Spread: Privacy Policy

Last updated: 2026-09-21.

This policy explains how Harold Taeter, a sole trader (entreprise personne physique) established in Belgium and trading as "Spread" ("Spread", "we") handles your personal data when you use Spread. We are the data controller (enterprise number 1041.047.352, VAT number BE 1041.047.352). You can reach us at privacy@spreadmymessage.com, or by post at:

Avenue Prince Baudouin 19 4802 Heusy (Verviers) Belgium

1. What we collect

• You give us: your name, email address, the ad message and image you submit, and the location you target. Optionally, if you tick the marketing opt-in, we record that consent.
• Contact details we publish. Every ad must carry at least one way for people to reach you: a phone number, a WhatsApp number, a public email address or a link (to a website or a social-media profile). Any one of them is enough, a link included. This is the whole point of the ad: it is shown publicly on your ad's page, on the board if you list it there, and it is where your Meta ad sends people. Please use details you are willing to make public. It is deliberately separate from the email address above, which we use only to reach you and never publish.
• How your ad was set up and how it did. Your ad's page also shows what you paid, the size of the area you targeted, the ages and the platforms (Facebook, Instagram or both) you chose to show it to, how long the ad runs, and how many times it was shown and clicked, so that someone who sees your ad can understand what putting one out involves. The ages and platforms appear only on ads placed after we started asking for them. The area shown is the one you targeted: the map on your page draws the same circle your ad is aimed at, so please choose a centre you are comfortable being seen. What the page never shows is your name or the email address you gave us to reach you.
• Payments: handled by Stripe, and by whichever payment method you choose to pay with: a card, or a service like PayPal, Apple Pay, Google Pay, Link or Amazon Pay. If you pick one of those, you sign in to them directly and they handle your details themselves; we never see your card number or your login for them. Whichever you use, we receive only limited payment metadata (e.g. the payer name and whether payment succeeded), not your full card details.
• VAT, and buying for a business. Our prices include Belgian VAT when you pay from the European Union, so we record the country of your card or payment method (Stripe tells us) to work out whether it applies. If you buy for a business and give a VAT number, we also record that number and the business's registered name and address: we check the number in the EU's VIES register, which usually returns the name and address, and ask you to type them where it does not. We use them to decide the VAT and to issue the invoice.
• If you contact us: whatever you choose to tell us. By email, that is your address and your message. By telephone, our line goes to voicemail, so it is the number you call from and a recording of the message you leave. We keep it only until we have dealt with it, and we do not record calls in any other way.
• If you report an ad: the reason you give and, only if you choose to give them, your name and email address. We use that address only to confirm we received your report and to tell you what we decided. We don't tell the person who placed the ad who reported it.
• Automatically: basic technical/usage data (e.g. IP address, device/browser) when you use the site. We also keep a daily count of how many times the ad form was opened, so that we can tell whether people who click one of our own adverts actually reach it. It is one running total per day and nothing more: no cookie is set, nothing is stored on your device, and nothing is recorded about you individually, so no figure in it could be traced back to any single visit.
• Only if you accept it on the ad form: a record of how you use the form, including a recording of the screen, made with PostHog so we can make the form easier to use. What you type and your photo are left out of it. Section 6 explains it in full.

If you appear in someone else's ad. An ad can mention or show a person who didn't submit it: a name in the message, a face in the photo. We have no way to reach such a person (we hold no contact details for them), so we say it here instead: what we hold is only what the ad itself contains, we use it only to screen and run that ad, and the person who submitted it promised us they had the right to include you. If you find yourself in an ad on Spread and want it changed or removed, contact privacy@spreadmymessage.com. You don't need an account or to have used Spread, and the same rights in Section 7 apply to you.

2. Why we use it, and our legal basis (GDPR Art. 6)

How your ad is screened: an automated decision. When you submit an ad, it is checked automatically before anything is published. Software, including an AI model, reads your message and image and compares them against Meta's advertising policies and our own acceptance rules: the categories we don't accept, the languages we support, and claims or content that could be misleading, unlawful or unsafe. This screening can decline your ad automatically, without a person having looked at it first. If that happens, we tell you the reason, you are not charged (the hold on your payment method is released), and you can ask for a human review: a real person with the authority to overturn the automated decision looks at your ad and decides afresh. We use this screening only to decide whether we can run the ad you asked us to run, never to profile you or for any other purpose.

