1. Introduction

Spottly (“we,” “us,” “our,” or “Company”) operates spottlyapp.app and related services. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise handle your information when you use our platform.

By accessing or using Spottly, you agree to this Privacy Policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 — Information You Provide Directly

Account Information: Email, name, phone number, profile photo, bio, account type (professional or studio owner).

Location Information: Zip code, city, state, and derived coordinates (latitude/longitude) for matching and discovery.

Professional Details: Modalities/specializations, availability, rates, teaching credentials, studio name, services offered.

Communication Data: Messages sent between practitioners and studios through our messaging system.

Payment Information: Billing address, payment method details processed securely by Stripe; we do not store full card details.

Posts and Content: Sub-requests (gig postings), job listings, community feed posts, calendar entries.

Preferences: Notification settings, filter preferences, saved searches.

2.2 — Information Collected Automatically

Device & Browser Data: IP address, browser type, operating system, referring URL, device identifiers.

Usage Data: Pages viewed, features used, time spent, click patterns, search history within the app.

Cookies & Tracking: Session tokens, authentication cookies, analytics trackers if enabled.

Geolocation: City/state derived from your zip code through our geocoding service. We do not collect real-time GPS or precise location without explicit consent.

2.3 — Information from Third Parties

Stripe: Tokenized payment data and transaction history.

Email Service Providers: Bounce reports, delivery logs.

Social Platforms: If you link social accounts, public profile data.

3. How We Use Your Information

We use your information to provide services, personalize opportunities, communicate with you, analyze usage, support safety and compliance, and process payments. This includes matching sub-requests, posting jobs, enabling messaging, facilitating professional networking, showing relevant opportunities within your location radius and modality preferences, sending transactional and marketing emails where permitted, improving features, troubleshooting technical issues, detecting fraud, enforcing our Terms & Conditions, complying with legal obligations, billing, subscription management, and payment dispute resolution.

4. Information Sharing & Disclosure

4.1 — Sharing Within Spottly

Your public profile (name, modality, location, bio) is visible to other practitioners and studios to enable discovery and networking. Sub-requests and job postings are visible based on your search/filter settings.

4.2 — Third-Party Service Providers

We share information with vendors who help us operate the platform, including Stripe for payment processing, Supabase for backend database hosting, Vercel for application hosting, email service providers for transactional communications, and analytics providers if enabled. These vendors are contractually bound to use your data only to provide services to us.

4.3 — Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect our legal rights, privacy, safety, or property.

4.4 — Business Transfers

If Spottly is merged, acquired, or its assets transferred, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the platform.

4.5 — No Sale of Personal Information

We do not sell, rent, or trade your personal information for money or consideration.

5. Data Security

We implement industry-standard security measures, including HTTPS/TLS encryption for data in transit, role-based access controls and database row-level security, secure authentication (email + password), and regular security reviews. However, no method of transmission is 100% secure. We cannot guarantee absolute security and are not liable for unauthorized access.

6. Data Retention

Active Accounts: We retain your data while your account is active. Deleted Accounts: Upon account deletion, we retain anonymized transaction records for legal/financial compliance, typically 7 years for payment records. Sub-Requests/Job Posts: Historical posts may be retained for dispute resolution and analytics. Communications: Archived messages are retained unless you request deletion within legal/compliance limits.

You may request deletion of your account and associated personal data by emailing us. We will comply within 30 days, except where retention is required by law.

7. Your Privacy Rights

7.1 — Access & Portability

You have the right to request a copy of your personal information in a portable format.

7.2 — Correction & Updates

You may update your account information at any time through your profile settings.

7.3 — Deletion

You may request deletion of your account and associated personal data, subject to legal/compliance retention requirements.

7.4 — Opt-Out of Marketing

You can opt out of marketing emails by clicking “Unsubscribe” in any email or adjusting notification settings in your account.

7.5 — California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information is collected, used, and shared; delete personal information with exceptions; opt out of the sale or sharing of personal information; and avoid discrimination for exercising your privacy rights. To exercise these rights, email us with your request.

7.6 — EU/UK Privacy Rights (GDPR/UK GDPR)

If you are located in the EU or UK, you have the right to access, rectify, or erase your personal data; restrict processing; object to processing; and data portability. We process your data based on your consent to our Terms & Conditions and the necessity to provide services. To exercise your rights, contact us.

8. Third-Party Links & Services

Our platform may contain links to third-party websites, such as external studio sites. We are not responsible for their privacy practices. Please review their privacy policies before sharing information.

9. Children’s Privacy

Spottly is not intended for users under 18. We do not knowingly collect information from minors. If we learn we have collected data from a minor, we will delete it promptly.

10. International Data Transfers

Your information may be processed and stored in the United States (Supabase infrastructure). By using Spottly, you consent to the transfer of your information to the US, which may have different data protection laws than your home country.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes via email or prominent notice on the platform. Your continued use constitutes acceptance of the updated policy.

12. Contact Us

For questions about this Privacy Policy, requests to access/delete data, or privacy concerns, contact: Spottly LLC, Email: privacy@spottlyapp.com, Website: www.spottlyapp.com. Response time: We aim to respond to all privacy requests within 30 days.

Acknowledgment of SimpleMaps Data

Spottly uses geocoding data from SimpleMaps (https://simplemaps.com/data/us-zips) to match practitioners and opportunities by location. This data is used solely to provide geographic matching services and is not shared with third parties for marketing or sale.