Privacy Policy

We ask that you read this privacy policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.

The Service was previously known as Metro Retro until August 4th 2025. References to Metro Retro in legacy communications or materials may still appear.

Who we are

This website is operated by Deqo Software Ltd (11594409) trading as Spreo. We are a software product company based in the UK making tools to enhance team productivity.

We collect, use and are responsible for certain personal information about you. When we do so we are regulated under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

When we are the controller and when we are a processor

We are the controller of the personal information described in this policy: your account details, how you use our website and service, your conversations with our support team, your billing details and your marketing preferences. That means we decide how and why it is used, and we are responsible for it.

When an organisation uses Spreo, the content its people add to boards (notes, comments, images, votes and actions, and any personal information in them) is processed by us on that organisation’s behalf. For that content the organisation is the controller and we are its processor, and our Data Processing Agreement sets out how we handle it. If you have a question about personal information in an organisation’s boards, please contact that organisation. If you contact us instead, we will pass your request on to them.

What this policy covers

This privacy policy relates to your use of our website, spreo.io, and of the Spreo service.

Throughout our website we may link to other websites owned and operated by certain trusted third parties to provide users with support features and analytics for our website. These other third party websites may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other third party websites, please consult their privacy policies as appropriate.

Our collection and use of your personal information

We collect personal information from you either directly, such as when you register with us or contact us or indirectly, such as your browsing activity while on our website (see ‘Cookies’ below), or if such is contained in any of your Notes.

The personal information we collect about you depends on the particular activities carried out through our website. This information includes:

• your name and email address

We use this personal information to:

• create and manage your account with us
• provide goods and services to you
• notify you of any changes to our website or to our services that may affect you
• improve our services

This website is not intended for use by children and we do not knowingly collect or use personal information relating to children.

Our legal basis for processing your personal information

When we use your personal information we are required to have a legal basis for doing so. There are various different legal bases on which we may rely, depending on what personal information we process and why.

The legal bases we rely on are:

• running your account and providing Spreo, including the service emails we send through Mailgun: contract
• billing through Paddle: contract, andlegal obligation for the tax and accounting records we must keep
• in-app support through Intercom: contract for answering your questions, and your consent for Intercom’s cookies, which load only after you accept them in our cookie banner
• product and website analytics through PostHog and Google Analytics: yourconsent, given in our cookie banner
• marketing emails through EmailOctopus: your consent, given when you register, which you can withdraw at any time
• keeping Spreo secure and preventing misuse:legitimate interests
• responding to lawful requests from authorities:legal obligation

Who we share your personal information with

We routinely share your email address and name with our support tool provider Intercom and our email service providers Mailgun and EmailOctopus. This data sharing enables us to send transactional emails via Mailgun and marketing emails to opted in users via EmailOctopus, plus the ability to offer support to users via Intercom. Some of these third party recipients may be based outside the United Kingdom and European Economic Area — for further information including on how we safeguard your personal data when this occurs, see ‘Transfer of your information out of the UK and EEA’.

The companies that process personal data for us are listed on ourSub-processors page, and the terms on which we process personal data for our customers are set out in ourData Processing Agreement.

We will share personal information with law enforcement or other authorities if required by applicable law.

We will not share your personal information with any other third party.

Transfer of your information out of the UK and EEA

We are based in the United Kingdom (UK), and our team may access personal information from there. The European Commission has decided that the UK provides an adequate level of protection for personal data.

Your account details and board content are stored in the European Union. Some of the companies that process personal data for us do so outside the UK and the European Economic Area (EEA), mainly in the USA. They include Intercom, which provides our in-app support. Each one is listed, with where it hosts data, on ourSub-processors page.

When personal information is transferred outside the UK and EEA, it is protected by one of the safeguards that data protection law allows: an adequacy decision (for example the EU–US Data Privacy Framework, where the company receiving the information is certified under it), or the standard contractual clauses approved by the European Commission, together with the UK International Data Transfer Addendum where the UK GDPR applies. To ask for a copy of the safeguards for a particular company, email us at contact@spreo.io. Intercom explains its own approach here:https://www.intercom.com/help/en/articles/1385437-how-intercom-complies-with-gdpr

See ‘Cookies and other tracking & analytics technologies’ for details of the information submitted to Intercom. You may opt-out of having this information collected or submitted to Intercom; to do so please contact us at contact@spreo.io.

