Trust, privacy, and terms

Account and workspace access

SpreadWork supports password authentication and sign-in through Google or Microsoft. Project membership controls access to a workspace. Passwords are stored as hashes, and AI provider keys are encrypted when saved.

Hosting and data location

The application and managed PostgreSQL database are hosted on DigitalOcean in Frankfurt, Germany. Production traffic uses HTTPS and passes through Cloudflare, which provides traffic delivery for DigitalOcean App Platform. Uploaded files are stored in Amazon S3 in Frankfurt, Germany. These regions do not describe the processing locations of all connected providers.

Services that handle data

• DigitalOcean: application hosting and managed PostgreSQL in Frankfurt, Germany.
• Cloudflare: global web traffic delivery through DigitalOcean App Platform.
• Amazon Web Services: uploaded file storage through Amazon S3 in Frankfurt, Germany.
• Postmark: service email delivery and incoming email when you use email ingestion.
• Google or Microsoft: authentication when you choose their sign-in option.
• Your selected AI provider: OpenAI, Anthropic, or Berget.ai processes the instructions and context sent to an AI step. Berget describes its infrastructure as based in Sweden and Europe. Berget’s privacy and infrastructure details.
• Other services you connect: services such as Gmail, Browserbase, or a custom integration receive the requests and data needed for the actions you configure.

This overview describes core hosting and product services. A complete audited provider register, including processing locations and transfer arrangements, is not yet available.

What AI receives and retains

You can run workflows with people only. When you enable AI steps, requests use your connected provider account and can include step instructions, row values, related context, selected attachments, and results from connected tools. AI run records are also kept in SpreadWork to help you review what happened.

Your provider’s terms and account settings govern its use of data for model training and how long it retains requests. Using your own provider account does not by itself guarantee zero retention. Review OpenAI’s data controls, Anthropic’s retention policy, or Berget’s privacy commitments, together with the terms of any other service you connect. Berget states that it does not retain prompts or generated responses; that statement applies only when a workflow request is sent to Berget.

Exporting your work

You can export a spreadsheet’s column headings and cell values as an Excel-compatible file. That export does not include attached files, notes, workflow definitions, or the full activity history.

If your team needs those records too, contact the founder about your export requirements before starting a pilot. For account closure or deletion requests, email [email protected].

Review your requirements with the founder

Have a security questionnaire, a DPA requirement, or rules about where your data can be stored? Talk directly with the founder before importing that data. We can discuss your intended process, the current setup, and which requirements still need to be met.

Report a concern

If you believe you have found a vulnerability or security issue, email [email protected]. Describe the issue without including passwords, API keys, personal data, or other secrets.

1. Who this policy covers

This policy explains how SpreadWork (“we”, “us”, or “our”) processes personal data when you visit our website, create an account, use the service, contact us, or are included in content submitted to a workspace.

2. Data we process

Depending on how you use SpreadWork, we may process:

• Account information, such as name, email address, authentication method, and profile image.
• Workspace content, such as rows, field values, notes, files, assignments, workflow history, and instructions.
• Technical and usage information needed to operate, secure, troubleshoot, and improve the service.
• Messages and other information you provide when contacting us.

3. Why we process data

We process personal data to provide and secure accounts, run workflows, deliver requested integrations and AI actions, communicate with users, support customers, improve reliability, prevent misuse, and meet legal obligations.

Our legal basis depends on the context and may include performing a contract, legitimate interests in operating and protecting the service, compliance with legal obligations, or consent where required.

4. Service providers and integrations

We use service providers for hosting, email delivery, authentication, storage, and technical operations. See services that handle data for the product’s providers and what they receive. If a workspace connects an AI provider or another service, relevant data may be sent to that provider to carry out the requested action. Those providers process data under their own terms and privacy commitments where they act independently.

5. International transfers

The application database and Amazon S3 file storage are in Frankfurt, Germany. Connected AI providers and other services may process data outside the European Economic Area; our core hosting location does not determine where those services process data. If your organisation requires a particular data location or transfer arrangement, contact us to review it before submitting personal data.

