Privacy

01Who we are

Spotto (“we”, “us”) makes an in-product guide that companies add to their own product. It answers their users' questions, shows them where to click, and shows the company's team where people get stuck.

We play two roles. On spotto.live and when you write to us, we decide what happens with your data (we are the controller). Inside a customer's product, the customer decides to use Spotto and we process the data on their behalf (we are their processor). For that part, the customer's own privacy policy applies too, and we sign a data processing agreement (DPA) with them on request.

Controller: Cristea Lelia, Bacău, Romania. Contact: rares@spotto.live.

02What we collect

When you contact us (email or WhatsApp): what you send us, such as your name, email or phone number, your company and your message.

On spotto.live: no accounts, no tracking cookies, no ads. The page loads fonts from Google Fonts, so Google receives your IP address to deliver the font files.

Inside a customer's product, Spotto stores:

• The question as typed, with emails, phone numbers, card or account numbers, links and keys replaced by a label before it is saved.
• How Spotto answered: an approved route, found by AI, or no sure answer.
• The page it was asked on, as a path, with record IDs blanked (for example /contacts/:id).
• For a guided walk: which steps were clicked, under a random number made for that one walk.
• At each step of a walk: the names of the buttons, menus and titles on screen, and where the button people look for is.

Never stored: who asked (no account, no name, no cookie, nothing that links two questions to one person); IP addresses; screenshots; what people type into fields; passwords.

03What Spotto sees on the screen

To guide someone, Spotto reads the structure of the page: the names of buttons, links, menus and titles, and short text next to them. It does not take screenshots and does not read field values, tables or anything the user types.

When a question has no approved route, the question and those visible labels go to our AI provider, the OpenAI API, to find the answer. Emails, phone, card and account numbers, links and keys are replaced first. Data sent through the OpenAI API is not used to train their models.

To stop abuse, a daily limit counts a one-way hash of the IP address and of a random number the browser keeps. The hash changes every day and is deleted after two days. The IP address itself is never stored.

04How we use it

• To answer users inside our customer's product and walk them to the right button.
• To show the customer's team their Team view: what people asked, where they stopped, and recommendations on what to change. Recommendations are written by AI from these facts, about once a day.
• To answer you when you write to us.
• To keep Spotto working and safe, and to make it better.
• The legal basis: our contract with the customer for running Spotto in their product; our legitimate interest in running, securing and improving the service; and, when you write to us, answering what you asked.

We don't sell or rent data, we don't run ads, and nothing is shared for marketing.

05Who we share it with

• OpenAI (API): to find answers when there is no approved route and to write recommendations, with the data masked as described above.
• Hosting and infrastructure: Render (our server), Supabase (database) and Vercel (the spotto.live website).
• Email: Google Workspace, when we write to you.
• The customer whose product the question was asked in: they see it in their own Team view.

OpenAI and some of these providers are based in the United States or use servers there. Those transfers rely on the providers’ Standard Contractual Clauses approved by the European Commission.

06How long we keep it

• Questions and guided walks: deleted automatically after 90 days.
• The daily anti-abuse hash: deleted after two days.
• Your messages to us: as long as we need them to talk with you, then deleted within 12 months.

A customer can ask us to delete all of their data sooner. Email rares@spotto.live and it is gone the same day.

07Your rights

If you use a product that has Spotto in it, that company decides about your data, so please contact them first. We help them answer you. Since Spotto doesn't store who asked, in most cases there is nothing that points back to you.

If you wrote to us, you can ask to see, correct, export or delete your data, or object to how we use it. Write to rares@spotto.live. You can also complain to your local data protection authority.

08Changes

If we change this policy in a way that matters, we update the date at the top and tell our customers before it applies.