Privacy Policy

Last updated October 22, 2026

This policy explains what personal information Spotlot collects, why, and how we protect it. Spotlot operates in Canada and handles personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

• Account details: your name and email address from the account you sign in with (Sign in with Apple or Google). If you choose Apple's "Hide My Email", we only receive a private relay address.
• Vehicle details: licence plate, make, model, colour and size, so hosts can recognize your car.
• Location: your device location while you use the app, to show spots near you and to confirm check-in at a booked spot. We don't track your location in the background.
• Host information: the address and exact location of your spot, photos of the spot, access instructions, and a document showing you own or control it.
• Identity verification: for hosts, a photo of a government-issued ID and a selfie.
• Bookings, messages and ratings made in the app.
• Payment information: handled by our payment processor, Stripe. Spotlot does not store your full card number. Host payout details are collected and held by Stripe.

How we use it

• To run the service: show spots, take bookings, process payments and payouts, send reminders, and enable chat between drivers and hosts.
• To keep the marketplace safe: verify hosts' identity and right to list a spot, prevent fraud, and handle disputes and reports.
• Automated checks: when a host submits an ID, an ownership document or a listing, an AI model reviews it first. Clear submissions are approved automatically, obvious junk is rejected with a reason, and anything uncertain goes to a person. You can always ask for a human review through support.
• To meet legal, tax and accounting obligations.

What other users see

• Drivers see a spot's approximate area before booking. The exact address, photos and access instructions are shown only to a driver with a paid booking.
• Hosts see the driver's first name, licence plate and vehicle details for bookings at their spot.
• Phone numbers and email addresses are never shown to other users, and are automatically hidden in chat.
• ID photos, selfies and ownership documents are only visible to Spotlot's review team.

Service providers

We use trusted providers to run Spotlot, who process information only on our instructions: Supabase (database and file storage, hosted in Canada), Stripe (payments, payouts and identity verification), Anthropic (AI review of host submissions; images and text are not used to train models), Apple and Google (sign-in), Expo (push notifications) and map providers (Apple Maps, Google Maps).

How long we keep it

We keep account and booking records while your account is open and as long as needed for tax, accounting and legal purposes. Identity verification images are deleted or de-identified once no longer needed to verify you or to meet legal obligations. You can delete your account at any time in the app under Profile → Delete account. That removes your name, contact details, ID images, documents, vehicles and listings right away; booking and payment records are kept only as long as tax law requires.

Your choices and rights

• You can access and correct your information in the app.
• You can turn off location access in your phone's settings (some features, like check-in, won't work without it).
• You can delete your account yourself in the app (Profile → Delete account), or ask us for a copy of your information.

Security

Information is encrypted in transit, private files are stored in access-controlled storage, and access is limited to people who need it to operate Spotlot.

Contact

For privacy questions or requests, email support@spotlot.ca or see the support page.