Privacy Policy

Spread Software Limited
Last updated: 27 May 2026 | Version 2.1

This Privacy Policy explains how Spread Software Limited collects, uses, stores, and protects your personal information when you use our website (https://spread.finance), our SaaS platform ("Spread"), or when you interact with us by email, social media, or other means.

This website and platform are not intended for use by children under the age of 18. We do not knowingly collect personal data from children.

WHO WE ARE

Spread Software Limited ("Spread", "we", "us", "our") is the controller of your personal data for the purposes of this Privacy Policy.

Company: Spread Software Limited Registered in: England and Wales Company number: 16564312 Registered office: The Coach House, 5 West Street, Leighton Buzzard, LU7 1DA Privacy contact: hello@spread.finance ICO registration: ZC040108

If you have any questions about this policy or how we handle your personal data, please contact us at hello@spread.finance.

2. WHAT PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data depending on how you interact with us and the Service:

Identity Data
Name, username, job title, company name, LinkedIn profile information.

Contact Data
Email address, telephone number, billing address, business address.

Technical Data
IP address, browser type and version, operating system, device information, time zone, usage statistics, log data, session identifiers.

Profile Data
Your account preferences, feature usage patterns, feedback, support request history, approval settings, login details (hashed — we never store plain-text passwords).

Accounting & Financial Data
Invoice details, transaction data, accounting journal entries, accrual and prepayment schedules, deferred revenue records, supplier and customer names appearing in financial records, recurring bill information — all processed on behalf of your Organisation.

Usage Data
Information about how you navigate and use the Spread platform and our website, including pages visited, features used, actions taken, and time spent.

Transaction Data
Subscription payment records, billing history, and payment method metadata (we do not store full card numbers — these are handled by our payment processor, Stripe).

Communications Data
Emails, messages, and other communications you send us, including support requests and feedback.

Marketing & Preferences Data
Your preferences for receiving marketing and product update communications from us, and your opt-in or opt-out history.

Third-Party Integration Data
Information received from connected accounting platforms (primarily Xero) via API, including organisation metadata, account codes, transaction data, and connection status.

We do not knowingly collect or process special categories of personal data (such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Please do not submit such data through the Service.

3. HOW WE COLLECT YOUR PERSONAL DATA

3.1 Directly from you

- When you register for a Spread account or begin a free trial
- When you connect your Xero or other accounting software account to the Service
- When you contact us by email, phone, or social media (including LinkedIn)
- When you participate in a discovery call, product demonstration, or onboarding session
- When you submit feedback, complete a survey, or request support
- When you subscribe to our marketing communications or download resources such as our guides or handbook
- When you interact with us at events or via referrals

3.2 Automatically

- Through cookies, pixel tags, and similar tracking technologies when you visit our website or use the platform (see section 7 for more detail)
- Through server logs and usage monitoring tools that record technical information about how you access and use the Service
- Through automated monitoring systems that track Service performance, errors, and security events

3.3 From third parties

- From Xero and other connected accounting software platforms via their APIs, where you have authorised the connection
- From our payment processor (Stripe) in relation to billing and subscription management
- From analytics and performance monitoring providers
- From LinkedIn and other professional networks where you engage with our content or contact us via those platforms
- From publicly available sources such as Companies House, for business identity verification purposes

4. HOW AND WHY WE USE YOUR PERSONAL DATA

We process your personal data only where we have a lawful basis to do so. The table below sets out our main processing activities, the data involved, and the lawful basis we rely on.

5. MARKETING COMMUNICATIONS

We may send you marketing communications about Spread's features, updates, resources, and related services if:

- you are an existing customer and have not opted out; or
- you have explicitly opted in to receive marketing from us.

We will not share your personal data with any third party for their own marketing purposes without your explicit prior consent.

You can opt out of marketing communications at any time by:

- clicking the unsubscribe link in any marketing email we send you
- updating your communication preferences in your Spread account settings
- contacting us directly at hello@spread.finance

Opting out of marketing will not affect your receipt of essential service communications such as billing notices, security alerts, or updates necessary to the operation of your account.

