Spotto · Privacy Policy

Last updated: {{EFFECTIVE_DATE}}

1. About this policy

This Privacy Policy explains how Spotto Today Pty Ltd (ABN {{ABN}}) (“Spotto”, “we”, “us”, “our”) collects, uses, discloses and protects your personal information when you use the Spotto mobile app, the Spotto merchant dashboard, and our related websites and services (together, the “Service”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service, you agree to the collection and use of information as described in this policy.

The Service has two audiences, and what we collect differs between them:

• Consumers: people who use the Spotto app to discover, save and redeem deals.
• Merchants: businesses that use the Spotto dashboard to list deals, manage their business profile, and subscribe to a paid plan.

To request deletion of a Spotto account without the app, see Request account deletion below.

2. Information we collect

2.1 Information you give us

All users (account):

• Email address, and (for password sign-in) your password, which is handled by our authentication provider and never stored by us in plain text.
• Display name, first name and last name.
• Profile photo, if you choose to upload one.

Website launch list:

• Email address, if you choose to join the Sydney launch list. We use it to send the launch update you requested.

Consumers:

• Businesses you favourite, deals you save as coupons, and deals you hide.
• Deal alert preferences: the suburbs and deal categories you want to be notified about.
• Email and notification preferences (including whether you opt in to marketing).

Merchants (business profile):

• Business name, description, and Australian Business Number (ABN).
• Business address, location, phone number, email address and website.
• A business banner image, if you upload one.
• The content of the deals you create. Where you use our AI-assisted deal drafting feature, the deal text you provide is processed by a third-party AI provider (see section 5) to structure it. We do not send your customers’ personal information to that provider.

2.2 Information we collect automatically

• Location information. With your permission, the Spotto app collects your device’s precise or approximate location to show you deals near you and to centre the map. You can grant or revoke this permission at any time in your device settings; if you decline, you can still use the app by searching for a suburb manually.
• Usage and analytics data. We record how you interact with the Service (for example, screens viewed, deals and businesses tapped, filters applied, and searches performed) to understand what’s useful and improve the product.
• Device and technical data. Device model, operating system version, app version, language, and similar technical identifiers.
• Crash and diagnostic data. If the app crashes, we collect diagnostic information to diagnose and fix the problem.
• Push notification tokens. While you are signed in to a mobile app, we may store a device push token so we can route notifications you choose to receive. Your device settings separately control whether notifications may be displayed.

2.3 Information from third parties

• Google Sign-In. If you sign in with Google, we receive your name, email address and profile photo from Google, in line with your Google account settings.
• Australian Business Register (ABR). When a merchant enters an ABN, we verify it against the public ABR / ABN Lookup service to confirm the business identity.

2.4 Payment information

When a merchant subscribes to a paid plan, payments are processed by Stripe. Card and bank details are collected and stored by Stripe directly under Stripe’s own privacy policy. We do not receive or store your full card number. We store a Stripe customer identifier and non-sensitive subscription details (plan tier, status, billing interval, renewal date) so we can manage your subscription.

3. How we use your information

We use personal information to:

• Create and manage your account and authenticate you.
• Notify you when Spotto launches, if you joined the website launch list.
• Provide the core Service: show nearby deals, let you save and redeem coupons, manage favourites, and (for merchants) list deals and manage a business.
• Send deal alerts, reminders and transactional messages (for example coupon and redemption confirmations, and account or billing notices).
• Send marketing communications where you have opted in (you can opt out at any time; see section 7).
• Verify merchant identity (ABN) and process merchant subscription payments.
• Understand usage, improve and personalise the Service, and develop new features.
• Maintain the security, integrity and reliability of the Service, and detect and prevent fraud or abuse.
• Comply with our legal obligations and enforce our terms.

4. Location and push notifications

• Location is used by Spotto to power location-based features (nearby deals, the map, and matching your deal alerts to suburbs). You control device location access through your device’s permission settings. Google Maps may separately process map-related data as described in section 5.
• Push notifications are used to deliver deal alerts and reminders you have asked for, and important account or service messages. You can disable notifications in your device settings or your in-app preferences at any time.

