Privacy policy
Last updated October 2026
Spotlights operates Spotlight. This policy explains what we collect and why. We don't sell personal data and we don't run third-party ad trackers.
What we collect
- Listing owners: your email and the listing details you submit. Payments are processed by PayPal; we never see or store your card details. We keep payment records (amount, status, payment provider and its reference ids) for accounting.
- Visitors: we count impressions and clicks. To de-duplicate clicks we compute a one-way hash of IP address, browser user-agent and the date, which rotates daily and cannot be reversed. We do not store IP addresses and do not set tracking cookies.
- Cookies: only functional ones — a short-lived cookie that shows your manage link after checkout, and a session cookie for administrators.
Processors
PayPal (payments), Resend (transactional email), Cloudflare (hosting, DNS and email forwarding) and Supabase (database).
Retention
Listing data is kept while your listing exists. Payment records are kept as long as tax law requires. Click de-duplication hashes are deleted after 3 days; only daily totals are kept.
Your rights
You can ask us to access, correct or delete your data at hello@spotlights.lol. We answer within 30 days.