6. LINKEDIN AND SOCIAL MEDIA

Spread uses LinkedIn as a primary channel for content distribution, brand awareness, and customer acquisition. We may collect and use publicly available information from LinkedIn profiles when you interact with our content, send us a message, or connect with us on the platform.

Where we use LinkedIn for direct outreach or automated connection sequencing, we process this in accordance with LinkedIn's own terms of service and applicable data protection law. If you receive a connection request or message from Spread via LinkedIn and do not wish to be contacted, you may decline the request or contact us at hello@spread.finance to be removed from any outreach sequence.

We do not purchase third-party marketing lists or use LinkedIn data for any purpose beyond professional outreach and content distribution related to Spread's services.

7. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies on our website and platform to improve user experience, analyse traffic, and personalise content. Cookies are small text files stored on your device by your browser.

Strictly necessary cookies
Purpose: Essential to the operation of the website and platform (e.g. session management, login state, security).
Lawful basis: Legitimate interests / Contract

Analytics cookies
Purpose: To understand how visitors use our site and platform so we can improve them.
Lawful basis: Consent

Functional cookies
Purpose: To remember your preferences and customise your experience.
Lawful basis: Consent

Marketing and tracking cookies
Purpose: To measure the effectiveness of our marketing campaigns and deliver relevant content.
Lawful basis: Consent

You can manage or disable non-essential cookies at any time through your browser settings or via any cookie consent tool displayed on our website. Please note that disabling certain cookies may affect the functionality of the Service.

8. AUTHORISED ACCOUNT ACCESS (STAFF ACCESS TO YOUR ACCOUNT)

Spread's back-office systems include a staff access function that allows authorised Spread staff to assume a session within your account in order to see the Service as you see it. This feature exists to enable effective customer support, onboarding, and quality assurance.

When this access is used, Spread staff may see your account data including your connected Organisation settings, journal entries, accrual and prepayment schedules, workflow configurations, and related financial information.

This access is:

- restricted to authorised Spread personnel only, on a role-based, need-to-know basis
- used solely for the following purposes: support, onboarding, training, quality assurance, data integrity checks, security investigation, legal compliance, and aggregated service improvement (see clause 10 of our Terms and Conditions for full detail)
- subject to confidentiality obligations binding on all Spread staff
- carried out in accordance with the principle of data minimisation — staff will only review data necessary to resolve the relevant issue

The lawful basis for this processing is Spread's legitimate interests in providing, maintaining, and improving the Service, balanced against your interests and rights. We have assessed that this processing is necessary, proportionate, and would reasonably be expected by customers receiving a managed SaaS service.

You have the right to object to non-urgent uses of this access. If you wish to restrict staff account access to emergency or legally required situations only, please contact us at hello@spread.finance. Note that this may limit the support we can provide.

9. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data. We share personal data only where necessary and with the following categories of recipient:

Xero and connected accounting platforms: To fulfil the core function of the Service, reading and writing accounting data via the Xero API under your authorisation.

Stripe (payment processor): To process subscription payments securely. Stripe receives your email address and an internal customer identifier for this purpose. Stripe acts as an independent data controller for payment data.

Wix: To operate our website and marketing tools. Wix receives your email address, first name, and last name where you interact with our website or marketing communications.

Our hosting provider: To store and process Service data securely on private infrastructure based in the UK, as part of delivering the Service.

Server monitoring provider: A third-party tool receives infrastructure metrics only (such as server uptime and resource usage) to help us monitor Service availability. This tool does not receive or process personal or customer data.

Regulators and law enforcement: Where required by applicable law, regulation, or court order.

Professional advisors: Such as lawyers and accountants, where necessary for legal or business purposes, subject to confidentiality obligations.

Prospective buyers or investors: In connection with a potential merger, acquisition, or business transfer. You will be notified of any such transfer that affects your data.

We do not permit generative AI platforms, analytics platforms, or any other third party to use your personal data or accounting data to train machine learning or AI models. This applies to all data processed through the Spread platform.

