Spredo Privacy Policy

Last updated: 8 October 2026

This Privacy Policy explains how Spredo Ltd. (“Spredo”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal data when people visit https://www.spredo.io, use our business contact database, Telegram outreach and CRM software, connect AI assistants through the Model Context Protocol (“MCP”) or other integrations, or otherwise engage with us. It also applies to professionals whose business contact information is included in the Spredo databases even if they do not have a Spredo account.

The responsible entity is Spredo Ltd., incorporated in England and Wales under company number 15706388, registered office 128 City Road, London, EC1V 2NX, United Kingdom. To contact us about personal data or exercise a right, email support@spredo.io or use https://www.spredo.io/claim-profile where available.

1. Scope and Our Roles

For the proprietary Spredo contact database, account administration, website operations and our own business activities, Spredo generally acts as a controller and determines purposes and means of processing. For a customer’s imported contacts, private communications, CRM notes and other Workspace data, our role may be that of processor acting under the customer’s documented instructions or a separate controller for limited operational purposes, depending on the processing activity and applicable agreement. Applicable signed Data Processing Addenda and other arrangements determine specific roles where required. Customers are responsible for their own lawful collection and use of records they upload and for the marketing communications they direct through the Services.

2. Categories of Personal Data

Account and billing details: Names, employer or organisation, business email, login identifiers, contact details, subscription records, billing information, payment confirmation and communications with support. Payment-card details may be processed by payment providers; we do not intend to store full payment-card numbers in our application.

Business Contact Data: Professional names, positions, companies, sectors, professional social and Telegram identifiers, public contact details where available, professional affiliations and participation in business events, relevant classifications, and contextual business information. Records may include inferred business attributes and links to sources. The inclusion of a record does not indicate consent to receive marketing messages.

Customer Workspace data: Customer-uploaded contact lists, campaign audiences, text templates, outreach messages, Telegram dialogue history, CRM records and notes, tags, task and pipeline data, account configuration, outreach performance, and information generated when the customer operates the Services. Such information may contain personal data about prospects or employees.

Technical, security and usage information: Device and browser information, IP address, event timestamps, access and authentication records, interaction logs, security alerts, system performance information, and cookie or analytics identifiers where used.

Integration information: Identities of connected applications, account or workspace identifiers, the permissions authorised, connection status, tool names, requests and responses to the extent logged, approval metadata where available, and security or diagnostic information.

Support and other communications: Messages or information voluntarily submitted through forms, calls, demonstrations, sales inquiries and technical support. We ask customers not to submit special-category information, highly sensitive credentials, payment-card data or government identification to our general-purpose outreach and MCP tools.

3. Sources of Information

We obtain information:

(a) Directly from account holders, prospects, website visitors and support correspondents;
(b) From customers who upload or import records and connect messaging accounts;
(c) From professional websites, company sites, directories, professional social profiles, event or conference materials and other lawfully accessible public sources;
(d) Where appropriate, from third-party business information providers; and
(e) From service operations and authenticated Connected Services.

Some professional attributes may be inferred from available information. We do not treat customers’ private uploaded lists and chats as sources for expanding our proprietary database.

4. Purposes and UK/EEA Legal Bases

We process account and subscription data to provide the requested Services and perform contracts; manage support, billing and service relationships; and comply with applicable tax and accounting rules.

We process limited security and usage data for legitimate interests in keeping the Services secure, preventing misuse, investigating incidents, improving reliability and maintaining business records. Where cookies or electronic communications require consent, we seek it and provide available withdrawal choices.

We process professional Business Contact Data to maintain and provide a searchable B2B information service, enable professionally relevant research, support permissible outreach and respond to accuracy, objection and removal requests.

For relevant UK/EEA processing, we generally assess legitimate interests under applicable data protection law, balancing the commercial utility of professional contact information against individuals’ reasonable expectations, privacy and rights.

This legal basis is not a blanket authorisation for customers to send unsolicited marketing: each customer must independently determine the lawful basis and communications-law permissions for its outreach.

For the purpose of delivering requested integrations and AI-connected workflows, we authenticate connections, retrieve requested data, execute permitted operations and maintain security or audit records as reasonably necessary.

The applicable basis may be contract performance, legitimate interests in secure service delivery, the customer’s lawful instructions under a DPA, or another legal basis depending on whose information is processed and why.

We do not use customers’ private uploaded contacts or conversations for independent marketing, sale or enrichment of the Spredo Business Contact Data database.