3. Who we share it with (processors and recipients)

We share data only as needed to provide the service:

• Meta: to create, run and report on your ad. Your ad is published publicly, and the information you submit for it is processed under Meta's own terms. (For ads shown in the EU, Meta publishes the name of the advertiser and of whoever paid for the ad. For ads run through Spread, that name is Spread's, not yours.) Meta also receives consent-based measurement data about visitors to the hosted ad page (Pixel / Conversions API, see Section 6).
• Stripe: to process your payment. If you choose to pay with PayPal, Apple Pay, Google Pay, Link, Amazon Pay, Klarna or Satispay rather than by card, that company also handles your payment, under its own privacy policy and the account you hold with it.
• Resend: to send you transactional emails (status, results).
• Anthropic: your ad text and image are sent to Anthropic's API to screen them against advertising policy. They process it to return a moderation result and do not use it to train models.
• Neon: the database your submission is stored in. Vercel: hosting; it processes every request to the site.
• Inngest: runs our background jobs (moderation, emails, scheduled clean-ups). Because it has to be able to resume a job after a failure, it holds the job's working state, which can include your email address.
• LocationIQ: turns the place you type into a map position, and a map position back into a place name. It receives what you type in the location box and the coordinates of the pin you set.
• Zadarma: runs our telephone line. If you call and leave a message, Zadarma records it and sends the recording to us by email. It only ever holds what you say and the number you call from.
• Cloudflare: stores your ad image (R2), and runs the anti-bot check on the form (Turnstile), which receives your IP address.
• Google: if you give a link as your public contact, we send that link (and nothing else) to Google's Web Risk service, which tells us whether it is a known malware or phishing address. This runs before your ad goes anywhere public. We never open the link ourselves.
• The European Commission's VIES service: if you give a VAT number, we send that number (and nothing else) to the EU's VIES register, run by the European Commission with the national tax authorities, which tells us whether it is valid and, usually, the business's registered name and address.
• Accountable: our accounting software. It holds the invoices we issue to businesses (the business's name, address and VAT number, and the amounts) and sends them over Peppol, the EU's e-invoicing network, where Belgian law requires it.
• Sentry: collects error reports when something breaks, so we can fix it. It is configured not to collect personal data, and we strip email addresses and private links from reports before they are sent.
• PostHog: only if you accept the cookie banner on the ad form, it records how you use the form (see Section 6). It stores that data in the EU, in Frankfurt.

We do not sell your personal data.

4. International transfers

Some of the companies in Section 3 process data outside the EEA, mostly in the United States; our geocoding provider (LocationIQ) is based in India. Where they do, the transfer is covered by an appropriate safeguard: several (including Stripe, Cloudflare, Vercel, Sentry, Anthropic, PostHog and Meta) are certified under the EU–U.S. Data Privacy Framework (Google too), which the European Commission recognises as providing adequate protection, and for the others we rely on the EU Standard Contractual Clauses incorporated in their data-processing agreements. You can ask us at privacy@spreadmymessage.com which safeguard covers a given provider and how to obtain a copy of it.

5. How long we keep it

We keep your data only as long as we need it:

• Your ad and account data (the name where collected, email, message, image, location and the screening record) is kept for up to 12 months, then anonymised: we clear the personal details and keep only a non-personal record of the transaction (see below). The 12 months run from the point we've finished doing anything with your ad, whichever is latest of: your most recent ad, the end of its run, the day your board listing comes down (including any renewals), and the settling of any payment or card dispute. So a listing you keep renewing stays up, and its data stays with us, for as long as you keep renewing it.
• Financial and transaction records (amounts, the VAT charged, payment references and invoices, including a business's name, address and VAT number) are kept for 7 years, because Belgian accounting and tax law requires it. As that law counts it, the period runs from 1 January of the year after the financial year the transaction belongs to. These records are kept in a minimised form that no longer needs your message or image.
• Marketing data is kept until you unsubscribe; after that we keep only a minimal record of your opt-out so we don't email you again.
• How you used the ad form (only if you accepted, see Section 6): the screen recordings are deleted after 30 days, and the usage events are kept for 12 months, after which PostHog no longer makes them available to us.
• Reports about ads (the reason, and your name and email address if you gave them) are deleted 6 months after we decide the report.
• How long your ad's page stays public. This is separate from how long we keep the data. The page we host for your ad (the one your ad links to) is publicly reachable while your ad is running and for 7 days afterwards. If you also choose to list it on our public board, it stays reachable for 60 days from the day you list it; we email you before that runs out, and you can renew it or take it down at any time from your status page. After that the page stops being publicly reachable, whether or not we still hold the underlying data under the periods above.

6. Cookies & measurement on hosted ad pages and on the ad form

We use only the cookies necessary to run the site by default. On the public ad pages we host (the page a Meta ad links to, and the page a board listing opens), we use the Meta Pixel and Meta's Conversions API to measure how the ad performs, for example that the page was viewed and that someone tapped a contact button. These set advertising cookies and share the visitor's IP address, device/browser information and interaction with Meta (acting as an independent controller under its own terms).

