Your photos, your data, your rules.

Spreadu is operated by Visual Playground SL ("we", "us", "our"), a company registered in the European Union. We are the data controller for your personal data processed through the Service.

You can reach us at [email protected].

Account information

Your name, email address, and password hash when you register. If you sign in with a social provider (Google, etc.), we receive your name, email, and profile picture from that provider.

Photos and album designs

The photos you upload and the album layouts you create. We process these solely to provide the Service. We do not use your photos for AI training, advertising, or any purpose beyond delivering the features you use.

Service diagnostics

We process error reports and limited performance diagnostics to keep the Service reliable. We do not send your photos or album designs with these reports.

Product analytics

Our self-hosted OpenPanel instance measures page visits, product actions, purchases and export progress to help us improve Spreadu. It is enabled by default and can be turned off in account privacy settings; we also respect existing explicit denials and browser Do Not Track or Global Privacy Control signals.

These events include workflow states recorded by our servers, linked to your stable account ID. When you are signed in, we also send your account email in a separate profile identification request linked to that same ID. Ordinary browser and server events do not include your email.

We do not send photos, album contents, names, profile pictures or private URLs. OpenPanel session replay is off.

Advertising measurement data

If you allow advertising cookies, we may process ad click identifiers, page views, registrations, checkout starts, purchase amount, currency, and hashed account email for conversion measurement. We do not send your photos, album designs, or private content to advertising platforms.

Payment information

Payment details are handled entirely by our payment processor. We store only a transaction reference and your subscription status. We never see or store your full card number.

Support conversations

When you contact us, we keep the conversation so we can provide better support and improve the Service.

We process your data under the following legal bases:

• Contract performance: Processing your photos and account data to deliver the Service you signed up for, including account verification, onboarding, Free Plan access, and subscription-related service emails
• Legitimate interest: Fraud prevention and service improvement, including limited product usage statistics in our self-hosted OpenPanel instance. You can object to this product analytics processing using its separate account privacy setting
• Consent: Newsletters, promotional campaigns, public-page cookie analytics, and optional advertising measurement. You can withdraw consent at any time
• Legal obligation: Tax records and legal compliance

We use your personal data to:

• Provide, maintain, and improve the Service
• Process your photos and generate album layouts
• Send service lifecycle emails (account verification, password resets, onboarding help, Free Plan guidance, and subscription updates)
• Send newsletters, promotional updates, and optional growth campaigns (only if you opt in. You can unsubscribe anytime)
• Respond to support requests
• Understand product use, purchases and export progress while respecting your product analytics opt-out
• Measure our own advertising campaigns when you allow advertising cookies
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not sell your data. Full stop. We share data only with:

• Infrastructure providers: Cloud hosting (Hetzner, EU-based), storage, and CDN services necessary to run the platform
• Payment processor: To handle subscriptions and billing
• Error tracking: Our self-hosted Bugsink instance, on our own servers in the EU, receives error reports so we can fix bugs. No third party receives them.
• Product analytics: Our self-hosted OpenPanel instance receives limited product events linked to your account ID unless you opt out. For signed-in users, a separate profile identification request adds the account email to that same profile; ordinary events remain email-free. We send no photos, album contents, names, profile pictures or private URLs, and OpenPanel session replay is off.
• Public page analytics: Microsoft Clarity, for heatmaps and session replay on our public pages and signup flow, when you allow analytics cookies. It receives page interactions, not your photos or album content, and never runs inside the editor, dashboard, lab portal, or proofing. Read the Microsoft Privacy Statement for how Microsoft handles it.
• Advertising measurement: Meta, Google Ads, Microsoft Ads, and X Ads when you allow advertising cookies
• AI features: OpenAI runs Henry, our AI assistant, AI photo analysis, and the album builder when you use them. Google Gemini helps us draft help content from questions asked in Henry. TypeSafe AI helps sort photos into scenes, using text descriptions only. Our Subprocessors page lists what each one receives.
• People grouping: Amazon Web Services (Rekognition) detects faces in album photos so we can group them by person, in albums where people grouping runs
• Email delivery: Resend, for transactional and product-critical emails; MailerLite, for onboarding, Free Plan lifecycle, customer lifecycle, and consent-based newsletter delivery

All processors are bound by data processing agreements and GDPR-compliant terms. We only share what is strictly necessary for each service to function.

Your data is stored on servers located in the European Union. We protect it with:

• Encryption in transit (TLS/HTTPS) and at rest
• Regular security updates and monitoring
• Access controls and authentication for all internal systems
• Regular backups with point-in-time recovery

No system is 100% secure, but we take every reasonable step to protect your data. If a breach occurs that affects your personal data, we will notify you and the relevant authorities within 72 hours as required by GDPR.

Under GDPR and applicable privacy laws, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interest
• Withdraw consent: For any processing based on consent, at any time

You can exercise most of these directly from your account settings. We also provide a GDPR export tool that packages all your data for download.

Turning OpenPanel off stops future product analytics delivery. It does not delete events already received. A request to erase those events is separate from opting out.

For any request, email [email protected]. We'll respond within 30 days.

We keep cookies minimal:

• Essential cookies: Session authentication and security. Required for the Service to function. Can't be disabled.
• Product analytics preference: The sp_analytics_consent_v1 cookie carries an explicit OpenPanel choice or browser privacy signal to our signup server, without a user identifier. It expires 180 days after synchronization. No choice creates no permission cookie, and the cookie does not change an existing account preference at login.
• Analytics cookies: Consent-aware storage for configured tags, and Microsoft Clarity heatmaps and session replay on public pages (_clck, _clsk). These device-local cookie settings are separate from your account's OpenPanel product analytics setting.
• Advertising cookies: Campaign measurement pixels and click identifiers. They only run when you allow advertising cookies.

For full details, see our Cookie Policy.

We keep your data only as long as necessary:

• Account data: While your account is active. When you delete your account, we close it 24 hours later unless you cancel before then, and erase it shortly after. Copies in our backups are removed as those backups expire.
• Photos and designs: Until you delete them or close your account
• Service diagnostics: Retained according to the retention periods configured in our self-hosted monitoring tools
• Payment records: As required by tax law (typically 7 years)
• Support conversations: 2 years after last contact

Spreadu is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Your data is primarily stored and processed within the European Union. If any data needs to be transferred outside the EU (for example, to service providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Some of our service providers process data in the United States: Stripe (payments), Resend (transactional email), MailerLite (lifecycle and newsletter email, on EU and US infrastructure), OpenAI (Henry, AI photo analysis, and the album builder), Google (Gemini, for drafting help content), TypeSafe AI (sorting photos into scenes), Slack (internal team notifications), and Microsoft Clarity (public page interactions, only when you allow analytics cookies). Amazon Web Services processes photos for people grouping in its Frankfurt region. Cloudflare serves our site through its global network and stores files in R2 with EU data residency. Our Subprocessors page lists what each one receives.

Each of these providers is bound by a data processing agreement. Transfers to the United States rely on Standard Contractual Clauses or, where the provider is certified under it, the EU-US Data Privacy Framework.

When you allow advertising cookies, Meta, Google Ads, Microsoft Ads, and X Ads receive the advertising measurement data described above and may process it in the United States.

We may update this policy from time to time. For significant changes, we'll notify you via email or an in-app notice at least 30 days before they take effect. Minor clarifications may happen without notice.

Something about your privacy you'd like to know? We're here.

• Email: [email protected]
• Entity: Visual Playground SL
• Region: European Union

You also have the right to lodge a complaint with your local data protection authority.