Spotl
Sign in
Privacy & Data Protection

Privacy Policy

Effective Date: November 6, 2026 · Version 1.1

Privacy at Spotl: Clean, Minimal & Creator-First

We never sell your personal data. We do not use third-party advertising tracking networks or data brokers. We collect only what is strictly necessary to run your portfolio, manage your deal pipeline, and power your invoices.

1. Introduction

Spotl ("we," "our," or "us") is committed to protecting the privacy of our creators and their visitors. This Privacy Policy explains our collection, use, and disclosure practices when you visit or use spotl.co or any creator portfolio hosted on our platform (such as spotl.co/u/[slug]).

2. Information We Collect

We collect information in the following categories:

A. Account & Profile Data

When you sign up or configure your profile, you provide your email address, creator handle (slug), display name, bio, profile avatar photo, social media links (Instagram, TikTok, YouTube, etc.), and optional rate packages.

B. Creator Media & Content

Videos, photos, thumbnails, logos, and testimonials uploaded to showcase your creator work. These materials are stored securely and published to your public portfolio page.

C. Commercial Deals & Invoicing Information

Deal names, brand client contacts, deal stages, contract values, invoice line items, and payment instructions entered into your private dashboard CRM. This information is strictly confidential and protected by multi-tenant Row-Level Security (RLS).

D. Portfolio Visitor & Engagement Analytics

When visitors view a creator's public portfolio or play a showcase video, we collect anonymous aggregate event data (page views, video plays, outbound link clicks, referring domains). We do NOT employ intrusive cross-site tracking or fingerprinting techniques.

E. Brand Inquiries & Contact Submissions

When a brand submits an inquiry through a creator's public contact form, we collect the sender's name, brand name, email address, budget, and project brief solely to deliver the message to the creator.

F. Payment & Subscription Details

Subscription payments for Spotl plans are processed directly by our payment processor (Stripe). Spotl never receives, transmits, or stores full credit card numbers or banking security codes.

3. How We Use Your Information

We use the data we collect solely to:

  • Provide, operate, and maintain the Spotl platform and public portfolio pages.
  • Authenticate users via secure passwordless magic links and verify identity.
  • Generate creator analytics and performance insights (view counts, link clicks).
  • Send transactional notifications, invoice reminders, and weekly business digest emails.
  • Process subscription billing and manage the creator referral rewards program.
  • Detect, prevent, and mitigate fraud, spam, automated bots, and security vulnerabilities.

4. Third-Party Service Providers (Categories of Recipients)

We do not sell, rent, or trade your personal information. To provide our Service reliably, we share limited personal information with trusted third-party service providers who perform essential services on our behalf. These service providers fall into the following functional categories:

Cloud Infrastructure & Hosting Providers:

We use secure cloud infrastructure providers for server compute, database management, and object storage to securely host application code, user profiles, uploaded media, and creator portfolios.

Payment Processors:

We partner with third-party payment processors (including Stripe) to securely process subscription billing and manage customer payment methods. Payment details are handled directly by the processor pursuant to their independent privacy policy and security standards.

Communications & Email Delivery Services:

We use reputable transactional email service providers to deliver passwordless login magic links, invoice delivery notifications, brand inquiry alerts, and business activity summaries.

Security, Bot Mitigation, & Abuse Prevention Services:

We utilize non-intrusive security and challenge verification providers to protect login screens and public inquiry forms from automated spam, brute-force attempts, and distributed denial-of-service (DDoS) attacks.

All third-party service providers receive only the minimum information necessary to perform their contracted functions, and are contractually obligated to maintain strict confidentiality and comply with applicable data protection legislation.

5. External Links & Third-Party Platforms

Creator portfolio pages hosted on Spotl may contain links to external third-party websites, social networks (such as Instagram, TikTok, YouTube, and X), digital storefronts, or brand partner sites.

Spotl has no control over, and assumes no responsibility or liability for, the content, privacy policies, or practices of any third-party websites or services. We encourage you and your visitors to read the privacy statements of any third-party site you interact with.

6. Cookies & Local Storage

We believe in clean web hygiene. We do NOT use third-party advertising cookies, ad targeting networks, or social tracking pixels.

  • Authentication Cookies: Strictly necessary secure session cookies to keep you signed in to your account.
  • Referral Cookie (spotl_ref): A first-party cookie retained for 30 days when a user visits via a creator's affiliate link, used exclusively to credit referral commissions to the referring creator.
  • Local Storage (cd-theme): Stores your light/dark/system theme display preference locally on your device.

7. Data Security & Multi-Tenant Isolation

We implement robust technical and organizational security controls designed to protect your personal and commercial data:

  • Row-Level Security (RLS): Database-level cryptographic isolation guarantees that your private deals, brand client names, invoices, and draft blocks cannot be accessed by other creators or unauthenticated users.
  • Encryption: All network communication is encrypted in transit via modern TLS (HTTPS), and stored records and media are encrypted at rest.
  • Bot Protection: Non-intrusive challenge tokens defend sign-in forms and public endpoints without invasive behavioral profiling.

8. Your Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you have specific statutory rights regarding your personal information:

  • Right of Access: You can view all profile, deal, and invoice data in your dashboard at any time.
  • Right to Rectification: You can edit and update your information directly within the app.
  • Right to Data Portability: You can export your audience leads and download your portfolio media.
  • Right to Deletion: You can request full deletion of your account and all associated data by emailing us.
  • Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at [email protected].

9. Data Retention

We retain your account and portfolio information for as long as your account is active. If you delete your account or submit an erasure request, we will permanently purge your private data, uploaded media, deals, and invoices within thirty (30) days, except where retention is required by tax, accounting, or legal compliance obligations.

10. Children's Privacy

Spotl is strictly intended for individuals who are at least 18 years of age (or the legal age of majority in your jurisdiction). We do not knowingly collect personal information from minors.

11. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect changes in our practices or applicable legal requirements. When updates are published, the effective date at the top will be updated.

12. Contact & Inquiries

For questions, concerns, or privacy inquiries, contact us directly:

Spotl Privacy Team

Email: [email protected]

Website: https://spotl.co