Legal

Privacy Policy

Last Updated: 22 September 2026 | v1

1. Roles and Responsibilities

Spike Studio, Inc., a Delaware corporation ("Spike," "we," "us") acts as a data controller for account administration, billing, fraud detection, security, and marketing communications, and as a data processor for User Content processed on behalf of business Customers under the Data Processing Agreement referenced in the Business Terms of Service. The Service is offered to businesses; see the Business Terms for the business-use scope.

2. Personal Data We Collect

"Personal Data" means information relating to an identified or identifiable natural person. We do not intentionally collect special-category data and ask that Customers not submit it to the Service except where lawfully permitted and necessary.

2.1 Information you provide. Account and profile information (name, email, organization); subscription and billing details; support requests; and User Content you or your Users submit to the Service (documents, messages, prompts, code, and files you choose to bring into a workspace).

2.2 Information collected through use of the Service. Device and installation information (OS, app version); basic usage and diagnostic telemetry (e.g., crash reports, feature-usage counts) where enabled; and, for the multiplayer edition, sync metadata needed to keep workspaces consistent across devices and team members.

2.3 Local-first data. In the single-player edition, Spike is designed to keep your Workstore, workspace documents, and agent session history on your own device by default. We do not receive this data unless you explicitly enable a feature that transmits it (for example, opting in to send diagnostics, or upgrading to a multiplayer workspace that syncs to our cloud infrastructure).

2.4 Information from other sources. If you sign in via a third-party identity provider or connect a Connected App (e.g., a calendar, mail account, source-control host, or MCP server), we receive the information that connection is scoped to share, as configured by you.

3. Where Your Information Is Stored and Processed

Single-player-edition data is stored locally on your device. Multiplayer-edition data, account/billing data, and any diagnostics you opt in to are stored on cloud infrastructure operated by us and our Sub-Processors, listed in the Subprocessor List. Where we transfer Personal Data internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses) as required by applicable law.

4. How We Use Your Personal Data

We use Personal Data to: provide, maintain, and improve the Service; manage accounts and process payments; monitor usage and diagnose issues; facilitate Connected Apps you configure; respond to support requests; comply with legal obligations; and secure the Service against fraud and abuse. We do not engage in automated decision-making that produces legal or similarly significant effects on individuals without human involvement.

5. AI Data Processing

The Service uses AI models to help draft, summarize, extract, and act on content at your direction. In the single-player edition, Customer connects its own AI provider (Bring-Your-Own-Agent); that provider processes the content Customer sends to it directly, under that provider's own terms and privacy policy, which Spike does not control. In the multiplayer edition, or where Spike otherwise provides AI access, User Content may be sent to third-party model providers listed in the Subprocessor List; we seek to disable data retention and model-training on Customer content by those providers where the provider supports it. We do not use Customer User Content to train Spike's own models, or any third party's models, unless Customer expressly opts in in writing.

6. Lawful Bases for Processing (EEA/UK/Switzerland)

Where GDPR or the UK GDPR applies, we process Personal Data on the following bases: performance of a contract; our legitimate interests (e.g., securing and improving the Service), subject to your right to object; compliance with legal obligations; and consent, where required (e.g., for optional diagnostics or marketing). Business Customers are responsible for determining the appropriate lawful basis for any personal data they choose to process through the Service, including data belonging to their own end users or contacts.

7. How We Share Your Information

We do not sell Personal Data and do not share it for cross-context behavioral advertising. We share Personal Data with: service providers and Sub-Processors who help operate the Service; Connected Apps you configure; AI providers as described in Section 5; law enforcement or regulators where required by law (with notice to you where legally permitted); and successors in a merger, acquisition, or asset sale. All Sub-Processors are contractually bound to appropriate data-protection obligations.

8. Data Storage, Retention, and Security

We retain account and billing data for as long as needed for the purposes described above and as required by law (billing records are typically retained for at least 7 years). Single-player-edition User Content stays under your control on your device and is retained or deleted according to your own actions. Multiplayer-edition User Content is retained per the DPA and deleted within a reasonable period after termination, subject to backup rotation. Diagnostic logs, where enabled, are retained for a limited period (e.g., 90 days). We use industry-standard technical and organizational measures, including encryption in transit, access controls, and monitoring, as further described in the DPA.

9. Your Data Protection Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your Personal Data, to object to certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority (EEA/UK/Switzerland), or to access, delete, correct, and opt out of the sale/sharing of Personal Data or profiling (certain U.S. states). To exercise these rights, contact us at privacy@spike.app. We will respond within the time required by applicable law (typically 30 days).

10. Notices to Third Parties

Where a business Customer directs the Service to process Personal Data about the Customer's own contacts, employees, or end users, the Customer — as controller of that data — is responsible for providing any required notices to those third parties (e.g., under Articles 13–14 GDPR). Spike will provide reasonable assistance as described in the DPA.

11. Anonymized, Aggregated, and De-Identified Data

We may create anonymized or aggregated data that does not identify any individual and use it for Service improvement and product development. Once data is irreversibly anonymized consistent with applicable regulatory guidance, it is no longer Personal Data and falls outside this Policy.

12. Website Analytics

When you visit our website (as opposed to using the Service), we use Vercel Web Analytics, a cookieless, privacy-first analytics tool provided by our hosting provider, Vercel Inc., to understand aggregate traffic — page views, referring sites, and general visitor counts. This tool does not use cookies, does not use any cross-site or persistent identifier, and does not collect or store Personal Data capable of identifying an individual visitor. Because no cookies or comparable tracking technologies are used, no cookie-consent banner is required under applicable law (e.g., the EU ePrivacy Directive, UK PECR). If we later add analytics, advertising, or marketing tools that do use cookies or similar tracking technologies, we will update this section and implement a cookie-consent mechanism before doing so.

12a. Mailing List

If you submit your email address through the subscribe form on our website, we use it only to send occasional product updates. The list is operated on our behalf by Buttondown (Buttondown, LLC, United States), which acts as a Sub-Processor; your address is stored on its systems and is subject to its privacy policy in addition to this one.

Subscription is double opt-in: submitting the form sends you a confirmation email, and you are not added to the list until you click the link in it. Where consent is the lawful basis (EEA/UK/Switzerland), that click is the consent. Every email we send carries a one-click unsubscribe link, and you may also withdraw consent at any time by writing to privacy@spike.app. Withdrawing does not affect the lawfulness of processing before withdrawal.

We do not sell or share this address, use it for any purpose other than the updates described, or add an address to the list that did not confirm it.

13. Children's Privacy

The Service is not directed to, and is not intended for use by, anyone under 18. We do not knowingly collect Personal Data from children and will delete such data if we become aware of it. Users must not direct the Service to process data relating to children.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes that reduce your rights or expand our processing will be communicated with at least 30 days' advance notice via email or in-product notification.

15. Contact

Email: privacy@spike.app (general/legal: info@spike.app) Security concerns: security@spike.app