5. When we share your information

We do not sell your personal information. We use the providers below to run the Service. They may receive information from us or directly from our apps. Google Maps Platform also uses map-related data to provide and improve Google products and services, as described below. Our key providers are:

Google Maps in the consumer app. When you use the map, Google may receive coordinates for the area displayed and technical data. On Android, the Google Maps SDK automatically sends Google device and app metadata, an IP address, a Maps SDK-specific pseudonymous identifier, and crash metrics. Depending on how the map is used, it may also send interactions such as panning and zooming. If you allow device location, the map area may reflect your location. Google may use and retain this data to provide and improve Google products and services under the Google Privacy Policy. See Google's Maps SDK disclosure for details about the Android SDK.

We may also disclose personal information:

• To comply with a law, regulation, court order or lawful request from a government or regulatory body.
• To protect the rights, property or safety of Spotto, our users or the public.
• In connection with a business sale, merger or restructure, subject to this policy.

Certain information is shared as part of how the Service works. For example, a merchant’s business profile and published deals are shown publicly to consumers. Redemption of a coupon confirms to the merchant that a coupon was redeemed.

6. Overseas disclosure

Some of the providers listed above are located, or process data, outside Australia (including in the United States). Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. Your primary account and business data is stored in Google’s Australian (Sydney) region.

7. Marketing communications

Where you have opted in, we may send you marketing emails about deals and features. Every marketing email includes an unsubscribe link, and you can manage your email and notification preferences in the app at any time. Opting out of marketing does not stop transactional or service messages (such as billing or security notices), which are necessary to provide the Service.

Joining the website launch list records your request to receive one launch update. You can withdraw from that list or ask us to delete the address by emailing contact@spotto.pro from the same address.

8. Data security and retention

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, including access controls, encryption in transit, and routing data access through validated server-side functions. Account data operations require authentication; the public launch-list endpoint uses validation and abuse controls instead. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We retain personal information for as long as your account is active or as needed to provide the Service, and afterwards only as required to meet legal, accounting, tax or regulatory obligations, resolve disputes, and enforce our agreements.

Launch-list email addresses are kept until we send the launch update or you withdraw, then deleted within 30 days unless we are legally required to retain them.

9. Your rights and choices

Under the Australian Privacy Principles you may:

• Access the personal information we hold about you.
• Correct information that is inaccurate, out of date or incomplete. Much of this can be done directly in the app’s profile settings.
• Delete your account. You can request deletion in the app or by following the instructions below. An in-app consumer deletion request ends normal account access immediately; the account can be recovered by signing in within 24 hours before the final purge. Merchants with an active subscription can delete immediately or schedule deletion for the end of the current billing period. We remove or de-identify personal information from active systems after deletion, except where we must retain limited records (for example, completed payment records) for legal, accounting, security, or dispute purposes.
• Opt out of marketing communications at any time.

Request account deletion

If you can access your Spotto account, open Profile and select Delete Account. To request deletion without the app or dashboard, email contact@spotto.pro with the subject “Delete my Spotto account” from the email address associated with your account. If you cannot access that address, include it in your message and tell us how to contact you. We may ask you to verify that the account is yours before processing the request. You do not need to reinstall the app. We will confirm when deletion is complete. The data-retention exceptions are described in section 8 above.

To make an access or correction request, contact us at contact@spotto.pro. We will respond within a reasonable period and in accordance with our obligations under the Privacy Act.

If you joined only the website launch list, use the same email address when contacting us so we can locate, remove or correct that standalone record.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

11. Cookies and analytics (web)

Our websites use cookies and similar technologies for authentication, to remember your preferences, and to measure usage so we can improve the Service. You can control cookies through your browser settings; disabling them may affect how the websites function.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, where the changes are material, provide a more prominent notice. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us and complaints

If you have a question, request or complaint about your privacy, contact us at:

• Spotto Today Pty Ltd
• {{BUSINESS_ADDRESS}}
• Email: contact@spotto.pro

We will acknowledge and investigate any complaint. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.