SpreadSpaceSpreadSpace

Privacy Policy

Download PDF
Version 1.0 · Effective July 1, 2026

This Privacy Policy describes how DocDissect, LLC, doing business as SpreadSpace ("SpreadSpace," "we," "us"), collects, uses, and discloses information in connection with spreadspace.app, our related websites, and our financial document extraction and analytics services (collectively, the "Service"). Any capitalized terms used and not defined in this Policy have the meaning given to them in the Master Service Agreement. If you do not agree with this Policy, you should not use the Service. Where required under applicable law, we will separately seek appropriate consent to the collection, use, and disclosure of certain types of Personal Information.

About Our Services

Our Service may require registering as a user on our system; other Service may involve certain fees or require separate agreements between you and SpreadSpace. Please reference our Master Service Agreement for more information on your rights as a user.

This Policy applies to visitors to our websites and to individuals who access the Service under an account held by one of our customers (typically a bank, credit union, other commercial lender, or other entity or individual each a "Customer").

We act in two distinct roles:

  • Controller. For information about website visitors, Customer account users, and billing contacts ("Account Data"), we determine how and why the data is processed.
  • Processor / Service Provider. For financial documents and derived data that Customers submit to the Service — including bank statements, tax forms, and borrower-prepared financial statements ("Document Data") — we process solely on the Customer's behalf and under its instructions, as set out in our agreement with that Customer.

If you are a borrower or loan applicant, or other third party whose documents or account data were submitted to SpreadSpace by a Customer, that Customer is responsible for the collection of your information and is your point of contact for privacy questions or requests. We will assist Customers in responding to such requests as required by our agreements and applicable law.

Account Data. Name, work email address, role/title, organization, and authentication data (managed through our identity provider).

Billing Data. Plan, usage records, and payment status. Payment card details are collected and processed directly by our Payment Processors (for example, Stripe); we do not store full card numbers.

Usage Data. Log data, device and browser information, IP address, pages viewed, features used, and diagnostic data generated by your use of the Service.

Support Communications. Information you provide when you contact us.

Document Data. Financial documents and the structured data extracted or derived from them, submitted by Customers through the Service. Document Data may contain personal information, including names, addresses, Social Security numbers or other taxpayer identification numbers, account numbers, and transaction details. Customers may also submit structured data they have exported from third-party financial Data Aggregators (for example Plaid); data may be received directly from the Data Aggregators, and the Customer's relationship with the aggregator governs its collection from the borrower. We collect Document Data directly from Data Aggregators only from or at the direction of our Customers.

We use information to:

  • Provide, operate, secure, and support the Service;
  • Process documents and connected account data, and generate extractions, spreads, enrichments, and analytics at the Customer's direction;
  • Meter usage and administer billing;
  • Monitor, detect, and prevent fraud, abuse, and security incidents;
  • Improve and develop the Service, including improving extraction accuracy;
  • Create De-identified Data as described in Section 4;
  • Comply with legal obligations.

AI processing. Portions of the Service use machine-learning models, including large language models, to process documents. Model inference runs within our AWS environment through Amazon Bedrock; document data is not transmitted to the model developer, is not retained by the model service, and is not used to train generalized AI models.

We may create de-identified, anonymized and/or aggregated data from information processed through the Service (collectively "De-identified Data"), including Document Data, in accordance with applicable law and our Customer agreements. De-identified Data does not identify, and cannot reasonably be linked to, any Customer, borrower, or individual, or other third party. We may use De-identified Data for any lawful purpose, including producing industry statistics and benchmarks. We commit to maintaining such data in de-identified form, not to attempt to re-identify it, and to require the same of any recipient.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We disclose information only:

  • To subprocessors that support the Service — including Cloud Infrastructure and AI Inference Providers (for example, Amazon Web Services, including Amazon Bedrock), Edge Network and Security Providers (for example, Cloudflare), Web Application Hosting Providers (for example, Vercel), Identity and Authentication Providers (for example, WorkOS) — under contracts limiting their use of the data to providing services to us. A current subprocessor list is available at https://spreadspace.app/legal/subprocessors.
  • To the Customer that controls the relevant account or submitted the relevant Document Data.
  • For legal reasons, where required by law, subpoena, or to protect rights, safety, or the integrity of the Service.
  • In corporate transactions, such as a merger, acquisition, asset sale, financing, or capital raising, in which case information may be transferred as part of the transaction, subject to this policy. We may also share aggregated, non-identifiable metrics regarding usage, volume and extraction performance with prospective investors or acquirers in connection with diligence, under confidentiality obligations.

Our websites may also include embedded third-party features — such as Scheduling Services (for example, Calendly) and payment elements associated with Payment Processors — that collect information directly from you under their own privacy policies when you interact with them.

We maintain administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, network isolation, and logging and monitoring. Our security program is aligned with the SOC 2 Framework. When we process nonpublic personal information on behalf of financial institution Customers, we do so consistent with the confidentiality and safeguards obligations in our agreements with those Customers.

We retain Account Data for the life of the account and as needed thereafter for legal, billing, and security purposes. We retain Document Data in accordance with our Customer agreements and the Customer's instructions, and delete or de-identify it following termination and any contractual export window, subject to legal retention requirements and backup cycles.

Depending on your state of residence, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to appeal a decision on such a request. To exercise rights regarding Account Data, contact us at privacy@spreadspace.app. To exercise rights regarding Document Data, contact the Customer that collected your information; we will support their response as their service provider. We do not discriminate against anyone for exercising privacy rights.

We use cookies and similar technologies that are strictly necessary for the Service to function (such as authentication and session management) and limited product analytics to understand how the Service is used. We do not use advertising or cross-site tracking cookies.

The Service is a business tool intended for users 18 and older. We do not knowingly collect information from children.

We are based in the United States, and information is processed and stored in the United States. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S.

We may update this Policy from time to time. We will post the updated version with a revised effective date and, for material changes, provide notice through the Service or by email.

DocDissect, LLC (d/b/a SpreadSpace)
privacy@spreadspace.app