GDPR and data protection

A summary of how Spreo handles personal data under the EU GDPR and the UK GDPR. The full terms are in our Privacy Policy, Data Processing Agreement and Sub-processors list. If anything here differs from those documents, the documents apply.

Is Spreo GDPR compliant?

Yes. Spreo is run by Deqo Software Ltd, a company registered in England and Wales (11594409), and we process personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

There is no official GDPR certificate, so this page sets out what we do, with links to the documents behind it, so you can check for yourself.

Where is my data stored?

On our hosted service, your account details and board content are stored in the EU, on DigitalOcean servers in Amsterdam, the Netherlands. If we ever have to fail over, it is to Amazon Web Services, also in the EU. Backups are encrypted and kept for 7 days.

Some of the companies we use for in-app support, billing, website analytics, DNS and optional AI features host data in the USA. You can limit most of this. AI features are off unless your workspace switches them on, website analytics runs only if you accept cookies, and we can turn off in-app support (Intercom) for your whole organisation on request.

Our Sub-processors page lists every company that processes personal data for us, what data each one receives and where it hosts that data.

Can we self-host Spreo?

Yes. On the Enterprise plan, Spreo can be self-hosted as a private cloud deployment in your own environment, on your own infrastructure, wherever you choose to put it. Your organisation then decides where its data is stored. Spreo is not open source: a self-hosted deployment is the same Spreo, deployed into your environment. To talk through your requirements, email sales@spreo.io.

Is Spreo a controller or a processor?

Both, for different data.

When an organisation uses Spreo, we process the content its people put on boards on that organisation's behalf. For that content the organisation is the controller and we are its processor, under our Data Processing Agreement.

We are the controller for account details, billing, support conversations, marketing emails and our website. Our Privacy Policy covers that data.

Do you have a Data Processing Agreement?

Yes. Our Data Processing Agreement is published and forms part of our Terms, so there is nothing to sign. It covers the EU GDPR and the UK GDPR. If your organisation has signed its own data processing agreement with us, that agreement applies instead.

Who are your sub-processors?

They are listed on our Sub-processors page, which forms part of the Data Processing Agreement. We update the list before a new sub-processor starts processing personal data, and each one is bound by a written contract that protects personal data at least as well as our agreement does.

How do you handle transfers outside the UK and the EU?

We are based in the UK, and the European Commission has decided that the UK provides an adequate level of protection for personal data.

Where one of our sub-processors handles personal data outside the UK and the European Economic Area, the transfer is covered by an adequacy decision (for example the EU–US Data Privacy Framework, where the company is certified under it) or by the European Commission's standard contractual clauses, with the UK International Data Transfer Addendum where the UK GDPR applies.

How do you protect personal data?

Connections to Spreo use TLS. Databases and backups are encrypted at rest with AES-256. Access to our infrastructure needs an authenticated VPN and multi-factor authentication, and our staff look at customer data only to give support or keep the service running. Paid plans can use SAML single sign-on and restrict access to their own email domain.

Our Security page has the detail.

How long do you keep personal data?

Your data stays until it is deleted:

• You can delete your account from your account page, and board owners can delete their boards at any time.
• If a trial ends without a subscription, the account and its boards stay until deleted by the Account Owner.
• If a paid subscription is cancelled, its data stays unless the customer asks us to delete it. If they do, we delete it no later than 30 days after the cancellation, or within 30 days of the request if they ask later.

Deleted data is overwritten in our backups within 7 days. We keep your marketing preferences until you unsubscribe or delete your user profile.

Do you use my data to train AI?

No, your data is not used to train any AI models. AI features are off unless your workspace switches them on. When they are on, only the board content sent to an AI feature, such as the notes being grouped, goes to the AI provider, and it is set up so that content is not used for training. The providers are listed on our Sub-processors page, and our AI Features Addendum has the terms.

What cookies do you use?

Spreo itself uses only a strictly necessary cookie to keep you logged in. Analytics tools and our in-app support and messaging (Intercom) load only after you accept them in our cookie banner.

How do I access, export or delete my data?

You can change or delete your account details from your account page, and export board content using the export features in Spreo.

For anything else, email contact@spreo.io, ideally from the email address on your Spreo account. We reply within one month. If your request is about content in an organisation's boards, we pass it on to that organisation, because it is the controller of that content.

In the EU you can also contact us through our representative, Prighter.

What happens if there is a data breach?

We have a documented incident response plan. If a breach affects personal data we process for a customer, we tell that customer without undue delay and give them what they need to meet their own obligations. Where the law requires it, we also notify the regulator and the people affected.

Who can I contact about data protection?

Email contact@spreo.io. Our representative in the EU is Prighter.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk/concerns, or to the data protection authority in the EU country where you live or work.