This measurement loads only with the visitor's consent: nothing fires until you choose Accept on the banner shown on the page, and Decline leaves the page fully usable with no Pixel and no cookies set. Your choice is remembered on your device so we don't ask again. This processing is based on consent (GDPR Art. 6(1)(a) / ePrivacy). You can change your mind at any time: at the foot of the page there is a line showing your current choice with a Change link, which brings the banner back so you can accept or decline again. Withdrawing takes effect immediately and is as easy as giving it in the first place.

Separately from the Meta measurement above, we keep simple aggregate statistics for each hosted ad page (a running count of page views and of taps on the contact buttons, including which contact channel was tapped, such as WhatsApp or the phone number) so the advertiser can see how their campaign is doing. These are plain totals: they set no cookies, store nothing on your device, and record nothing about you individually (your IP address is used transiently only to rate-limit abuse, and is not stored with the count).

To be explicit about what the banner's choices mean: Accept loads the Meta Pixel and shares the measurement data described above with Meta; Decline means no Pixel, no advertising cookies, and nothing shared with Meta. The anonymous page totals are kept in both cases. They are not affected by the banner, because nothing is placed on or read from your device and no personal data is retained. To the extent any processing is involved at all, it is based on our legitimate interest (GDPR Art. 6(1)(f)) in reporting campaign performance to the advertiser.

Note: the part above concerns visitors to a hosted ad page, who may be different people from the advertiser who submitted the ad.

On the ad form

The form where you create an ad shows a banner of its own. It asks whether we may use PostHog to see how people use the form, so that we can make it easier.

If you choose Accept, PostHog stores cookies on your device and records your visit to the form: the steps you open, where you tap and scroll, the errors the form shows you, and a recording of the screen as you move through it. Some things are left out of the recording on purpose: everything you type (it is hidden, never captured), your photo, the previews of your ad, the place you pick and the email address the form may suggest. The recording is tied to a random identifier stored on your device, and we never connect it to your name or your email address. Advertising click identifiers in the page address are removed before anything is sent.

If you choose Decline, PostHog is never loaded and nothing is stored or recorded. Your choice is remembered on your device, and a line under the form shows it with a Change link, so you can change your mind at any time. Declining after accepting stops the recording at once and removes PostHog's cookies from your device.

This is based on your consent (GDPR Art. 6(1)(a) / ePrivacy), and we ask every visitor, wherever they are. The separate daily count of how many times the form was opened (Section 1) uses no cookie and is kept either way. How long PostHog keeps this data is in Section 5.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent where processing is based on consent. If you opted in to marketing, you can withdraw that consent at any time via the unsubscribe link in any marketing email (or by contacting us). To exercise any of these, contact privacy@spreadmymessage.com. You also have the right to lodge a complaint with your supervisory authority, which in Belgium is the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).

If you are in Mexico: your ARCO rights

This document is also our aviso de privacidad for the purposes of Mexican data-protection law.

The rights above have their own names in Mexico, where they are known together as the ARCO rights: acceso (access: knowing what data we hold about you and what we do with it), rectificación (correcting it if it is wrong or incomplete), cancelación (asking us to delete it) and oposición (asking us to stop using it for a particular purpose). You can also revoke your consent wherever we rely on consent, and limit the use or disclosure of your data. These are the same rights as in the paragraph above, under the names Mexican law gives them.

To exercise any of them, write to privacy@spreadmymessage.com telling us who you are, which right you want to exercise, and which data it concerns. We answer by the same route. If our answer does not satisfy you, you can go to the Mexican data-protection authority, which since 20 March 2025 is the Secretaría Anticorrupción y Buen Gobierno (it took over from INAI, which was dissolved).

We do not ask you for sensitive personal data, and we do not need any to run the service. If your message or your image happens to contain some, we process it only to screen and run that ad, as Section 2 describes.

8. Children

Spread is not directed to anyone under 18, and you must be 18+ to use it.

9. Changes to this policy

If we make a material change to this policy (for example a new purpose for using your data, a new recipient we share it with, a change to who the data controller is, or a change to how you exercise your rights), we will contact you directly, by email to the address you gave us, to tell you what has changed and what it means for you. That message will be about the change and nothing else. Where a change is a significant one, we will tell you before it takes effect, so you have time to consider it and to exercise your rights.

We will not rely on you checking this page. Minor edits (a typo, or rewording that doesn't change what we do) aren't treated as material changes; they're simply recorded below with a new Last updated date at the top of this page.

Every substantive change is listed here, so you can see what changed and when.

This history was reconstructed from our change records on 2026-07-31; changes before that date were not stamped in the policy at the time they were made.

10. Contact

Privacy questions or requests: privacy@spreadmymessage.com.