5. How Business Contact Data Is Used and Disclosed

Customers with authorised access may search or receive relevant professional records, including via the website, exports, APIs and authorised AI/MCP integrations, for business research and legally permitted B2B activities.

Categories of data disclosed depend on the service, requested fields, user permissions and applicable plan. We seek to limit disclosures to information relevant to a professional context.

A professional may request access, correction, objection or exclusion from our databases using the contact methods below.

We may use appropriate measures to prevent excessive harvesting, enforce subscription quotas, maintain suppression lists and investigate misuse.

A suppression record may be retained after an objection so we do not inadvertently reintroduce a record to the database.

We do not guarantee that a correction or removal within Spredo will affect a customer’s independent records or external platforms that already received the information.

6. Customer Workspace Confidentiality and Use Restrictions

Customer-uploaded contacts, private chats, leads, campaign content and CRM history are maintained for the Customer’s Workspace and are not made available to other customers or used to expand the Spredo database.

Spredo personnel do not use such content for their own sales or marketing purposes.

Access may occur where technically required for service delivery, to carry out support requested by the Customer, to investigate or prevent abuse or security incidents, or to satisfy legal obligations, in each case subject to appropriate access restrictions.

Routine automated processing required to operate the service does not constitute independent use of Customer Content.

7. AI Assistants and MCP Integrations

Spredo supports integrations with third-party AI assistants and compatible applications, including through MCP.

Once an authorised user links an AI provider to the user’s Spredo Workspace, that provider may request information and operate functions that the user is permitted to access.

Depending on the specific request, responses may include professional contact records, campaign details, message drafts and histories, CRM information, workspace metadata, tool status and related results.

We endeavour to return only the data necessary to fulfil the requested operation and not authentication secrets or irrelevant internal identifiers.

By default, the integration requires user approval for tool calls and actions. Critical operations are designed to require the user’s consent.

Authorisation and approval controls may be presented by the connected AI provider and are subject to its implementation and the permissions configured in Spredo.

When a tool call is approved, requested data may be transmitted to the external AI platform and processed according to its own published notices, terms, security controls and account settings.

Providers may include Anthropic, OpenAI or other AI services expressly connected by a Customer.

Spredo does not determine an independent provider’s model training, retention or account policies and does not represent that third-party processing is zero-retention or training-free.

We process connection identifiers, permissions, relevant operational events and other necessary technical records to authorise access, respond to requests, protect the integration and troubleshoot errors.

Customers can disconnect supported integrations through the available controls or ask support for assistance.

Revocation stops future authorised use through that connection once effective; it does not erase outputs, chat histories or records already disclosed to a provider.

Users should consult the relevant external provider’s privacy policy and settings for its retention and deletion choices.

8. Service Providers and Other Recipients

We share data with service providers when needed to provide and protect the Services, including infrastructure and cloud hosting providers, payment processors, support and communication vendors, security and operational tooling, and professional advisers subject to appropriate contractual or professional obligations.

We may disclose information to a Connected Service specifically requested or authorised by the Customer, including Telegram and third-party AI providers.

Business Contact Data may be supplied to customers and their authorised integrations as part of the contracted service.

We may also disclose information where necessary to comply with law, respond to valid legal process, protect rights and safety, enforce agreements, or in connection with a legitimate corporate transaction subject to applicable safeguards.

We do not make private Customer Workspace data available to unrelated customers.

Whether any disclosure of Business Contact Data constitutes “sale” or “sharing” under a jurisdiction’s privacy law depends on that law; where the law provides an opt-out, eligible individuals may exercise it through our stated request channels.

9. Data Retention and Deletion

Active Workspace data is retained while needed to provide the Services and follow Customer instructions.

If a Customer’s paid subscription expires or the Customer closes its account, we retain the inactive Workspace, including chats, leads, campaign records and CRM history, for 12 months to enable reactivation, unless an authorised Customer requests earlier deletion.

If the Customer does not reactivate within those 12 months, an automated deletion process will be initiated at the end of that period to remove the inactive Workspace and associated Customer Content from active systems, without a separate deletion request.

Copies in routine backups expire under applicable backup retention cycles. Limited data may be retained separately where required by law or necessary for legitimate security, fraud-prevention, accounting or legal-claim purposes.

An authorised Customer may ask for deletion of an entire Workspace before that period ends.

Following verification, we will process the request in accordance with applicable contractual and legal obligations.

Some information may remain temporarily in protected backups, fraud and security logs, transaction records, legal holds or suppression records where required or justified.

