Privacy Policy
Last updated: 23 August 2026
This policy explains what personal data Spoto collects, why we collect it, who we share it with and what rights you have. It is written to match what the service actually does — if you find a difference between this page and Spoto's behaviour, tell us and we will fix one of the two.
1. Who is responsible
The controller of your personal data is [legal entity name], registration number [registration number], registered address [registered address].
For anything in this policy, including requests about your data, write to [legal@spoto.lv]. We answer data requests within one month.
2. What we collect
When you register: your email address, a hashed password (we never store the password itself), your account type, and the IP address you registered from. If you sign in with Google or Facebook instead, we receive your email address and that provider's user identifier rather than a password.
When you use the service: the filters you create — including any location, price range and attributes they contain — the listings you mark as watched, and a log of the notifications we sent you, with the channel, the time and whether you opened them.
For notifications: optionally a separate notification email address and a Telegram chat ID, if you provide them, plus your per-channel on/off preferences.
For paid plans: a Stripe customer identifier and your subscription status and period. Card numbers are handled entirely by Stripe — they never reach our servers and we cannot see them.
Technical data: standard web server logs, which include IP addresses and are used for security and troubleshooting. We do not build profiles, we do not track you across other websites, and we do not sell data to anyone.
3. Why we use it, and on what legal basis
To provide the service you signed up for — your account, your filters, matching and sending notifications, and running paid plans. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
To keep the service secure and prevent abuse — the registration IP address, rate limiting and server logs exist for this. Legal basis: our legitimate interests in protecting the service and other users (Art. 6(1)(f)).
To meet accounting and tax obligations for payments received. Legal basis: legal obligation (Art. 6(1)(c)).
To communicate with you about the service — verification, billing and important changes. These are service messages, not marketing. We do not send marketing email and there is no advertising on Spoto.
We do not use your data for automated decision-making that produces legal effects, and we do not profile you. Filter matching compares a new listing against criteria you chose yourself.
5. Who else processes your data
Stripe — payment processing and subscription management. Stripe receives your email address and payment details directly from you, and acts as an independent controller for the payment itself.
Brevo — delivery of transactional email (verification, notifications, billing). Brevo receives the recipient address and the message content.
Telegram — delivery of notifications to the bot, if you have connected a Telegram chat. Telegram receives your chat ID and the message content.
Google and Facebook — only if you choose to sign in with them, and only for that sign-in.
Our hosting provider, which stores the database and application servers. We use providers within the European Union for hosting.
6. Transfers outside the EEA
Some of the providers above may process data outside the European Economic Area.
Where that happens, the transfer relies on a European Commission adequacy decision or on standard contractual clauses, together with the provider's own technical safeguards. You can ask us at [legal@spoto.lv] which safeguard applies to a particular provider.
7. How long we keep it
Account data, filters and notification preferences: until you delete your account. Deleting your account removes them immediately.
Notification history: 12 months, after which it is deleted. The registration IP address is kept for 12 months for security purposes.
Billing and subscription records: for as long as accounting and tax law requires us to keep them, which is longer than the life of your account.
Backups: database backups are taken before each deployment and retained for 7 days, then destroyed. Data you delete may persist in a backup until that window passes.
Listing data collected from classified sites is not tied to your account and is kept independently of it.
8. Your rights
You have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, and to receive your data in a portable format.
You can exercise the most important ones yourself: your account settings show and correct your details, and the delete-account control in settings erases your account, filters and notification history and cancels any active subscription. It is immediate and cannot be undone.
For anything else — a copy of your data, a portability export, an objection, or a restriction — write to [legal@spoto.lv] from the address on your account.
Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue. Exercising any of these rights is free and will not cost you access to the service.
9. How we protect it
Passwords are stored only as salted hashes and are never recoverable, by us or anyone else. Traffic is encrypted with TLS. Sessions use short-lived signed tokens.
Access to production data is limited to what is needed to run the service. Payment card data never reaches our infrastructure at all.
No system is perfectly secure. If a breach ever affects your rights, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.
10. Children
Spoto is not intended for children. You must be at least 16 years old to create an account. If you believe a child has registered, write to [legal@spoto.lv] and we will delete the account.
11. Data in classified listings
Spoto copies publicly published listings from third-party classified sites. A listing's free-text description occasionally contains personal data an advertiser chose to publish, such as a phone number. We do not extract, index or use such details — they are stored only as part of the description text and shown as the source published them.
We are not the original publisher of that content. If you are an advertiser and want a listing removed from Spoto, write to [legal@spoto.lv] with the listing link and we will remove it from our copy; removing it from the source site remains a matter between you and that site.
12. Client records on professional plans
Professional plans let an agent store records about their own clients — a name and free-text notes. Those records describe people who are not Spoto users and who did not agree to anything with us.
For that data the agent is the controller and Spoto is only the processor: we store it, we do not use it for our own purposes, and we delete it when the agent deletes the record or their account. The agent is responsible for having a lawful basis to store it and for telling their clients about it.
13. Changes to this policy
We will update this page when what we do with data changes. The date at the top always reflects the current version.
If a change materially affects you, we will tell you by email or in the dashboard before it takes effect, rather than changing this page quietly.
14. Questions and complaints
Please write to us first at [legal@spoto.lv] — most issues are quickest to fix directly.
You also have the right to complain to the Data State Inspectorate (Datu valsts inspekcija), the supervisory authority in Latvia, or to the authority in the EU country where you live.