Data Processing Agreement
Last updated: 18 October 2026
Download this agreement as a PDF to keep or sign.
This agreement applies when the workbooks you upload to Spreadless AI, or the records you keep in your app, contain personal data about other people (for example customers, employees or suppliers). It forms part of our Terms of Service. You (the customer) are the controller of that data; we, the company named in the Terms of Service, are the processor. It is written to meet Article 28 of the EU and UK GDPR and the UAE Personal Data Protection Law, where they apply.
1. What we process
- Subject matter and purpose: storing your workbooks, designing an app for them, importing their rows and running the app for you.
- Data: whatever your workbooks and records contain, typically names, contact details, dates, amounts and notes.
- People concerned: the people your data is about.
- Duration: for as long as your account exists, until you ask us to delete the data.
2. Our commitments
- We process the data only to provide Spreadless AI as you use it, which is your instruction to us.
- Everyone at our company with access to it is bound to confidentiality.
- We keep it secure: encrypted connections, private file storage, and database rules that let each workspace read only its own data.
- We help you answer requests from the people concerned and meet your own obligations, as far as we can.
- We tell you without undue delay, and within 72 hours, after we become aware of a breach affecting your data.
- When you ask, we delete your data within 30 days, unless the law requires us to keep it.
- We give you the information you reasonably need to show that this agreement is kept; answers to written questions are the first step.
3. Subprocessors
You allow us to use these subprocessors:
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc. | Database, file storage and sign-in (accounts, sign-in emails, your workbooks and records) | Data stored in Frankfurt, Germany (AWS eu-central-1) |
| Vercel, Inc. | Hosting the website and app; server functions run in Frankfurt, Germany; page-view counts without cookies (Web Analytics) | Frankfurt, Germany; web pages served from its global network |
| Stripe, Inc. and its affiliates | Payments and invoices for paid plans: the billing name, email, address and tax ID of the paying company, and card details (we never see full card numbers) | United States and other Stripe locations |
| Resend, Inc. | Delivering the emails sent from apps and team invites: the recipient's address, the subject and the message, and the sender's address for replies | United States |
| Anthropic, PBC | The AI model (Claude) that designs your app and reads what you give it: a description of your workbook (sheet and column names, value types and counts, up to 20 sample rows per sheet) and your note; the text or image of the documents and photos you add; and your messages to the assistant | United States |
Each is bound by data protection terms at least as protective as this agreement. Before we add or replace one, we update this list and tell saved accounts by email at least 14 days in advance; you can object by writing to us, and if we can't resolve it you may end your use of Spreadless AI.
4. International transfers
Your data is stored in Frankfurt, Germany. To read and check your workbook, the contents of its sheets (up to the first 120 and the last 30 filled rows of each for the layout, the rows of its tables in parts for the checks), a description of it (sheet and column names, value types and a few sample rows), your note, the documents and photos you add (to read them) and your messages to the assistant go to Anthropic in the United States, outside the EU. These transfers are covered by the EU Standard Contractual Clauses (and the UK addendum) in our providers' terms. Anthropic does not use data sent through its API to train its models.
5. Your part
You confirm that you have a lawful basis to upload the data and to have us process it, and that you have told the people concerned as the law requires.
Webhooks, automations that call a URL or send an email, and API keys send personal data to receivers you choose. We send it on your instruction; those receivers are not our subprocessors, and you are responsible for them.
Contact
Data protection questions: hello@spreadless.ai.