10. INTERNATIONAL DATA TRANSFERS

Service data is hosted on private infrastructure based in the UK. Some of our other service providers and sub-processors (such as Stripe) may be based or operate infrastructure outside the UK or the European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including:

UK Standard Contractual Clauses (SCCs) approved by the Information Commissioner's Office
adequacy decisions made by the UK Government in respect of the destination country
other approved transfer mechanisms under the UK GDPR

11. HOW LONG WE KEEP YOUR DATA

We retain your personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting requirements.

Account and profile data:
Retained for the duration of your Subscription plus 6 years after termination, to meet statutory accounting and legal obligations.

Accounting and financial data processed through the Service:
Retained for the duration of your Subscription. Following termination, you may export your data within 7 days. We will delete or archive this data within a further 7 days unless required to retain it by law.

Payment and transaction records:
Retained for 7 years from the date of each transaction, as required under UK tax legislation.

Support and communications records:
Retained for 3 years from the date of each interaction, or for the duration of your Subscription if longer.

Authorised account access logs:
Retained for 12 months from the date of each access event.

Marketing preferences and opt-out records:
Retained for the duration of your Subscription plus 3 years, to evidence compliance with marketing consent obligations.

Website usage and analytics data:
Retained for 26 months from collection, unless anonymised earlier.

Anonymised and aggregated data:
May be retained indefinitely for product development and service improvement purposes.

12. HOW WE PROTECT YOUR DATA

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

encryption of data in transit using TLS 1.2 or higher
our production server is not reachable from the public internet; access is only possible through a private VPN, and server login requires public-key authentication rather than a password
passwords are hashed using PBKDF2-SHA256, a one-way industry-standard method, and are never stored in plain text
daily backups, with weekly offsite backups of full server images, allowing data to be restored in the event of a system failure

No method of transmission or storage is completely secure. If you believe your account has been compromised, please contact us immediately at hello@spread.finance.

In the event of a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of becoming aware of it, where required by applicable law.

13. YOUR DATA PROTECTION RIGHTS

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access
You can request a copy of the personal data we hold about you.

Right to rectification
You can ask us to correct inaccurate or incomplete personal data.

Right to erasure
You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.

Right to restriction
You can ask us to restrict our processing of your data in certain circumstances.

Right to portability
You can ask us to provide your personal data in a structured, commonly used, machine-readable format.

Right to object
You can object to our processing of your personal data where we rely on legitimate interests as our lawful basis, including profiling for direct marketing.

Right to withdraw consent
Where we process your data on the basis of consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

Right to complain
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

To exercise any of your rights, please contact us at hello@spread.finance. We will respond within one month of receiving your request. We may ask you to verify your identity before processing your request.

Please note that some rights are not absolute and may be subject to exceptions under applicable law. Where we are unable to fulfil a request, we will explain why.

14. AUTOMATED DECISION-MAKING

The Spread platform automates the generation of accounting journal entries, accruals, prepayments, deferred revenue adjustments, and recurring bill management based on rules and configurations set by you. This automation is a core feature of the Service.

These automated outputs do not constitute "solely automated decision-making with legal or significant effects" under Article 22 of the UK GDPR, as all outputs are subject to review and approval by you or your designated finance professionals before being posted to your accounting software. You retain full control and professional responsibility for all entries made to your accounting records.

15. THIRD-PARTY LINKS AND SERVICES

Our website and platform may contain links to third-party websites, services, or integrations (such as Xero, the Xero App Store, or other tools). We are not responsible for the privacy practices of those third parties.

We encourage you to review the privacy policies of any third-party service you connect to or navigate to from Spread. In particular, your use of Xero and other accounting platforms is subject to their own privacy policies and data processing terms.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the features of the Service. We will notify you of any significant changes:

- by email to the address associated with your Spread account; and/or
- by displaying a notice within the Spread platform

The "Last updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically.

17. HOW TO CONTACT US

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

Privacy enquiries: hello@spread.finance
General support: support@spread.finance
Postal address: The Coach House, 5 West Street, Leighton Buzzard, LU7 1DA
Website: https://spread.finance
ICO (supervisory authority): www.ico.org.uk | 0303 123 1113

---
Spread Software Limited | Company No. 16564312
The Coach House, 5 West Street, Leighton Buzzard, LU7 1DA
hello@spread.finance | spread.finance