Privacy Policy

1. Overview

SpreadPic ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under applicable data protection laws including the EU General Data Protection Regulation (GDPR).

Data Controller: SpreadPic, reachable at privacy@spreadpic.com

2. Data We Collect

Account Data (provided by you)

• Email address — required for account creation and login
• Password — stored as a one-way hash (bcrypt); we never see your plain-text password
• Subscription status and payment history — processed by Stripe

Automatic Collection (on registration and login)

• IP address — collected for security, fraud prevention, and abuse detection (legal basis: legitimate interest)
• Browser type and version — derived from your User-Agent string
• Operating system — derived from your User-Agent string
• Internet Service Provider (ISP) — derived from your IP address via ip-api.com
• Browser language preference — to improve your experience
• Device timezone — for service optimization
• Referrer / traffic source — to understand how users find us
• Login count and last login timestamp — account security monitoring

Usage Data

• Number of files processed (free tier quota tracking)
• Pages visited and timestamps

What We Do NOT Collect

• Your Excel files or extracted images — all file processing happens locally in your browser
• Your real name, physical address, or phone number
• Precise GPS location

3. Legal Basis for Processing (GDPR)

We rely on the following legal bases:

• Contractual necessity — email and password are required to provide your account
• Legitimate interest — IP address, browser/OS, and ISP are collected to protect our service against fraud, abuse, and unauthorized access
• Consent — where required by law (e.g., non-essential cookies)

4. How We Use Your Data

• Provide and maintain your account
• Process payments via Stripe
• Track free tier usage limits
• Send service-related emails (verification, password reset, billing)
• Detect, prevent, and investigate fraud or abuse
• Analyze usage patterns to improve our service

5. Data Sharing & Third Parties

We share data only with the following processors, and only as necessary:

• Stripe — payment processing. Privacy Policy
• Hostinger — hosting infrastructure (servers located in the EU/EEA).
• ip-api.com — ISP lookup from IP address (no account required, no data retained by them). Legal

We do NOT sell, rent, or trade your personal data to third parties.

6. Data Retention

Account data is retained while your account is active. Upon account deletion, all personal data is removed within 30 days. Usage records and IP logs may be retained in anonymized form for analytical purposes. Data required for legal obligations (e.g., payment records) is retained per applicable law.

7. Data Security

• All traffic encrypted via HTTPS/TLS
• Passwords hashed with bcrypt (12 rounds)
• Database access restricted to application-level authentication
• Regular security reviews

8. Your Rights (GDPR)

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest

To exercise any of these rights, email privacy@spreadpic.com. We will respond within 30 days.

9. Cookies

We use essential cookies for authentication (login session) and preference cookies for language selection. No third-party tracking or advertising cookies are used. You can disable cookies in your browser settings, but some features may not work.

10. International Transfers

Your data is hosted on servers provided by Hostinger, with data centers located in the European Union / European Economic Area. We do not transfer personal data outside the EU/EEA without appropriate safeguards.

11. Children's Privacy

Our service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or a notice on our website. Continued use after changes constitutes acceptance.

13. Contact

For privacy-related inquiries or to exercise your rights: privacy@spreadpic.com

You also have the right to lodge a complaint with your local data protection supervisory authority.