Welcome to Vspot! Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services, including our marketplace connecting brands and content creators.

📱1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password (or authentication token via Google Sign-In).
• Creator Profile: If you register as a content creator, we collect your display name, bio, social media handles, platforms (Instagram, TikTok, YouTube, Twitter), follower counts, niches, and spoken languages.
• Brand Profile: If you register as a brand, we collect your business name, description, category, website, location, and contact information.
• Spot / Campaign Information: Details you provide when creating a spot (title, description, location, reward type and value, deadlines, follower requirements, content expectations).
• Application Messages: Messages you send when applying to a spot or communicating with brands/creators through the in-app chat.
• Content Submissions: Photos, videos, links, and descriptions you submit as deliverables for a spot collaboration.
• Profile Picture: Optional profile images you upload.

1.2 Payment Information

• Stripe Connect: If you are a creator receiving payments, you complete Stripe’s onboarding process (Stripe Connect). Stripe collects your identity documents, bank account / IBAN details, and tax information directly. Vspot does not store your bank details, card numbers, or identity documents.
• Brand Payments: When a brand pays for a spot, the payment is processed by Stripe. We store only the Stripe transaction ID, amount, and status — never your full card number.
• Transaction Records: We record payment statuses (pending, paid, transferred, refunded) and transaction details to manage the collaboration lifecycle.

1.3 Information Collected Automatically

• Device Information: Device type, operating system, and unique device identifiers.
• Location Data: With your permission, we collect location data to show nearby spots and enable location-based features.
• Usage Data: How you interact with the app, features you use, screens you visit, and actions you perform.
• Push Notification Tokens: We store your Firebase Cloud Messaging (FCM) token to send you notifications about applications, messages, content reviews, and payments.
• Analytics Data: Anonymous statistics to improve our services.

1.4 Information from Third Parties

• Google Sign-In: If you sign in with Google, we receive your name, email, and profile picture from your Google account.
• Social Media Platforms: We may access publicly available data from platforms like Instagram, TikTok, YouTube, and Twitter (follower counts, public profile info) to verify creator profiles and display relevant statistics.
• Stripe: We receive payment confirmation, payout statuses, and onboarding completion status from Stripe.

🎯2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Create and manage your account (user, creator, and/or brand profiles)
• Operate the marketplace: match brands with creators, manage applications, reservations, and collaborations
• Process payments: charge brands, manage funds on our platform account, and transfer payouts to creators via Stripe Connect
• Show you relevant spots based on your location, preferences, and follower requirements
• Send push notifications about new applications, accepted/rejected candidatures, chat messages, content reviews, and payment statuses
• Enable in-app chat between brands and creators for collaboration coordination
• Enforce platform rules: Fair Play limits (max 5 pending applications, max 3 active reservations), content delivery deadlines (24–120 hours depending on content type), and content review timeframes
• Send you important updates about our services
• Respond to your comments, questions, and support requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent or unauthorized activities

🤝3. Information Sharing

We do not sell your personal information. We may share your information in the following situations:

• Between Brands and Creators: When a creator applies to a spot, the brand can see the creator’s public profile (display name, bio, platforms, follower counts, niches). When a brand accepts an application, both parties can communicate via in-app chat. We never share email addresses, phone numbers, or private contact details between users.
• Stripe (Payment Processing): We share necessary transaction data with Stripe to process payments and transfer payouts to creators. Stripe acts as an independent data controller for payment data. See Stripe’s Privacy Policy.
• Firebase / Google Cloud: We use Firebase for authentication, push notifications, and cloud infrastructure. See Firebase Privacy.
• With Your Consent: When you explicitly agree to share information.
• Legal Requirements: When required by law or to protect our rights and safety.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

💳4. Payment Data & Stripe

Vspot uses Stripe as its sole payment processor. Here’s how payment data is handled:

