Privacy

Who we are

SpreadWord (spreadword.org) is run by Vanette’s Place Global LLC, 2810 N Church St PMB 607081, Wilmington, Delaware 19802-4447, United States (“SpreadWord”, “we”, “us”).

We are the controller of the personal information described in this policy. It covers spreadword.org and the emails we send.

Questions? Use the contact form at spreadword.org/help, or email support@asaplinks.com.

The short version

• We collect what we need to run accounts, gifts, pages and payouts.
• Card details go straight to Stripe. We never see or store them.
• We use PostHog to understand how the site is used. We never send it your name, email address, notes or messages.
• We do not use advertising tags or ad cookies, and we never share your information for advertising.
• We do not sell your personal information.
• You can delete your account at any time in Account.

What we collect

What we collect depends on how you use SpreadWord.

• Sponsors: your email; the name you enter at checkout or in Account, if you give one (if you leave it empty and pay with Apple Pay or Google Pay, the name on that payment); your gifts (the creator, the amount, monthly or one-time, the dates, and the Stripe charge and invoice references), the note you write to a creator if you write one, your email preferences, and your Stripe customer and subscription references. A note goes only to that creator and is never public.
• Creators: your name, handle, mission, photo, links, favorite verse, story, community link, categories, denomination, content types and page color; your published updates and their photos; your sponsor list and earnings; and your Stripe Connect account reference and payout status.
• Contact form: your name, email and message.
• Server logs: your IP address, browser, a request id and any errors, for security and debugging.
• Email log: what we sent, to whom and when, so a retry never sends the same email twice.
• Usage: the pages you view and the actions you take on the site. See “Analytics” below.

Where it comes from:

• from you, when you check out, set up your page, change your settings or contact us;
• from Stripe: the status of payments, monthly gifts, refunds and payouts. Stripe collects creators’ identity, bank and tax details itself. SpreadWord never collects them;
• from Clerk, when you sign in. If you sign in with Google, Google shares basic profile details, such as your name and email address;
• from your browser, automatically. See “Cookies and similar technologies” and “Analytics” below.

How we use it, and our legal bases

We use your information only for the purposes below. Data protection laws such as the GDPR ask us to name a legal basis for each one.

• To run SpreadWord for you (our contract with you): creating your account and signing you in, taking gifts, combining monthly gifts into one bill, paying creators, showing creator pages, passing notes to creators, showing community links to people who have given, and sending receipts and account emails.
• To send creators’ monthly updates (our contract with you, and our legitimate interest in connecting creators with their sponsors). You can turn these off in Account at any time.
• To answer you (legitimate interest): replying to messages you send us.
• To understand and improve SpreadWord (legitimate interest): product analytics, including what people search for in the directory, so we can see what is missing.
• To keep SpreadWord safe (legitimate interest): using server logs to prevent fraud and abuse, keep the site secure and fix errors.
• To meet our legal duties (legal obligation): keeping payment, payout and tax records, and answering lawful requests.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time. See “Your rights” below.

Who we share it with

Creators you give to. A creator sees you in their sponsor list and in the email telling them about your gift: your name if you gave one (otherwise “A sponsor”), whether your gift is monthly or one-time, the amount and the date it started. They also see your note. The list is not public.

Everyone, for creators. Your page is public. Anyone can see your name, handle, photo, mission, links, verse and story. The categories, denomination and content types you choose help people find you in the directory. Your updates go to your sponsors. Your community link is shown only to people who have given to you.

Our service providers. These companies process data for us to provide their service:

• Stripe: payments, payouts and creators’ identity checks
• Clerk: sign-in, including Google sign-in
• Resend: sending email
• PostHog: product analytics
• Google: the fonts in the card form at checkout, on the email unsubscribe page and in our emails. Your browser or email app fetches them from Google, which sees your IP address
• Netlify: website hosting
• Amazon Web Services: our servers, database and uploaded images, in the United States (us-east-2)

Stripe and Google also use some data for their own purposes, under the Stripe Privacy Policy and the Google Privacy Policy.

When the law requires it. We share information when we are legally required to.

We do not sell your personal information, and we do not share it with advertisers or ad networks.

Cookies and similar technologies

Cookies and browser storage are small pieces of information saved in your browser. We use them like this:

• Essential: Clerk’s session cookies keep you signed in, and its security cookies help it block bots. Your checkout basket (the creators, the amounts and any note you add) is saved in your browser’s local storage so it is still there if you reload the page.
• Preference: the sw_variant cookie remembers which version of the site’s wording you saw. It lasts 30 days.
• Analytics: PostHog’s cookie and local storage, and a session-storage entry that remembers the first page of your visit and how you arrived. See “Analytics” below.

