Privacy Policy
Effective September 29, 2026
We use the information we collect to:
If you ask to receive product updates, we use your email address to send you occasional emails about new features, and we record when and where you signed up. Each email has a one-click unsubscribe link, and you can also turn updates off on your Account page. Our lawful basis is your consent (Article 6(1)(a)), which you can withdraw at any time.
We don't use your information to train AI models. We don't sell your information to third parties. We don't use your client profile information for any purpose other than delivering your briefings.
We keep your account and the work in it for as long as the account exists. That doesn't change when a subscription ends. If you cancel, if a payment fails and isn't made good, or if a pilot ends (the free access a pilot code gives, as the Terms describe), your account stays open and becomes read-only: your clients, lenses and past briefings are still there to read, export or delete, and nothing is deleted on a timer. Your data stays until the account is deleted.
You can delete your account yourself at any time from the Account page, and it happens straight away. If you're the only member of your workspace, the deletion removes your briefings, lenses and client profiles, your account settings and security codes, the workspace itself, its Stripe customer record (which cancels any subscription), and your sign-in. If you're in a shared workspace, it removes your account, your settings and your membership, but the clients, lenses, briefings and comments you created stay with the workspace, because they're the firm's work; they're no longer attributed to you. If you'd rather we did it, email hello@speider.ai and we'll delete the account within 30 days of your request, except where we're required to keep something by law or to resolve a pending dispute. Three narrow records outlive a deletion, all described below: the record of AI actions, a twelve-month security log, and a three-year record of your agreement to automatic renewal.
If you book a demo, we keep the booking and your answers so we can prepare for the call and follow up afterward. A booking isn't tied to an account and isn't deleted automatically. Email hello@speider.ai and we'll send you a copy of yours or delete it.
Uploaded documents are never written to our database. They exist only in serverless function memory for the duration of one parse call (typically under thirty seconds) and are discarded the moment that call returns.
Usage records are kept for these periods. The counters behind per-minute rate limits expire within minutes, and the counters behind the daily limits in the Terms expire after a day. A record of each AI action (your account identifier, which feature ran, how much text it processed, its estimated cost, and the time, but never what was sent or written) is kept for 13 months for cost and fair-use monitoring. After that, only monthly totals per feature are kept, with no account attached. If you delete your account, your identifier is removed from these records straight away. The security log is kept for twelve months, as described below. Our hosting and error-monitoring providers keep their own request and error logs for the periods their services set.
We keep a security log of sensitive actions for twelve months, and this outlives account deletion. The log records that an action happened, not what it concerned: an account identifier, the action (for example a data export, an account deletion, or a request for a record belonging to another account), the endpoint, and a timestamp. It never contains client names, document contents, or briefing text. We keep it because it's how we would establish what happened during a security incident, which is often discovered months after the fact, and deleting it on request would let an account erase its own trail. Twelve months after the entry is written it's deleted automatically.
We also keep a record of your agreement to automatic renewal for three years, and this outlives account deletion too. California law (Civil Code § 17600 and following, as amended by AB 2863) requires a business that bills on a recurring basis to be able to show that the subscriber agreed to it, and to hold that proof for at least three years. Under the GDPR the lawful basis is our compliance with a legal obligation, Article 6(1)(c), and Article 17(3)(b) is why it survives an erasure request.
The record is deliberately thin. It holds an account identifier, the workspace identifier, the plan and billing term you chose, the price you were shown, a reference to the exact wording you agreed to, and the moment you agreed. It doesn't hold your name, your email address, or your IP address, and it carries nothing about your clients. Three years after it's written it's deleted automatically. If you want to see yours, email hello@speider.ai.
Stored data is encrypted at rest by our database provider, and data in transit is protected by TLS. Supabase, our database and authentication provider, maintains SOC 2 Type II compliance. These are baseline infrastructure practices common to modern hosted services, not unique features of Speider.
Within Speider, access to user data is restricted by per-account database-level isolation (row-level security). No user's data is accessible to any other user. For a full description of our security architecture, see our Security page.
If you believe your account has been compromised, contact us immediately at hello@speider.ai.
Speider acts as the data controller for personal information collected directly from you in connection with operating the Service (account registration, billing, support, security, platform usage). For information you upload about your clients (counterparty names, business descriptions, regulatory exposure, contractual obligations, and similar profile data), Speider acts as a data processor on your behalf. You, as the lawyer or organization using the Service, are the controller of that data and remain responsible for compliance with your own professional and legal obligations, including rules of professional conduct governing client confidentiality.
You have the following rights with respect to personal information we hold about you:
You can exercise your right of access and data portability yourself, right now, by downloading your data from your Account page, and you don't have to ask us or wait for us to do it. For any of the other rights, email hello@speider.ai. We'll respond within 30 days, or such shorter period as required by applicable law. You may also lodge a complaint with the data protection supervisory authority in your jurisdiction.
If you're located in the European Economic Area or the United Kingdom, the legal basis for our processing of your personal information depends on the purpose:
Speider hosts its infrastructure in the United States. If you access the Service from the European Economic Area, the United Kingdom, or another jurisdiction with cross-border data transfer restrictions, your personal information will be transferred to and processed in the United States. Speider relies on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and other applicable transfer mechanisms with its subprocessors to provide appropriate safeguards for such transfers. A copy of the relevant clauses is available on request at hello@speider.ai.
Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), we disclose the following categories of personal information we have collected in the preceding 12 months:
We don't collect biometric information, audio or video recordings, education records, precise geolocation, or sensitive personal information as defined in Civil Code § 1798.140(ae) beyond what you choose to disclose. We don't sell personal information, and we don't share personal information for cross-context behavioral advertising as those terms are defined under California law.
California residents have the right to know, the right to delete, the right to correct, the right to portability, the right to limit use of sensitive personal information (not applicable to our processing), and the right to non-discrimination for exercising these rights. To submit a California privacy request, contact hello@speider.ai. You may also designate an authorized agent to submit a request on your behalf; we'll require reasonable verification of the agent's authorization.
In the event of a personal data breach that creates a risk to your rights and freedoms, Speider will notify affected users without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification will include, to the extent known, the nature of the breach, the categories of data affected, the likely consequences, and the measures we have taken or propose to take.
Speider doesn't currently process personal data at a scale or in categories that require the designation of a dedicated Data Protection Officer or appointment of an EU representative under Article 27 of the GDPR. EU and UK data subjects may direct all privacy inquiries to hello@speider.ai. If our processing scale or categories change such that designation becomes required, we'll update this Policy.
Speider is a professional research tool intended exclusively for use by adult legal professionals, paralegals, and authorized members of legal teams. The Service isn't directed at, designed for, or available to minors. We don't knowingly collect personal information from anyone under 18 years of age. If you become aware that a minor has provided personal information to Speider, contact us at hello@speider.ai and we'll delete the information promptly.
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or by posting a notice in the platform before the changes take effect. The effective date at the top of this page reflects when the current version was last updated. Your continued use of Speider after the effective date of a revised policy constitutes your acceptance of the changes.
Questions about this Privacy Policy or how we handle your data:
Questions? Email hello@speider.ai or read our Security page.
Try it free