Privacy

01Who we are

Spotto (“we”, “us”) makes a browser companion that shows you where to click in the dashboards you use. This policy covers spotto.live and the Spotto extension.

Controller: Cristea Lelia, Bacău, Romania. Contact: sales@spotto.live.

02What we collect

When you join the waitlist:

• Your email address.
• Optionally, your site, app or company name, and whether you're joining for yourself, your SaaS or your company.

When you use Spotto: the question you type or say; the structure of the page you ask about (the labels of its buttons, menus and fields); a screenshot of the visible part of that tab, with secrets painted over; your language and personality settings; and usage counts (how many questions you asked and what they cost us), so we can run your plan and its limits. If you sign in, your email and a Google account ID.

03What Spotto sees on your screen

To guide you, Spotto reads the structure of the page you ask about: buttons, labels and menus. Values in fields that look like API keys, passwords, tokens or card numbers are masked on your device before anything leaves your browser.

The page structure, the masked screenshot and your question are sent to our server and to OpenAI’s API, which works out where you should click. We don’t store screenshots: they are used for that one answer and discarded. Per OpenAI’s API policy, API data isn’t used to train their models and is kept up to 30 days for abuse monitoring, then deleted. Voice is used only while you hold or switch on the mic: the audio goes to OpenAI for transcription and we don’t keep it. For common tasks Spotto follows a known path on the page and sends no screenshot at all.

04How we use it

• To send your invite and product updates you asked for.
• To hold your founder price.
• To answer you when you write to us.
• To run the service you ask for and keep it safe from abuse. The legal basis is our contract with you when you use Spotto, and your consent for the waitlist emails — you can withdraw it any time.

05Who we share it with

We use a small number of service providers to run Spotto, such as hosting and email delivery. They only process data on our behalf.

OpenAI (AI answers and voice transcription, United States), Supabase (sign-in and database), Render (our server), Vercel (the spotto.live website, global network), Google (sign-in with Google) and, once payments open, Stripe (payments — we never see your full card number). Transfers outside the EU rely on the providers’ standard contractual clauses.

06How long we keep it

Waitlist data is kept until launch plus 12 months, or until you ask us to delete it, whichever comes first. Account data is kept while your account exists and deleted when you ask us to delete it; short-lived server logs used for debugging and abuse prevention are deleted after a few weeks. Screenshots are never stored.

07Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. Write to sales@spotto.live and we'll handle it. You can also complain to your local data protection authority.

08Changes

If we change this policy in a way that matters, we'll update the date at the top and tell you by email if you're on the list.