Privacy Policy

This Privacy Policy explains how SIA SPOTY.APP ("Spoty.app", "we", "us") collects, uses, shares and protects personal data when you use the spoty.app website, the Spoty.app mobile apps for Android and iOS and the Spoty.app Telegram bots (together, the "Service"). Read it together with our Terms of Use and, if you run a business on Spoty.app, the Terms for Businesses.

1. Who we are (controller)

The controller of your personal data is SIA SPOTY.APP, registration No. 40203789400, legal address Loka maģistrāle 23-5, Jelgava, Latvia.

Contact for all questions about your data: [email protected].

2. What we collect

2.1 Your account

You can use the map without an account. If you create one, we keep:

email address and, if you give it, your name;
sign-in methods you link: Google or Apple (the account identifier and the email the provider confirms — with Apple this may be a private relay address), Telegram (your Telegram user ID and username), email codes. We store one-time email codes and links only in hashed form and they expire after 15 minutes;
phone number, only if you give it to us (for example, by sharing it in our Telegram bot) or if an invitation to manage a business was sent to it;
interface language, account status, dates of creation, last sign-in and, if you merge two accounts, a record of the merge;
active sessions: the device/browser and IP address of each signed-in session, so you can see and end them in your profile.

2.2 Favourites and notifications

the places and brands you add to favourites, and when you add or remove them;
your notification settings (which notifications you want — for example lunch, breakfast, happy hour — and your quiet hours) and a log of notifications sent to you (type, channel, time, delivery status);
for push notifications in the app: the push token of your device, platform (Android/iOS), app version and when the device was last seen.

2.3 Location

If you allow it, the website or app uses your device's location to show where you are on the map and the offers around you. Your location stays on your device: we do not send it to our servers and do not store it. The map itself is provided by Google Maps, so Google receives the area of the map being shown (see section 4).

2.4 Consents

The versions of these documents you accepted and when, and your marketing consent with the history of every change (see section 5).

2.5 Businesses

If you register or manage a business on Spoty.app, we also keep:

the business details you enter: brand, places, addresses, opening hours, phone, website, logo and, optionally, legal name, registration and VAT numbers, legal address;
your role and access to the brand, and invitations you send to other people to manage it (their email or phone number);
the offers you publish, and photos or texts of menus you send for automatic processing;
the channels you choose for business notifications (push, Telegram, email);
once paid plans are available: payer details, plans and invoices.

Actions with business access are logged for security.

2.6 Usage data

Statistics. To show businesses how many people see their places, and to improve the Service, we count page views and actions with places (shown on the map or in a list, opened, route requested, shared). For each we record the place or page, the time, the interface language, where the visit came from (for example the map, a search engine or a direct link) and a visitor code. The code is calculated from your IP address and browser for one day only and changes every day; it cannot be turned back into your IP address and is not linked to your account. We do not use Google Analytics or any other third-party analytics or advertising trackers.

Cookies and browser storage. We use only cookies that the Service needs to work: the session cookie (keeps you signed in and remembers your choices during the visit) and a security token that protects forms against forged requests. The website also remembers the last map position in your browser tab. We do not use advertising or analytics cookies, so we do not ask for cookie consent.

Server logs. Our servers keep technical logs (IP address, time, requested address, browser) for security and troubleshooting.

2.7 Content you post

When features for reviews are available: the reviews, ratings, comments, photos and suggestions you post, with the place they are about and the time, and the name shown with them.

