Privacy Policy

Who is responsible for your data

Spoto is responsible for deciding how personal information is used in the service. You can send a privacy request through our legal notice form. We may ask for information needed to confirm your identity before completing a request.

Information we collect

We collect information you provide, information created when you use Spoto, and limited technical information needed to operate and protect the service.

• Account information: name, email address, profile image, verification status, authentication records, security settings, and account preferences.
• Community activity: spots, map coordinates, captions, tags, photos, videos, comments, follows, likes, saves, ratings, collections, reports, and appeals.
• Product activity: aggregate destination selections, map opens, spot views, subscription-preview visits, interest responses you explicitly submit, and whether a signed-in account returns on different days. Search text and viewed coordinates are not stored in analytics events.
• Technical information: IP address, request time, browser and device details, security events, rate-limit records, cookies, and diagnostics.
• Location information: a device location only after browser permission, a location you search for, or coordinates you choose when publishing a spot.
• Messages to us: contact details and information included in legal notices, safety reports, appeals, or support requests.

Why we use information

We use information only for defined service, safety, communication, and legal purposes.

• Create and secure accounts, maintain sessions, and provide two-factor authentication.
• Publish content to the audience you choose and operate maps, search, saves, collections, and community features.
• Personalise discovery using choices and activity associated with your account or device.
• Detect abuse, enforce rate limits, investigate reports, keep audit records, and protect people and the service.
• Send verification, security, service, and requested communications.
• Comply with legal obligations and establish, exercise, or defend legal claims.

Legal bases in the EEA and UK

We rely on the legal basis appropriate to each purpose. Account and core feature data is generally processed to perform our agreement with you. Security, abuse prevention, product reliability, and proportionate service improvement rely on our legitimate interests. Legal records may be processed to meet legal obligations. Device location and optional personalization rely on your choice or consent where required.

• You can withdraw consent at any time without affecting processing that occurred before withdrawal.
• Where we rely on legitimate interests, you may object and we will consider your circumstances and our reasons for processing.
• We do not use sensitive personal information for advertising.

Public content and location

Public profiles and published spots can be viewed, shared, indexed, or copied by others. A precise map pin can reveal where media was created or where a person spends time. Review the audience and location before publishing.

• Drafts and private collections are not displayed publicly.
• Deleting content removes it from normal public access, but copies may temporarily remain in backups or with people who previously shared it.
• Remove unnecessary metadata from media and avoid publishing another person’s private location without permission.

Service providers and disclosures

Specialist providers process limited information for Spoto under their own security and data-protection commitments.

• Vercel hosts the application and media storage; Neon provides the database.
• Cloudflare Turnstile helps detect automated abuse on protected forms.
• OpenFreeMap and MapLibre deliver map tiles and map rendering; Geoapify or another configured place provider may process search text and approximate map areas.
• Resend delivers account verification and other service email when email delivery is enabled.
• We may disclose information when required by law, during a corporate transaction, or when reasonably necessary to protect people, rights, and service integrity.
• Where information is transferred internationally, we use an applicable adequacy decision, contractual safeguards, or another lawful transfer mechanism.

How long we keep information

We keep information for the shortest period reasonably needed for its purpose. Account content is generally retained while your account is active. After deletion, some records may remain for a limited period in backups, security logs, fraud-prevention records, reports, or legal files where deletion is not immediately possible or would undermine a legal obligation or valid claim.

• Session and verification records expire or rotate according to their security purpose.
• Product analytics events are deleted after 180 days.
• Temporary map results and analytics deduplication markers are stored in the browser session and disappear when that session data is cleared.
• We periodically review retention needs and delete or anonymise information that is no longer required.

Cookies and device storage

Spoto uses essential storage for authentication, security, and settings you request. Optional destination-history storage is created only after you allow homepage personalization. We do not currently use advertising cookies or cross-site tracking.

• You can change personalization or clear non-essential device data from the Cookie Policy.
• Blocking authentication cookies prevents signed-in features from working.
• If analytics or marketing tools are introduced, they will remain blocked until any legally required consent is obtained.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your information, and to object to certain processing. You can export or delete your account in Account settings and submit other requests through the legal notice form.

• Change or remove location permission in your browser or device settings.
• Change spot visibility and location precision when creating or editing content.
• Complain to your local data-protection authority. In the EEA, you may contact the authority where you live, work, or believe an infringement occurred.
• Appeal eligible content-moderation decisions using the appeal form.

Recommendations and automated tools

Spoto may use automated signals such as distance, price, opening schedule, ratings, freshness, saves, category, trust, and quality to order recommendations or flag suspicious activity. These systems do not make decisions that produce legal or similarly significant effects about you. Material moderation decisions can be reviewed through the appeal process.

Security

We use access controls, encrypted connections, rate limits, account verification, optional two-factor authentication, upload validation, audit records, and security monitoring to protect information. No online service can guarantee absolute security, so protect your password and report suspected account access promptly.

Children

Spoto is not intended for children under 16. We do not knowingly allow accounts for children below the age at which they can lawfully consent to the relevant data processing. A parent or guardian can use the legal notice form to request review or deletion.

Contact and policy changes

Use the legal notice form for privacy questions or rights requests. If this policy changes materially, we will provide reasonable notice in Spoto or by email when appropriate and update the date at the top of this page.