Privacy Policy of Spot.gg

This document has been written in plain language to make it easier to understand. It applies to the spot.gg website, the client panel and the Spot.gg mobile application.

Pursuant to Article 13(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), we inform you that:

1. Data controller

The controller of your personal data is InterScript Sebastian Sobieraj with its registered office at Chmielna 2/31, 00-020 Warsaw. For matters related to your data, contact us by e-mail: [email protected].

2. What data we collect

1. Account data: e-mail address, password (in encrypted form), two-factor authentication data, and when logging in via Google also the Google account identifier.
2. Account settings: language, currency, country, theme and selected consents.
3. Technical data: IP address (including at registration and last login), browser or device type, login date.
4. Order and payment data: order history, amounts, payment method, transaction identifiers, wallet and points balance. We do not store card numbers; they are handled by payment operators.
5. Server data: configuration, files, backups, profiles, logs, console and history of actions on the server.
6. Content you provide to us: chat conversations, tickets, attachments, photos, survey responses and reasons for resigning from the service.
7. Source of acquisition: campaign parameters (UTM), ad click identifiers, the site from which you come to us, referral code, and in the application information about the source of installation from Google Play.
8. Data from the mobile application described in point 5.

3. For what purpose and on what basis

1. Creating an account and providing services, including server handling, payments and support (Article 6(1)(b) GDPR).
2. Settlements, accounting and tax obligations (Article 6(1)(c) GDPR).
3. Security, prevention of abuse, protection against claims and development of services (Article 6(1)(f) GDPR, i.e. our legitimate interest).
4. Messages about news and promotions, statistics and ad measurement, only with your consent (Article 6(1)(a) GDPR).

Providing data is voluntary, but without an e-mail address and password or a Google account you will not create an account, and without it we cannot provide services.

4. E-mail messages

Messages related to the service, for example about server expiration or payment, are sent to every client. Messages about news and promotions are sent only to persons who have given their consent during registration or in account settings. You can withdraw your consent at any time in your account settings.

5. Mobile application

1. Push notifications: after your consent we store the device token in order to send notifications. You can disable them in your phone settings.
2. Photos and camera: the application uses them only when you yourself select a photo or take it to send it in the chat.
3. Anonymous counter: the application sends us the name of the step (for example opening the registration screen), system and application version. We record only the daily total, without identifiers and without assigning it to a person, therefore this counter also works without consent.
4. Application and ad measurement: only with your consent the application uses the Google Analytics for Firebase service. Google then receives information about actions in the application (for example about account registration), the application instance identifier, the advertising identifier (Advertising ID) and device data. We provide them in order to count the use of the application and measure the effectiveness of ads, including in Google Ads. We do not use this data for remarketing or ad personalization. We do not add an e-mail address or account identifier to events.
5. Without consent, measurement is disabled and the application does not read the advertising identifier. You can change your consent at any time in the application settings. We record the date of granting and withdrawing consent as proof of obtaining it.

6. Cookies

Our website uses cookies in order to:

1. Adjust the content of the website to your preferences.
2. Enable logging in and maintaining login on subsequent subpages.
3. Prepare statistics on the use of the website using Google Analytics (Google) and Microsoft Clarity (Microsoft) tools, only after consent is given in the “Analytical” category.
4. Measure the effectiveness of advertising campaigns using Google Ads (Google) and Reddit Pixel (Reddit) tools, only after consent is given in the “Campaign effectiveness” category. These tools may receive information about visited pages and actions taken, such as account registration, server activation or payment for its extension.

You can change or withdraw your consent to analytical and advertising cookies at any time using the “Cookie settings” link in the footer of the website.

7. Who we share data with

We do not sell your data. We share it only with companies that help us provide services, and only to the necessary extent:

1. Hosting and infrastructure: providers of servers, data storage and network protection.
2. Payments: Przelewy24, PayPal, Stripe, Google Play.
3. Messages: providers of e-mail and push notification delivery.
4. AI assistant: OpenAI. It receives the content of the conversation, attached photos and information about the server necessary to respond. Do not enter passwords or sensitive data in the chat. Our employees may also read conversations to check the quality of responses.
5. Login and form protection: Google and the website security provider.
6. Statistics and ads, only with your consent: Google, Microsoft, Reddit.

We may also provide data to state authorities if required by law. We store server data in the location you choose.

8. Transfer of data outside the European Economic Area

Some of these companies, including Google, Microsoft, OpenAI, Reddit, Stripe and PayPal, may process data outside the European Economic Area, in particular in the USA. This is done on the basis of a decision of the European Commission stating an adequate level of protection or standard contractual clauses. If you choose a server location outside the European Economic Area, the data of that server will be stored in that location. You can obtain more information at [email protected].

9. How long we store data

1. Account data: until the account is deleted.
2. Order and payment data: 5 years from the end of the tax year in which the tax obligation arose. After deleting the account, they are no longer associated with it.
3. History of actions on the server: 1 month, and entries about payments until the server is deleted.
4. Server files and backups: in accordance with the rules described in the Terms of Service, and after deleting the server we delete them.
5. Server profiles: up to 6 months from last use. We inform you about deletion by e-mail 14 days in advance.
6. Tickets and attachments: until the account is deleted.
7. Chat conversations: 30 days from last activity, and after deleting the account we delete them immediately together with attached photos.
8. IP address data from network protection systems: 30 days, and data on security incidents 180 days.
9. Data in Google Analytics: up to 14 months.
10. Data processed on the basis of consent: until it is withdrawn, and the record of granting consent until the account is deleted.

10. Your rights

You have the right to access your data, rectify it, delete it, restrict processing and transfer it, as well as the right to object to processing based on our legitimate interest. You can withdraw your consent at any time. This does not affect the lawfulness of processing before its withdrawal.

For matters related to your data, write to [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

11. Deleting the account and data

You can delete your account yourself in the account settings on the spot.gg website (after logging in: https://spot.gg/en/user/settings) or in the mobile application settings. You can also request this at [email protected].

Along with the account we delete account data, servers with files, profiles, tickets and chat conversations. We only retain the data from point 9 that we must store longer, in particular data on orders and payments. Remember that deleting your account means resigning from our services, and the wallet balance and points expire in accordance with the Terms of Service.

To delete part of the data without deleting the account, write to [email protected].

12. Changes to the policy

We inform about changes to the policy on this page. You will find previous versions in the list of versions below the document.