PRIVACY POLICY

Last updated: 23 July 2026

1. Who We Are

TT Service OÜ ("SpotsMe", "we", "us", or "our") operates the SpotsMe digital loyalty platform. We are registered in Estonia under registration number 16551742, with registered address at Rõikheina tee 47, 74117 Maardu, Estonia.

For privacy-related enquiries, please contact us at: privacy@spotsme.app

2. What Data We Collect and Why

Customer data

Data	Purpose	Legal basis
Email address	Account creation, login, transactional notifications	Contract (GDPR Art. 6(1)(b))
Display name	Personalised experience within the app	Contract (GDPR Art. 6(1)(b))
Authentication method	Verifying identity at login	Contract (GDPR Art. 6(1)(b))
Language preference	Serving the app in your preferred language	Legitimate interest (GDPR Art. 6(1)(f))

Loyalty usage data

Data	Purpose	Legal basis
Check-ins (store + timestamp)	Recording programme participation	Contract (GDPR Art. 6(1)(b))
Transaction history (amounts + points)	Calculating and displaying loyalty balances	Contract (GDPR Art. 6(1)(b))
Orders	Fulfilling in-app purchase or reward redemption requests	Contract (GDPR Art. 6(1)(b))
Bookings (service, time, chosen staff member)	Fulfilling booking requests at participating stores	Contract (GDPR Art. 6(1)(b))
Loyalty balance and tier	Displaying current status to the customer	Contract (GDPR Art. 6(1)(b))

Important: What merchants can see When you participate in a merchant's loyalty programme, that merchant can see your display name and your purchase and loyalty history at their store within the SpotsMe dashboard. Merchants cannot see your email address or your activity at other merchants.

Merchant data

Data	Purpose	Legal basis
Email address	Account creation, login, billing communications	Contract (GDPR Art. 6(1)(b))
Business name, category, and description	Displaying merchant profile to customers	Contract (GDPR Art. 6(1)(b))
Contact phone number	Support and account verification	Contract (GDPR Art. 6(1)(b))
Store name and address	Enabling customers to find and check in to the store	Contract (GDPR Art. 6(1)(b))
Logos and images	Displaying branding within the app	Contract (GDPR Art. 6(1)(b))
Staff usernames	Access control for merchant staff accounts	Contract (GDPR Art. 6(1)(b))

Automatically collected data

Data	Purpose	Legal basis
IP address (server logs)	Security monitoring, abuse prevention, debugging	Legitimate interest (GDPR Art. 6(1)(f))

3. How We Use Your Data

Operate and maintain the SpotsMe platform and all its features.
Send transactional emails only (account confirmations, OTP codes, important service notices). We do not send marketing emails without your explicit consent.
Detect and prevent fraud, abuse, and security incidents.
Respond to support requests.
Produce aggregate, anonymised analytics about platform usage (no individual profiling).

We do not sell your data. We do not use automated profiling or automated decision-making that produces legal or similarly significant effects on you.

4. Who We Share Your Data With

Recipient	Purpose	Data shared
Cloud hosting provider (EU data centres)	Hosting the SpotsMe platform and database	All platform data
Payment service provider	Processing merchant subscription payments	Merchant email address, subscription and payment details
Transactional email delivery provider	Delivering transactional emails and OTP codes	Email address and email content only
Cloud object storage provider	Storing merchant logos and uploaded images, and encrypted database backups (encrypted before upload; decryption keys are held outside the provider)	Images; encrypted backup archives

Google and Apple: When you use social sign-in, we verify the identity token against Google's or Apple's public key endpoint. We send no personal data to Google or Apple as part of this process.

We do not share customer email addresses or identity information with merchants.

5. Data Retention

Data category	Retention period
Account data	Until you delete your account, then anonymised within 30 days
Transaction and order records	7 years (Estonian tax law), then anonymised
Check-in history	3 years from the date of the check-in
Refresh tokens	Up to 30 days depending on account type
Server logs (IP addresses)	30 days
OTP codes	15 minutes

6. Your Rights

Under the GDPR, you have the following rights:

Right of access (Art. 15) — request a copy of the personal data we hold about you.
Right to rectification (Art. 16) — ask us to correct inaccurate data.
Right to erasure (Art. 17) — request deletion of your data, subject to financial record retention obligations.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to restriction (Art. 18) — ask us to restrict processing of your data in certain circumstances.
Right to object (Art. 21) — object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@spotsme.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.

7. Data Security

We protect your data using the following measures:

All data in transit is encrypted.
Passwords are stored only in irreversibly hashed form, never in plaintext.
Access sessions are short-lived; session credentials are rotated on use.
Secrets and credentials are kept strictly separate from the source code.
Expired and revoked session credentials are removed on a regular schedule.

8. Children

SpotsMe is not directed at persons under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us at privacy@spotsme.app and we will delete it promptly.

9. International Transfers

Your data is stored on servers located within the EU/EEA. Where any sub-processor operates outside the EEA (for example, the global network of our object storage provider), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.

10. Language Versions

This Privacy Policy is available in English, Estonian, and Russian. In the event of any conflict or ambiguity between language versions, the English version governs.

11. Changes to This Policy

We will notify you of material changes to this Privacy Policy by email at least 15 days before they take effect. Continued use of SpotsMe after the effective date constitutes acceptance of the revised policy.