PRIVACY POLICY

Last updated: 24 September 2026

1. Who We Are

TT Service OÜ ("SpotsMe", "we", "us", or "our") operates the SpotsMe digital loyalty platform. We are registered in Estonia under registration number 16551742, with registered address at Rõikheina tee 47, 74117 Maardu, Estonia.

For privacy-related enquiries, please contact us at: privacy@spotsme.app

2. What Data We Collect and Why

Customer data

Data	Purpose	Legal basis
Email address	Account creation, login, transactional notifications	Contract (GDPR Art. 6(1)(b))
Display name	Personalised experience within the app	Contract (GDPR Art. 6(1)(b))
Authentication method	Verifying identity at login	Contract (GDPR Art. 6(1)(b))
Language preference	Serving the app in your preferred language	Legitimate interest (GDPR Art. 6(1)(f))
Push notification token, device platform, app version, notification permission state	Delivering order status notifications (order ready / cancelled) to your device	Contract (GDPR Art. 6(1)(b))
Merchant news subscription choices and consent timestamps	Sending offers and news from merchants you have subscribed to	Consent (GDPR Art. 6(1)(a)), withdrawable at any time in the app

Loyalty usage data

Data	Purpose	Legal basis
Check-ins (store + timestamp)	Recording programme participation	Contract (GDPR Art. 6(1)(b))
Transaction history (amounts + points)	Calculating and displaying loyalty balances	Contract (GDPR Art. 6(1)(b))
Orders	Fulfilling in-app purchase or reward redemption requests	Contract (GDPR Art. 6(1)(b))
Bookings (service, time, chosen staff member)	Fulfilling booking requests at participating stores	Contract (GDPR Art. 6(1)(b))
Loyalty balance and tier	Displaying current status to the customer	Contract (GDPR Art. 6(1)(b))

Important: What merchants can see When you participate in a merchant's loyalty programme, that merchant can see your display name and your purchase and loyalty history at their store within the SpotsMe dashboard. Merchants cannot see your email address or your activity at other merchants.

Merchant data

Data	Purpose	Legal basis
Email address	Account creation, login, billing communications	Contract (GDPR Art. 6(1)(b))
Business name, category, and description	Displaying merchant profile to customers	Contract (GDPR Art. 6(1)(b))
Contact phone number	Support and account verification	Contract (GDPR Art. 6(1)(b))
Store name and address	Enabling customers to find and check in to the store	Contract (GDPR Art. 6(1)(b))
Logos and images	Displaying branding within the app	Contract (GDPR Art. 6(1)(b))
Staff usernames	Access control for merchant staff accounts	Contract (GDPR Art. 6(1)(b))

Automatically collected data

Data	Purpose	Legal basis
IP address (server logs)	Security monitoring, abuse prevention, debugging	Legitimate interest (GDPR Art. 6(1)(f))

3. How We Use Your Data

Operate and maintain the SpotsMe platform and all its features.
Send transactional emails only (account confirmations, OTP codes, important service notices). We do not send marketing emails or marketing push notifications without your explicit consent.
Detect and prevent fraud, abuse, and security incidents.
Respond to support requests.
Produce aggregate, anonymised analytics about platform usage (no individual profiling).

Push notifications: Order status updates are sent when a store marks your order as ready or cancelled. Offers and news from merchants are sent only for merchants you have explicitly subscribed to in the app. The content of merchant news is written by the merchant; SpotsMe only delivers it. Merchants never receive your push notification token, your device data, or your identity.

We do not sell your data. We do not use automated profiling or automated decision-making that produces legal or similarly significant effects on you.

4. Who We Share Your Data With

Recipient	Purpose	Data shared
Cloud hosting provider (EU data centres)	Hosting the SpotsMe platform and database	All platform data
Payment service provider	Processing merchant subscription payments	Merchant email address, subscription and payment details
Transactional email delivery provider	Delivering transactional emails and OTP codes	Email address and email content only
Cloud object storage provider	Storing merchant logos and uploaded images, and encrypted database backups (encrypted before upload; decryption keys are held outside the provider)	Images; encrypted backup archives
Push notification delivery provider — Expo (650 Industries, Inc., USA)	Delivering push notifications to your device	Push notification token and the notification text (merchant name, news title, "order ready"); nothing else
Apple Push Notification service and Google Firebase Cloud Messaging	Operating-system delivery channels for push notifications on iOS and Android	Push notification token and the notification text; nothing else

Google and Apple: When you use social sign-in, we verify the identity token against Google's or Apple's public key endpoint. We send no personal data to Google or Apple as part of this process.

We do not share customer email addresses or identity information with merchants.

5. Data Retention

Data category	Retention period
Account data	Until you delete your account, then anonymised within 30 days
Transaction and order records	7 years (Estonian tax law), then anonymised
Check-in history	3 years from the date of the check-in
Refresh tokens	Up to 30 days depending on account type
Server logs (IP addresses)	30 days
OTP codes	15 minutes
Push notification tokens	Until you log out on that device, the device stops accepting notifications, or after 90 days of inactivity
Notification consent records	Until consent is withdrawn or your account is deleted

6. Your Rights

Under the GDPR, you have the following rights:

Right of access (Art. 15) — request a copy of the personal data we hold about you.
Right to rectification (Art. 16) — ask us to correct inaccurate data.
Right to erasure (Art. 17) — request deletion of your data, subject to financial record retention obligations.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to restriction (Art. 18) — ask us to restrict processing of your data in certain circumstances.
Right to object (Art. 21) — object to processing based on legitimate interests.

Withdrawing notification consent: you can withdraw your consent to offers and news from a merchant at any time using the per-merchant toggle in the app, the switches under Profile → Notifications, or your phone's system notification settings. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, contact us at privacy@spotsme.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.

7. Data Security

We protect your data using the following measures:

All data in transit is encrypted.
Passwords are stored only in irreversibly hashed form, never in plaintext.
Access sessions are short-lived; session credentials are rotated on use.
Secrets and credentials are kept strictly separate from the source code.
Expired and revoked session credentials are removed on a regular schedule.

8. Children

SpotsMe is not directed at persons under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us at privacy@spotsme.app and we will delete it promptly.

9. International Transfers

Your data is stored on servers located within the EU/EEA. Where any sub-processor operates outside the EEA (for example, the global network of our object storage provider, or our push notification delivery provider Expo, 650 Industries, Inc., located in the USA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection and, where the provider is certified under it, on the EU-US Data Privacy Framework.

10. Language Versions

This Privacy Policy is available in English, Estonian, and Russian. In the event of any conflict or ambiguity between language versions, the English version governs.

11. Changes to This Policy

We may update this Privacy Policy when our services, the law, or our processing of personal data change. We inform you of changes in the SpotsMe app before they take effect; where a change materially affects how your personal data is used, we will also inform you by email. Every version, with its effective date, remains available at the addresses above.