• Brand Payments: When a brand publishes a spot, they pay the total charge (reward + platform fees + VAT) via Stripe. Funds are received by Vspot’s platform account and the cash reward is transferred to the creator upon content approval.
• Creator Payouts: Creators receive payments through Stripe Connect. To receive payouts, creators must complete Stripe’s identity verification (KYC) process.
• What Vspot Stores: Transaction IDs, amounts, payment statuses (pending, paid, refunded), and Stripe account IDs. We do NOT store card numbers, bank account details, or identity documents.
• What Stripe Stores: Stripe independently stores and processes your card details, bank account information, and identity verification documents under their own privacy policy.
• Platform Fees: Vspot charges a 15% platform commission + applicable VAT on each transaction. This is calculated transparently and shown to the brand before payment.

📍5. Location Data

Vspot uses location data to enhance your experience:

• Show spots near your current location on the marketplace map
• Provide accurate distance calculations to spots
• Allow brands to set a specific location for their spot
• Display relevant city-based content

🔔6. Push Notifications

Vspot sends push notifications to keep you informed about:

• New applications to your spots (for brands)
• Application accepted/rejected status (for creators)
• New chat messages
• Content submission and review updates
• Payment confirmations and payout notifications
• Collaboration deadlines and reminders

You can disable push notifications at any time through your device settings or within the app.

🔐7. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of all data in transit (HTTPS/TLS)
• Secure authentication via Firebase Auth (email/password and Google Sign-In)
• JWT-based API authorization with secure token handling
• Stripe PCI DSS Level 1 compliance for all payment data
• Server-side validation and sanitization of all inputs
• Role-based access controls (user, creator, brand, admin)
• Secure cloud infrastructure (Fly.io, PostgreSQL with encryption at rest)
• Regular security audits and dependency updates

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

⏰8. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. We may retain certain information as required by law or for legitimate business purposes.

• Active accounts: Data retained for the duration of account activity.
• Payment records: Transaction data retained for 7 years as required by tax and financial regulations.
• Chat messages: Retained for the duration of the collaboration plus 6 months for dispute resolution.
• Content submissions: Retained as long as the collaboration record exists.

When you delete your account:

• Your personal data will be deleted within 30 days
• Your creator or brand profile will be removed
• Active collaborations must be completed or cancelled before deletion
• Payment records may be retained as required by law
• Some anonymized data may be retained for analytics
• Backup copies may persist for up to 90 days

🗑️8.1 Account Deletion

You have the right to delete your account at any time. To delete your account, you can:

• In-App: Go to Profile → Settings → Delete Account
• By Email: Send a request to contact.desapli@gmail.com with the subject “Account Deletion Request” and include the email address associated with your account.

⚖️9. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Portability: Request your data in a portable format
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing

To exercise these rights, please contact us at the email below.

🍪10. Cookies and Tracking

Our mobile app uses local storage and similar technologies to:

• Remember your preferences and settings (language, theme)
• Keep you signed in (authentication tokens)
• Cache data for offline use and performance
• Understand how you use our app (anonymous analytics)

👶11. Children’s Privacy

Vspot is not intended for children under 16 years of age. The marketplace involves financial transactions and legal agreements that require users to be of legal age to enter contracts. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

🌍12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our servers are hosted on Fly.io infrastructure. We ensure appropriate safeguards are in place for such transfers in compliance with applicable laws, including GDPR Standard Contractual Clauses where applicable.

🔄13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the “Last updated” date
• Sending a push notification or email for significant changes

🇪🇺14. GDPR Compliance (EU Users)

For users in the European Economic Area (EEA), we process your data based on:

• Consent: Where you have given consent for specific purposes (location, notifications)
• Contract: To perform our contract with you (providing the marketplace service, processing payments)
• Legitimate Interests: For fraud prevention, security, and service improvement
• Legal Obligation: To comply with tax, financial, and legal requirements

You have the right to lodge a complaint with a supervisory authority (e.g., CNIL in France, AEPD in Spain).