Privacy Policy

1. Who is responsible

Stepan Ikonnikov, doing business as spotstr, is responsible for your personal data. Contact: support@spotstr.com.

2. What we collect

Account details: name, email, phone number, profile photo.
Location: your device location while you use the App, so we can show professionals near you. Professionals choose how precisely their own location is shown.
Professional profile: business details, services, prices, portfolio, links, availability.
Session feel: the tags (for example “Calm” or “Step by step”), any tags of their own and the one-line promise a Professional adds to their profile. These are public.
Comfort wishes: the comfort preferences (for example “Quiet session” or “No photos or videos”) and the short note a Client chooses to add. They are optional and private: they are saved to your account so you don’t have to repeat them, added to the requests and bookings you send, and shared only with the Professional you send that request or booking to (and with authorized spotstr staff when needed for safety or a dispute). You can change or delete them at any time in Settings → My comfort. Please do not include health information or other sensitive personal data in your note.
Community: questions you post in Ask, your replies, recommendations and likes. These are public to other users with your first name and last initial; your contact details are never shown.
Activity: searches, favorites, appointment requests, messages, reviews, and the photos, videos and files you send in messages. Files in messages are stored privately: only the people in that conversation can open them (and authorized staff when investigating a report), and they are deleted when the sender deletes their account. Photos, videos and files you attach to a request (SpotSignal) are visible only to you and to the professionals your request is open to, and only while it is open; your name and contact details are never shown with a request.
Client profile: the name, photo, city, short description and interests you add when you register as a Client, your age (spotstr is for adults only), and, if you choose to add them, your gender and the languages you speak.
Payments: handled by our payment provider or app store. We do not store full card numbers.
Device data: device type, app version, time zone, push-notification token, and crash reports and app performance data, which our error-monitoring provider (Sentry) receives linked only to your account ID, never to your name, email or phone.
Deals: deals Professionals post (including photos and videos) are public in the App. We record views, taps, shares and saves of each deal to show the Professional anonymous counts, and to show Clients deals that fit what they look at. Photos and videos may be sent to a content-scanning provider (for example Hive) to detect prohibited content before they are published.
Verification: whether you have confirmed your email or phone and completed identity verification, and, for Professionals who submit one, license details (type, number, issuing authority). Identity documents and selfies are collected and stored by our verification provider (Stripe), not by spotstr; spotstr receives only the result (for example “verified”) and may receive your verified name and date of birth.
Profile statistics: when someone views a professional's profile in the App or through a shared link, we record the visit (and, in the App, the viewer's account) to show the professional anonymous visit counts.

3. How we use it

To run the App and show nearby availability, deliver messages and requests, send the notifications you choose, process subscriptions and boosts, keep the App safe and prevent fraud, enforce our Terms (including our intellectual property rights), and comply with the law.

Safety and moderation: when content or an account is reported, or we suspect a breach of the Terms, fraud or a safety risk, authorized spotstr staff may review the reported content and the related account activity, including the messages in the conversation concerned. Every such review is logged with its reason. We may then warn, restrict or close the account or remove content, and we tell the person why and how to appeal.

4. Legal bases

Where laws such as the EU or UK GDPR apply, we rely on: performance of our contract with you; your consent (for example, location and notifications, which you can withdraw in your device settings); our legitimate interests in securing and improving the App; and our legal obligations.

Other users see your public profile and the messages you send them. If you are a Client, a Professional you send a request or message to can see your client profile: name, photo, city, description, interests, age, and your gender and languages if you added them, which verifications you have completed, your spotstr booking history with them and in general (completed, cancelled and missed appointments), and reviews other Professionals left about you. Professionals cannot see your client profile unless you contact them. Your phone number and email are not shown unless you share them in a message. We use service providers for hosting and database (Supabase), maps, payments (Stripe or the app stores), in-app purchases and subscriptions (RevenueCat, together with the App Store and Google Play), crash and performance monitoring (Sentry), content scanning (Hive) and push notifications. They may only process your data on our instructions. We do not sell your personal data and do not share it for cross-context behavioural advertising.

6. International transfers

spotstr is available worldwide, so your data may be processed in countries other than your own, including the United States. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Your rights

Depending on where you live, including under the GDPR (EU/EEA), the UK GDPR, the CCPA/CPRA (California), the LGPD (Brazil), PIPEDA (Canada), the Australian Privacy Act and similar laws, you may have the right to access, correct, delete, or export your data, and to object to or restrict its processing. You can delete your account in the App or email support@spotstr.com. You may also complain to your local data protection authority.

8. Retention

We keep your data while your account is active. After you delete your account, we delete or anonymise it within 30 days, except where we must keep records longer by law (for example, payment and tax records).

9. Children

spotstr is only for people aged 18 or over. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete the account and its data.

10. Security

We use encryption in transit, access controls and row-level database security. No system is perfectly secure, so please use a strong password.

11. Changes

We will notify you in the App of material changes to this policy.