We do not use advertising cookies.

There is no cookie banner. You control cookies in your browser: you can block them, delete them, or browse in a private window. Your browser’s help pages explain how, and many browsers can also block trackers.

If you block essential cookies or storage, sign-in and checkout will not work.

Analytics

We use PostHog to understand how SpreadWord is used. It records page views and actions in the product, such as searches, the steps of giving, and actions in the creator dashboard. With these it records the page you arrived on, the site or campaign link that sent you, and whether you are on a computer or a phone. It also records your browser, device and screen size, and page-speed timings (how fast pages load and respond). As with any website, it receives your IP address.

Search terms you type into the public directory are recorded, so we can see what people look for.

PostHog never records the text of notes, updates, messages, stories or verses. It does not record email addresses, names, card details or community link URLs.

Session recording, automatic click capture and heatmaps are turned off.

PostHog recognises your browser by a random identifier. After you sign in, it uses your internal SpreadWord user id, not your email.

PostHog is the only analytics on SpreadWord. There are no advertising tags or pixels, and nothing you do here is used for ads.

To limit analytics, block cookies and scripts from PostHog in your browser, or use a browser or extension that blocks trackers.

International transfers

Your information is processed in the United States. If you live outside the United States, for example in the EU or the UK, it is transferred there. Where the law requires it, we rely on standard contractual clauses or equivalent safeguards for these transfers.

How long we keep it

We keep your account data while your account exists.

When you delete your account, we remove your name and email from it and close your sign-in. We also remove your email address from our records of the emails we sent you and of your checkouts, the name you gave at checkout, and the notes you wrote. If you are a creator, your page, profile, photo, links, community link and updates are removed too.

We keep:

• payment, gift, payout and tax records, for as long as the law requires (generally up to 7 years): which creator was given how much and when, the copies of Stripe’s payment messages to us, which include your email address, and your Stripe customer record, which Stripe keeps with your email address as the record of your payments;
• if you are a creator, your handle, which stays reserved so nobody else can take over your old links, and your Stripe account, so money you have earned still reaches you;
• server logs, which we keep on our servers for as long as we need them to run and secure SpreadWord;
• contact messages, for as long as we need to answer them, and then as a record of what was said.

Emails we have already sent stay in the inbox they went to, for example a note in the email telling a creator about your gift.

Analytics data is kept by PostHog for the period set in our PostHog settings.

Security

Your information is encrypted in transit, and access to it is limited to the people who need it to run SpreadWord. Payment card data is held by Stripe, not by us.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities where the law requires.

Your rights

Wherever you live, you can change your name, email and email preferences in Account, and delete your account there. Creators can edit their page in their dashboard.

If you are in the EU, the UK or a country with similar laws (GDPR and UK GDPR), you have the right to:

• access the personal information we hold about you;
• correct it if it is wrong;
• have it deleted;
• receive it in a common format, or have it sent to another service (portability);
• object to our use of it where we rely on legitimate interests;
• restrict our use of it while a concern is looked into.

You can also complain to a data protection supervisory authority, such as the one where you live or work, or the Information Commissioner’s Office in the UK. We would welcome the chance to help first.

If you live in California, the CCPA and CPRA give you the right to:

• know what personal information we collect, use and disclose;
• have it deleted;
• have it corrected;
• not be treated differently for using these rights.

We do not sell your personal information or share it for targeted advertising, so there is nothing to opt out of.

If you live in another US state with a privacy law, you may have similar rights, and you can use them in the same way.

To use any of these rights, use the form at spreadword.org/help or email support@asaplinks.com. We answer within 30 days. We may ask you to confirm it is you, for example by writing from the email on your account. Someone you authorise can also ask on your behalf.

Children

SpreadWord is not for children under 13, and we do not knowingly collect personal information from them. You must be 18 or older, or the age of majority where you live, to give, and 18 or older to create a page.

If you believe a child under 13 has given us personal information, contact us through spreadword.org/help and we will delete it.

Changes to this policy

We may update this policy when SpreadWord changes or the law requires it. The date at the top shows when it last changed. If a change is significant, we will tell you before it takes effect, by email or on the site.

Our Terms explain the rules for using SpreadWord.

Contact

For questions about this policy or your information, use the contact form at spreadword.org/help, or email support@asaplinks.com.

Vanette’s Place Global LLC, 2810 N Church St PMB 607081, Wilmington, Delaware 19802-4447, United States.