These categories are retained only for their respective legitimate purposes, with appropriate restrictions, and removed according to applicable retention schedules.

Business Contact Data is periodically assessed for accuracy, necessity and objections; information is corrected, suppressed or removed when appropriate.

Personal data associated with accounts, support, billing, integration diagnostics and website usage is retained only for as long as needed for the relevant purposes, considering legal requirements and security needs.

We do not currently publish one universal deletion period for every category. We will provide additional category-specific information on request where required by law.

10. International Transfers

Spredo is established in the United Kingdom.

Information may be stored or accessed in other countries by authorised infrastructure providers, support services and Connected Services, including AI providers selected by a Customer.

Where we transfer personal data from the UK or EEA to a country without an applicable adequacy decision, we use an appropriate lawful transfer mechanism where required, such as recognised standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with supplementary measures where appropriate.

A connected third-party controller may operate its own international transfer arrangements.

11. Information Security

We apply proportionate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure and loss.

Measures may include access controls, authenticated connections, secure transmission, restrictions on staff and service-provider access, logging, separation of customer workspaces and security incident response.

No networked system is risk-free.

Customers must protect their own credentials, messaging accounts, connected agents and devices, and promptly report suspected compromise.

Specific security controls and certifications should be relied upon only where separately documented or confirmed.

12. Privacy Rights and Objections

Depending on the governing law and circumstances, individuals may have rights to know whether we process their data; access and obtain a copy; correct inaccurate records; request erasure or restriction; object to processing based on legitimate interests, including direct marketing; request portability where applicable; and withdraw consent where consent is relied upon.

Individuals may also have rights concerning certain automated decisions. We do not state that Spredo makes solely automated decisions with legal or similarly significant effects about individuals as part of ordinary contact database use.

If your professional information appears in our contact database, you can object to inclusion or request correction or removal at https://www.spredo.io/claim-profile, if available, or by writing to support@spredo.io.

You do not need a paid Spredo account to make a privacy request.

We may reasonably verify identity and authority, respond within the legally applicable time period, and explain any lawful reason we cannot fully grant a request.

You may complain to the UK Information Commissioner’s Office (ICO) or your relevant supervisory authority.

When data is held within another organisation’s Customer Workspace and that organisation determines its purposes, we may refer a request to the relevant customer/controller or assist it in complying with applicable law.

We do not promise to delete another controller’s copy simply because a professional objects to inclusion in Spredo’s proprietary database.

13. Cookies and Tracking

We may use essential cookies and similar technologies to maintain sessions, secure authentication and provide requested website functions.

Analytics or marketing technologies, if enabled, are subject to applicable notice, choice and consent requirements, including UK rules for non-essential cookies.

The categories, providers and controls described in any separate Cookie Policy or cookie preference interface must reflect the technologies actually deployed.

You may also control cookies using browser settings, though doing so may affect functionality.

14. Marketing Communications

We may send service and account communications required to administer a relationship.

Promotional communications from Spredo are subject to applicable electronic marketing laws and consent or other permissions as required.

Recipients can opt out of promotional messages through the available unsubscribe method or by contacting us.

Customers conducting outreach through Spredo independently determine their own recipient notice and opt-out arrangements; Spredo’s marketing choices do not govern a Customer’s separate campaign communications.

15. Children and Sensitive Information

The Services are intended for adults engaged in business and are not directed to children under 18.

We do not knowingly seek children’s personal data for the Services.

We discourage customers from using the Services to collect or disclose sensitive personal data unless a documented lawful basis and appropriate controls exist.

Please contact us if you believe a child’s information was collected inappropriately.

16. Third-Party Services and Links

Our Services may link or connect to independently operated platforms such as Telegram, Anthropic, OpenAI and other services.

When you independently use such services, their own terms, policies, user settings and account arrangements apply.

Spredo does not control those providers’ separate processing.

This Privacy Policy covers processing for which Spredo is responsible, not every use by an external recipient after data leaves our controlled environment.

17. Changes to This Policy

We may update this Policy as our practices, Services or legal obligations change.

We will identify the updated effective date on the published Policy and provide additional notice of material changes where required or reasonably appropriate.

We will not treat continued use alone as consent where the law requires specific consent.

18. Contact and Requests

Spredo Ltd. (Company number 15706388)

128 City Road, London, EC1V 2NX, United Kingdom

Privacy and data requests: support@spredo.io

Business contact record requests: https://www.spredo.io/claim-profile