredr
- Sign-in and security: your sessions, the country your connection comes from (as reported by Cloudflare), and the browser and system you sign in from, so we can tell you when a new device signs in. We keep a record of security-relevant actions in your account, such as tokens created and providers linked.
- Usage: memory, CPU, traffic and build minutes of each service and agent, used to run and bill the Service.
- Your Content: your code and the images built from it, environment variables (encrypted at rest), the logs your services print, and your agents' memory and files.
For billing
Stripe collects and keeps your card, billing name and address and tax ID. We do not store card numbers. We keep your Stripe customer ID, your plan and your invoices' references and amounts.
4. Why we use it
We do not send marketing emails without your consent, and we do not use your data or Your Content to train AI models.
5. Who we share it with
We share data only with the providers that help us run Spredr, under contracts that limit them to that work:
We may also disclose data when the law requires it, to protect people or the Service from harm, or to a buyer if Spredr is sold or merged, who would remain bound by this policy. We do not sell or rent personal data, and we do not share it for advertising.
6. Where it lives and international transfers
Our main systems are in the United States. If you are outside it, your data is transferred there. Where the law requires it, such transfers rely on the European Commission's Standard Contractual Clauses or another valid mechanism.
7. How long we keep it
- Account data: while your account exists.
- Your Content after a plan ends: 30 days, then deleted, as the Terms describe. We email you before.
- Logs: for the window your plan includes, then deleted.
- Security records: up to 12 months.
- Billing records: as long as tax and accounting law requires, usually up to 7 years. Stripe keeps its own records under its policy.
When you delete your account we delete or anonymize your data within 30 days, except what we must keep by law. Copies in backups are overwritten in the normal backup cycle.
8. Cookies
Spredr uses one cookie that keeps you signed in, and your browser remembers your language. Both are needed for the Service to work, so they do not need consent. There are no advertising, tracking or third-party analytics cookies.
9. Your rights
Depending on where you live, including in the EU and UK (GDPR), California (CCPA), Brazil (LGPD) and Colombia (Law 1581 of 2012), you may have the right to:
know what data we hold about you and get a copy of it;
correct it, or have it deleted;
take it with you in a usable format;
object to or restrict how we use it, and withdraw consent you gave;
complain to your data protection authority.
Write to hey@spredr.cloud from your account's email. We answer within 30 days and may need to confirm it is you. We do not treat you differently for using these rights. For data inside a customer's service, write to that customer; we will help them answer.
10. Security
Traffic is encrypted in transit. Secrets such as environment variables and tokens are encrypted at rest. Every service runs isolated in its own container sandbox, images we build are signed, and access to production is limited to the people who run it. No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay, as the law requires.
11. Children
Spredr is not meant for anyone under 18, and we do not knowingly collect their data. If you believe a child gave us personal data, write to us and we will delete it.
12. Changes
If we change this policy in a material way, we will email you before the change takes effect. The date at the top says when it last changed.
13. Contact
Questions or requests about your data go to hey@spredr.cloud.
Candhrly, LLC · 131 Continental Dr, Suite 305, Newark, DE 19713, United States · hey@spredr.cloud