3. Why we use it and on what legal basis

Purpose	Data	Legal basis (GDPR art. 6)
Account, sign-in, sessions, account merging and deletion	2.1	contract
Favourites and notifications you asked for (service notifications)	2.2	contract
Showing your location and offers near you	2.3	consent (device permission)
Records of accepted documents	2.4	legal obligation, legitimate interest
Marketing messages	email / push / Telegram	consent only
Business tools, verification of businesses, menu processing	2.5	contract, legitimate interest
Invoices (once paid plans are available)	2.5	contract, legal obligation
Statistics for businesses, improving the Service	2.6	legitimate interest
Publishing reviews and other content you post	2.7	contract
Security, abuse prevention, logs	2.1, 2.5, 2.6	legitimate interest

4. Who receives data

We do not sell personal data. We use these service providers; they act on our instructions or, where you use their own services (for example sign-in with Google, Apple or Telegram), also under their own privacy policies:

Google — sign-in with Google; Google Maps (the map on the website and in the app — Google receives your IP address and the map area shown); Google Fonts (fonts of the website and our emails — Google receives your IP address); Firebase Cloud Messaging (delivery of push notifications to Android and iOS devices);
Apple — Sign in with Apple; Apple Push Notification service (delivery of push notifications to iOS devices);
Brevo — sending emails: sign-in codes and service notifications;
Telegram — sign-in through and messages from our Telegram bots;
Anthropic — automatic reading of menu photos and texts that businesses send; only the sent image or text is processed;
Cloudflare — protection and delivery of the website; all requests to the website pass through Cloudflare;
DigitalOcean — hosting; our servers are located in Frankfurt, Germany;
Zoho — our mailbox: the letters you send to [email protected].

Some of these providers may process data outside the European Economic Area. In that case the transfer relies on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies) or on the Standard Contractual Clauses approved by the European Commission.

5. Service and marketing messages

Service notifications — sign-in codes, account security messages, notifications about offers of places you added to favourites, and messages about your business — are part of the Service and you control them in Profile → Notifications.

Marketing messages (promotions and news from Spoty.app) are sent only if you tick the separate box in Profile → Consents. It is off by default; you can withdraw it at any time, and we keep the date of every change. Service notifications do not depend on it.

6. How long we keep data

account data — while the account exists; deleted when you delete the account (section 7); copies in backups — up to 6 months;
one-time sign-in codes and links — valid for 15 minutes;
signed-in sessions — until you sign out or end them in your profile, at most 180 days after your last visit;
notification log — while the account exists;
push tokens — until the app reports a new token, you sign out or the token stops working;
server logs and the security log of business actions — up to 6 months;
statistics (section 2.6) — without a time limit, in pseudonymous form only;
content you post — while it is published; deleted when you delete it or your account;
records of accepted documents and consents — while the account exists;
business data — while the business is on Spoty.app, until it is deleted;
invoices and payment records (once paid plans are available) — for the period required by Latvian accounting law.

7. Deleting your account

You can delete your account yourself in Profile → Delete account. Deletion takes effect immediately and also covers any accounts earlier merged into yours. We delete your account data, sign-in methods, sessions, favourites, content you posted, devices and push tokens, notification settings and log, records of accepted documents and consents, and your access to brands. Offers already published for a brand stay with the brand. In the security log of business actions your entries remain, but your name is replaced with "Dzēsts konts" ("Deleted account") and the account number. If you are the only full owner of a brand, you first hand the brand over to another owner or give it up.

After deletion we keep only copies in backups, until they are overwritten (up to 6 months), and invoices and payment records (once paid plans are available) for the period required by law.

8. Your rights

Under the GDPR you may access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent at any time (this does not affect processing before the withdrawal). Write to [email protected]. You may also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv) or your local authority.

9. Children

The Service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, write to [email protected] and we will delete it.

10. Security

We protect data with technical and organisational measures: encrypted connections, hashed codes and keys, limited staff access with logging. No system is completely secure.

11. App permissions

Location — to show where you are and the offers near you; you can deny it, the map then shows a general area.
Notifications — to send push notifications you enabled; you can turn them off in the device settings.
Internet — to load offers and the map.

12. Changes

When this Policy changes materially, we publish a new version and ask signed-in users to accept it at their next visit. Minor corrections that do not change its meaning (for example typos or updated contact details) are published as a new version without asking again. The version number and its date are shown at the top of this page. Earlier versions are kept.

13. Contact

[email protected]