Privacy policy

Effective date: October 3, 2026. This Privacy Policy explains what personal information Spreadiom collects, why, how long we keep it, who we share it with, and the rights you have. It applies to spreadiom.com, our booking pages, the ad embed code that Publishers place on their websites, and our emails.

1. Who is responsible

The controller of your personal information is DevTeam Co., Ltd. (“Spreadiom”, “we”), 509-J492, 5F, 81, Convensia-daero, Yeonsu-gu, Incheon, Republic of Korea (business registration no. 889-06-02572). Our privacy officer is listed in section 13.

Spreadiom connects website owners (“Publishers”) with the businesses that book their ad space (“Advertisers”). When an Advertiser books a Publisher's ad slot, the Publisher also receives the booking details and handles them as its own controller under its own policies.

2. Information we collect

Publishers (account holders)

• Account: name, email, password (stored only as a one-way hash), company, website, country, time zone, language, profile image and the profile details you choose to add. If you sign in with Google or GitHub, we receive your account ID, name, email and profile picture from them.
• Payment settings: your Stripe API keys (stored encrypted), your Stripe account ID and name as reported by Stripe, and your PayPal email.
• Billing: your bookings' amounts and fees, invoices, payment status and PayPal payment references.

Advertisers (bookings)

• Name, email, company (optional), the dates and slot you book, the landing page URL, the banner image you upload and any note to the Publisher.
• Payment references: Stripe checkout and payment IDs, or PayPal order and capture IDs with the payer email and payer ID that PayPal returns. We never receive or store card numbers — you enter card details on Stripe's or PayPal's own pages.

Contact and enterprise forms

• Name, email, company, website and your message.

Ads shown on Publishers' websites

• When a Spreadiom banner is shown, we count the impression for the slot and date only.
• When someone clicks a banner, we record the time, slot, IP address, browser (user agent), the page the click came from, and an approximate country and city that we look up from the IP address with a database stored on our own server (MaxMind GeoLite2).
• The embed code is a plain image link: it sets no cookies, runs no JavaScript and does not build profiles of website visitors.

Visits to spreadiom.com

• IP address, approximate country and city, browser, pages visited, referring page and a session identifier, used for security and simple traffic statistics.
• Cookies: only strictly necessary cookies — a session cookie and a security (CSRF) token. Your light/dark theme choice is stored in your own browser. We use no advertising or third-party analytics cookies.

3. How we use it

• To provide the Service — accounts, booking pages, checkouts, showing booked ads, statistics and booking emails (performance of a contract).
• To bill Publishers — monthly fee invoices, reminders and pausing new bookings for unpaid invoices (contract; legal obligations for records).
• To screen ads — uploaded banners are checked automatically for prohibited content (legitimate interest in keeping the Service safe). See section 4.
• Security and fraud prevention — protecting accounts, detecting abuse and fake clicks, rate limiting (legitimate interests).
• Support and communication — answering messages and sending service emails. We do not send marketing emails without your consent.
• Legal compliance — tax, accounting and other legal obligations.

We do not sell personal information and do not use it for targeted advertising.

4. Automated screening of ad images

To keep prohibited content (for example adult, gambling or drug-related images) off Publishers' websites, every uploaded banner is sent to OpenAI's API, which returns whether it appears to break our advertising policy. If it does, the upload is rejected and you can upload a different image. No other decisions are made automatically, and you can contact us if you believe an image was rejected by mistake.

5. Who we share information with

• Publishers receive the details of bookings on their slots (Advertiser name, email, company, banner, landing page, note and payment status) so they can review and run the ads.
• Payment providers: Stripe processes card payments on the Publisher's Stripe account, and PayPal processes PayPal payments to the Publisher and Spreadiom fee payments. Each acts under its own privacy policy.
• Service providers who process data for us under contract (listed in section 6).
• Authorities, when required by law or to protect our rights and users.

6. Service providers and international transfers

We use the following providers. Their servers may be located outside your country, including outside the Republic of Korea; the data is transferred over encrypted connections when the Service is used, and kept only as long as described in section 7 or as each provider's terms require.

Where the GDPR applies, transfers outside the European Economic Area rely on the European Commission's standard contractual clauses or another lawful mechanism offered by the provider.

7. How long we keep it

• Account data: while your account is open. After you ask us to close it, we delete it within 30 days, except records we must keep by law.
• Bookings, payments and invoices: 5 years, as required for contract and payment records under Korean e-commerce and tax law.
• Click records (IP address, browser, referring page): 12 months, then deleted. Impression counts contain no personal information.
• Website visit logs: 90 days. Web server access logs: 14 days. Application error logs: 7 days.
• Contact messages: up to 3 years, to handle requests and complaints.
• Backups: daily database backups are kept for up to 30 days, then overwritten.
• Ad images: kept with the booking or ad slot they belong to.

When the retention period ends, electronic records are deleted in a way that cannot be restored, and any paper copies are shredded.

8. Your rights

You can ask us to access, correct, delete or export your personal information, to restrict or object to its processing, or to withdraw a consent you gave. Publishers can update most details in their dashboard. To make a request, email [email protected] from the address you used with us. We answer within 10 days, or sooner where the law requires, and may need to verify your identity.

If you are not satisfied with our answer, you can complain to your local data protection authority. In Korea you can contact the Personal Information Protection Commission or the Personal Information Infringement Report Center (privacy.kisa.or.kr, phone 118).

California residents: we do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

9. How we protect it

• All traffic is encrypted with HTTPS, and our server is reachable only through Cloudflare's network.
• Passwords are stored as one-way hashes; Stripe keys and other third-party secrets are encrypted at rest.
• Access to personal information is limited to people who need it to run the Service, and login and payment endpoints are rate-limited.
• We keep encrypted connections to our service providers, monitor errors, and take daily backups.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect information from children under 14. If you believe a child has given us personal information, contact us and we will delete it.

11. Links to other websites

Ads and booking pages link to websites run by Publishers and Advertisers. Their privacy practices are their own responsibility.

12. Changes to this policy

We may update this policy as the Service changes. The date at the top shows the latest version. For material changes we will notify account holders by email or on the website before they take effect.

13. Privacy officer and contact

Privacy officer: Daniel Ahn, CEO · Email: [email protected] · Phone: +82-10-5448-4986
DevTeam Co., Ltd., 509-J492, 5F, 81, Convensia-daero, Yeonsu-gu, Incheon, Republic of Korea