If you would like further information please contact us (see ‘How to contact us’ below). We will not otherwise transfer your personal data outside the UK and EEA or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.

Cookies and other tracking & analytics technologies

A cookie is a small text file which is placed onto your device (e.g. computer, smartphone or other electronic device) when you use our website. We only use strictly necessary cookies within our service to maintain a users logged in session. Once this session expires or a user logs out then the cookie is removed. However, Spreo does utilise third party analytics tools (see below) and Google, GitHub and Slack social login integration which also use cookies. If you would like information on how they use cookies, please refer directly to their websites. Additionally, you can find further information on how third parties and your browser may use cookies here:aboutcookies.org.

We use analytics tools to gather user information whilst they use the service. This is to allow the Spreo team to analyse how, when and why you use the service in an attempt to improve and innovate the product.

In particular, we provide a limited amount of your information (such as sign-up date and some personal information like your email address) to Intercom, Inc. (“Intercom”) and utilize Intercom to collect data for analytics purposes when you visit our website or use our product. As a data processor acting on our behalf, Intercom analyzes your use of our website and/or product and tracks our relationship by way of cookies and similar technologies so that we can improve our service to you. For more information on Intercom’s use of cookies, please visit https://www.intercom.com/terms-and-policies#cookie-policy. We may also use Intercom as a medium for communications, either through email, or through messages within our product(s). As part of our service agreements, Intercom collects publicly available contact and social information related to you, such as your email address, gender, company, job title, photos, website URLs, social network handles and physical addresses, to enhance your user experience. For more information on the privacy practices of Intercom, please visit https://www.intercom.com/terms-and-policies#privacy. Intercom’s services are governed by Intercom’s terms of use which can be found at https://www.intercom.com/terms-and-policies#terms. If you would like to opt out of having this information collected by or submitted to Intercom, please contact us:contact@spreo.io.

Marketing

We would like to send you information about products and services which may be of interest to you. Where we have your consent, we may do this by email.

We will only ask whether you would like us to send you marketing messages when you tick the relevant boxes upon registration.Click here to see what this form looks like and review your preferences.

If you have previously agreed to being contacted in this way, you can unsubscribe at any time by:

• contacting us at contact@spreo.io
• using the ‘unsubscribe’ link in emails
• updating your marketing preferences here /account

It may take up to 7 days for this to take place.

For more information on your rights in relation to marketing, see ‘Your rights’ below.

Your rights

Under the General Data Protection Regulation you have a number of important rights free of charge. In summary, those include rights to:

• fair processing of information and transparency over how we use your personal information
• access to your personal information and to certain other supplementary information that this Privacy Notice is already designed to address
• require us to correct any mistakes in your information which we hold
• require the erasure of personal information concerning you in certain situations
• receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations
• object at any time to processing of personal information concerning you for direct marketing
• object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
• object in certain other situations to our continued processing of your personal information
• otherwise restrict our processing of your personal information in certain circumstances
• claim compensation for damages caused by our breach of any data protection laws

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please email us at contact@spreo.io from the email address on your Spreo account and tell us what your request is about, including any account or reference numbers if you have them. If you write from a different address, we may ask you to confirm details of your account so we know the request comes from you. We only ask for what we need to confirm your identity. We will reply within one month.

How long we keep your personal information

We do not yet delete accounts or boards automatically. Your data stays until it is deleted:

• You can delete your account from your account page, and board owners can delete their boards at any time.
• If a trial ends without a subscription, the account and its boards stay. We do not delete them after a set time.
• If a paid subscription is cancelled, its data stays unless the customer asks us to delete it. If they do, we delete it no later than 30 days after the cancellation, or within 30 days of the request if they ask later.

Deleted data is overwritten in our backups within 7 days. We keep your marketing preferences until you unsubscribe.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

You can read more about how we keep your personal information secure on our Security page.

How to complain

We hope that we can resolve any query or concern you raise about our use of your information.

The General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority, in particular in a European Economic Area state or in the United Kingdom if you work, normally live or if any alleged infringement of data protection laws occurred in the relevant state. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone: 0303 123 1113.

Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website:https://app.prighter.com/portal/18060012132

Changes to this privacy policy

This privacy policy was published on 29th April 2019 and last updated on 19th October 2026.

We may change this privacy policy from time to time, when we do we will inform you via a pop up on service entry to reconfirm acceptance to the change in terms and policies.

How to contact us

Please contact us at contact@spreo.io if you have any questions about this privacy notice or the information we hold about you.