6. Retention

We keep personal data for as long as needed to provide the service, meet legal and security requirements, resolve disputes, and maintain appropriate business records. Retention depends on the type of data and why it is processed.

For an export or deletion request, email [email protected]. See what the spreadsheet export includes.

7. Cookies

SpreadWork uses cookies and similar storage that are necessary for sign-in, security, and requested application functions. If we introduce non-essential analytics or advertising cookies, we will request consent where required.

8. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or export personal data, and to withdraw consent where processing relies on consent. You may also complain to your local data-protection authority.

9. Contact

For privacy questions or requests, email [email protected]. We may need to verify your identity before acting on a request.

10. Changes

We may update this policy as SpreadWork, our providers, or legal requirements change. We will update the date above and provide additional notice when appropriate.

1. Agreement

These Terms govern your access to and use of SpreadWork, including its websites, applications, and related services. By creating an account or using the service, you agree to these Terms. If you use SpreadWork for an organisation, you confirm that you are authorised to accept these Terms for it.

2. Accounts

You must provide accurate account information, protect your credentials, and promptly tell us about suspected unauthorised access. You are responsible for activity performed through your account and for managing access to your workspace.

3. Using the service

You may use SpreadWork for lawful business purposes. You may not misuse the service, interfere with its operation, attempt unauthorised access, introduce malicious code, infringe the rights of others, or use the service to create or distribute unlawful or harmful material.

4. Your content

You retain your rights in content you submit to SpreadWork. You give us permission to host, process, transmit, and display that content only as needed to provide, secure, maintain, and support the service. You are responsible for having the rights and lawful basis needed to submit and process that content.

5. AI and integrations

AI-generated output can be incomplete or incorrect and should be reviewed before it is relied on. You are responsible for configuring AI actions, integrations, and automation appropriately for your use case. Third-party services are governed by their own terms, availability, and data practices.

6. Plans and payment

Paid features, prices, billing periods, and included usage are described when you select a plan or in an order agreed with us. Unless otherwise stated, fees are exclusive of applicable taxes. You remain responsible for charges from third-party providers you connect, including AI providers.

Free includes one user, unlimited workflows, 1,000 work items per month, and a one-time grant of 5,000 AI usage units. After that grant is used, AI usage can be purchased separately; people can continue completing To Do work manually without AI. Team is $49 USD per month for up to five users and 10,000 work items; Business is $149 USD per month for up to 20 users and 100,000 work items; Enterprise has custom pricing and allowances. Paid plans include monthly AI usage, and additional AI usage can be purchased separately. See subscription plans for current plan details.

7. Service changes and availability

We may improve, change, or discontinue features. We aim to operate SpreadWork reliably, but do not promise uninterrupted or error-free availability. We may suspend access when reasonably necessary for security, legal compliance, non-payment, or material misuse.

8. Intellectual property

SpreadWork and its software, design, branding, and documentation are owned by us or our licensors. Except for the limited right to use the service under these Terms, no rights are transferred to you.

9. Disclaimers and responsibility

To the extent permitted by applicable law, the service is provided without warranties not expressly stated in these Terms or an applicable order. Neither party is responsible for indirect or consequential loss that was not reasonably foreseeable. Nothing in these Terms limits responsibility where it cannot legally be limited.

10. Ending use

You may stop using SpreadWork at any time and export spreadsheet headings and cell values as described in exporting your work. Contact us to discuss any additional export requirements or to request account closure and deletion. Retention and deletion are subject to legal requirements and any applicable order. We may terminate access for a material breach if it is not remedied within a reasonable period, unless immediate action is required.

11. Changes to these Terms

We may update these Terms as the service or applicable requirements change. We will update the date above and provide additional notice when a change materially affects existing customers.

12. Contact

Questions about these Terms can be sent to [email protected].