Spiral Privacy Policy

This Privacy Policy explains how Spiral Ad, Inc. (“Spiral,” “we,” “us”) collects, uses, shares, and protects personal data when you visit spiral.ad or use our products and services. Capitalized terms not defined here have the meanings in our Terms of Use at spiral.ad/legal/terms.

1.  Who We Are and Scope

This Policy applies to visitors of spiral.ad and to all users of our products, including self-serve plans (Launch and Grow) and Scale. If this Policy conflicts with a signed MSA or DPA for a Scale customer, that agreement controls for that customer.

Roles.  When we handle Customer Personal Data to provide the Services to your workspace, we act as your processor. When we handle Service and Usage Data — such as telemetry, logs, and security signals — to operate, secure, and improve the Services, we act as an independent controller.

2.  What We Collect

• Account and billing data.  Name, email, team or workspace info, plan tier, and settings. Payments are processed by Stripe, our payment service provider.
• Customer Data and Outputs.  Assets, prompts, references, and other content you submit, and the creatives and other outputs the Services generate for you.
• Service and Usage Data.  Events, device and browser data, IP address, timestamps, performance metrics, error logs, security and fraud signals, and feature usage.
• Cookies and similar technologies.  Pixels, SDKs, and cookies for essential functions, analytics, security, and where permitted, marketing and retargeting.
• Ad platform data.  Connecting an advertising account is optional. We recommend it to get the most out of Spiral, but the core product works without it. If you do connect an account (such as Meta Ads), we collect OAuth access tokens, account and campaign settings, performance data, creative data, audience and targeting information, and spend data. We request only the scopes needed to analyze performance and publish ads you approve.

3.  How We Use Your Data

Provide the Services. Creative generation, workspace management, support, and billing. Legal bases: contract, legitimate interests.

Operate and secure the Services. Fraud prevention, abuse detection, incident response, diagnostics, and availability. Legal bases: legitimate interests, legal obligation.

Improve the Services. Quality, safety, reliability, and product analytics. Legal basis: legitimate interests.

Communicate with you about service messages and product updates. Legal bases: contract, legitimate interests.

Run marketing where permitted. Legal bases: consent, legitimate interests.

Model training.  We may use Customer Data and Outputs in aggregated or de-identified form to develop, train, and improve our own models and analytics. This use is internal to Spiral. We do not intentionally include your identifiable Customer Data in outputs for other customers.

De-identified and aggregated data.  We may create, use, and retain de-identified or aggregated data for security, analytics, benchmarking, and improving the Services. We will not attempt to re-identify such data.

4.  Sharing and Disclosure

We share personal data with:

• Service providers acting as subprocessors for hosting, storage, analytics, support, messaging, and payments. Our subprocessor list is available on request at support@spiral.ad.
• Advertising and analytics partners for targeted advertising where permitted, as described in Sections 6 and 7.
• Platform providers when you connect integrations and as you direct.
• Legal or safety recipients when required by law or to protect rights, safety, and security.
• Parties to a business transfer such as a merger or acquisition.

We do not sell personal data for money. Some United States laws define sharing for targeted advertising, and we may share personal information for that purpose as described in Section 7.

5.  International Data Transfers

We operate globally. When personal data is transferred internationally, we use approved safeguards including the EU Standard Contractual Clauses, the UK Addendum, and the Swiss Addendum. Spiral is not currently enrolled in the EU–US Data Privacy Framework.

6.  Cookies and Tracking

We use cookies and similar technologies for essential functions, analytics, security, and where permitted, marketing and retargeting.

Consent in the EEA, UK, and Switzerland.  We ask for consent for non-essential cookies in these regions. You can change your preferences at any time using the Manage Cookies control in the product.

Global Privacy Control.  We honor Global Privacy Control signals where applicable.

7.  Your Privacy Rights

This section also serves as our Do Not Sell or Share My Personal Information notice for United States visitors.

Targeted advertising.  We may share personal information such as online identifiers with advertising partners for targeted ads. You can opt out at any time by emailing support@spiral.ad with the subject line “Do Not Sell or Share.” We also honor Global Privacy Control signals where applicable.

Revoke platform access.  You may revoke Spiral’s access to any connected advertising account at any time through that platform’s settings. After revocation, we stop syncing new data and follow our retention schedule for any cached data.

Marketing emails.  You can opt out of marketing emails through unsubscribe links or in your account settings. We will still send service and transactional emails.

Region-specific rights.

• GDPR, UK, and Swiss: access, correction, deletion, portability, restriction or objection, and lodging a complaint with a supervisory authority.
• US state rights: access, deletion, correction, portability, and opt out of sale, sharing, or targeted advertising.

Submit requests through the Privacy Choices control in the product or by emailing support@spiral.ad. We may need to verify your identity. For some US states we accept authorized agent requests.

8.  Data Retention

Customer Data and Outputs.  When you delete them or close your account, we delete from active systems within 30 days and from backups within 90 days, unless retention is required by law, security, or billing purposes.

Ad platform data.  Retained for as long as your account is active and for up to 30 days after account termination, consistent with the general retention timelines in this Policy.

Service and Usage Data and security logs.  Retained for 180 days, or longer if needed for security or incident response, then deleted or de-identified. We may keep de-identified or aggregated data indefinitely.

9.  Security

We use industry-standard technical and organizational measures, including encryption in transit and at rest, access controls, logging and monitoring, backups, and a secure development lifecycle. If we confirm a data breach likely to pose a risk to individuals, we will notify affected users within 72 hours and cooperate with required regulatory notifications.

10.  Children

The Services are not for individuals under 18. We do not knowingly collect data from children.

11.  Data Processing Addendum

When we process Customer Personal Data on your behalf, the Spiral DPA applies and is incorporated by reference. For Launch and Grow, the DPA is accepted during sign-up or available at spiral.ad/legal/dpa. For Scale, your signed MSA or DPA governs and controls in case of conflict.

12.  Changes

If we make material changes that reduce your rights, we will provide at least 30 days’ advance notice by email or in-product. Continued use after changes take effect means you accept the updated Policy.

13.  Contact

Spiral Ad, Inc.

Website: spiral.ad
‍Email: support@spiral.ad
Address: 1111B South Governors Ave STE 37149, Dover, DE 19904, USA