Privacy policy

1. Controller

Spotstar
Owner: Luca-Matheo Rohrbach
Mainluststraße 17
60329 Frankfurt am Main
Germany
Email: info@getspotstar.com

We have not appointed a data protection officer because we are not legally required to.

2. The essentials

• We use no analytics, tracking or advertising tools and no social media plugins.
• We only set cookies that are technically necessary. That is why there is no cookie banner.
• Our fonts are hosted on our own server. Loading the page does not connect you to any third party.
• When someone taps a Spotstar card, we store neither names nor IP addresses or device data.

3. Hosting and server logs

This website and the Spotstar application run at Sliplane on servers of Hetzner Online GmbH in Germany [please confirm: provider once the contract is signed]. Whenever a page is requested, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred and browser identifier. This data is written to log files and deleted after [please confirm: retention period stated by the hosting provider].

The purpose is to deliver the website securely and reliably. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We have a data processing agreement with the hosting provider under Art. 28 GDPR.

4. Cookies

We only set cookies that are technically required to use the website:

• spotstar_session: keeps you signed in to the customer area. Stored for 30 days or until you sign out. Our database only holds a hash of this identifier.
• locale: remembers the language in which you last used the website, so that sign-up and the customer area appear in the same language. Stored for 1 year.

The legal basis for setting these cookies is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); for the related processing it is Art. 6(1)(b) GDPR (sign-in) and Art. 6(1)(f) GDPR (language).

5. Customer account

For a Spotstar account we process your name, your email address, your business name, the link to your Google review page and, if you pick your business through the search, its address and Google identifier (Place ID). We only store your password as a cryptographic hash, never in plain text.

The purpose is to provide Spotstar; the legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual steps). The data is kept until you delete your account, which you can do yourself at any time in the settings. This also deletes your business and all stored card contacts. Statutory retention obligations, for example for invoices, remain unaffected.

Account on the waitlist: before Spotstar launches, signing up creates an account on the waitlist. We process the same details as above so that we can activate your account at launch and tell you by email. Until then we provide no services; in particular we do not connect a Google profile or write replies. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request). You can delete the account yourself in the settings at any time.

Confirming your email address: after you sign up, we email you a link. Only once you confirm it do we create your account and your business. Until then we keep your details provisionally, for no longer than 24 hours; without confirmation we delete them afterwards. If an account already exists under the address, we send a note saying so instead.

Forgotten password: if you request a new password, we email you a link. It is valid for 60 minutes and can be used once; our database only stores a hash of it. Resetting your password signs out all existing sessions of your account.

Abuse protection: to prevent password guessing, automated requests and spam, we count attempts at sign in, registration, password reset, report requests and business search, depending on the form per IP address, email address or account. These counters only live in the server's memory and are deleted after just over three hours at most. The legal basis is Art. 6(1)(f) GDPR.

5a. Connecting your Google Business Profile

When you connect your Google Business Profile in the dashboard, you sign in with Google and allow Spotstar to manage your profile. We do not receive your Google password. Google gives us an access key, which we store encrypted. We use it to fetch your business's reviews (stars, text, date, existing replies), to write replies, to publish them on your behalf depending on your setting, and to read the details in your profile (description, phone numbers, website, opening hours, special hours). We do not store the reviewers' names.

Changes to your profile and posts. Spotstar suggests additions to these details and posts for your profile (updates, events, offers). We only send a change or a post to Google once a user of your Spotstar account has approved that individual suggestion in the dashboard. There is no automatic publishing for this. Approved content becomes publicly visible on Google under your business's name; Google is responsible for displaying it there.

We keep a log of every change and every post: the suggestion, who approved it and when (the user's name), what was sent to Google and what Google responded. After each approval the users of your account receive a confirmation by email, plus at most once a week a note about new suggestions. [please confirm: legal basis for the log and the notifications, proposed Art. 6(1)(b) and (f) GDPR]

For suggestions we also check whether the website stored in your profile can be reached. Our server requests that address once a day.

To write the replies, to analyse reviews by theme and to draft the profile description and posts, we send review texts, your notes and keywords, and your business's name and address to our AI service Claude by Anthropic Ireland, Limited (Dublin). Processing takes place in the USA (see section 11). Anthropic does not use the data for training and deletes it within 30 days, or at the latest after two years if a breach of its usage policy is suspected. The legal basis is Art. 6(1)(b) GDPR. Where reviews contain personal data of third parties, we process it on your behalf under the data processing agreement.

You remain the owner of your Business Profile. You can disconnect at any time in the dashboard. We then revoke the access at Google and delete the fetched reviews, profile details, suggestions, drafts and analyses. We keep the log of your approvals as a record until you delete your account [please confirm: retention period of the log]. When you delete your account, we delete everything. Your reviews, published replies, profile details and posts remain on Google; you can change or remove them there yourself.

[please confirm: Google's policies for the Business Profile API limit how long content fetched from Google may be stored (30 days). Whether the current storage of reviews and of the log until disconnection is compatible with this is open.]

6. Spotstar cards (NFC)

When someone taps a Spotstar card, we only store which card was used at what time and which business it belongs to. We do not store names, IP addresses or device data. The IP address is only processed briefly for technical reasons, as described in section 3.

The purpose is to show the business in its dashboard how often the card was used. The legal basis is Art. 6(1)(f) GDPR. These entries are deleted automatically after 24 months.

The person is then forwarded to the business's Google review page. Everyone lands on the same page; we filter nobody. Google is responsible for reviews submitted on Google, and Google's privacy policy applies.

7. Searching for your business

When you search for your business in our forms, our server looks up matching listings via the Google Maps Platform. We send the search term you typed and a random session identifier, but not your IP address. We do not store the search term. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to spare you typing in your address and review link.

8. Free review report

When you request a report on our website, we process your email address, the selected business (name and Google identifier), the time and the chosen language. We use this data to create the report and email you the link. The legal basis is Art. 6(1)(b) GDPR (your request).

To prevent abuse, we limit reports to three per email address and five per business per day (Art. 6(1)(f) GDPR).

For the content we retrieve public data about your business and comparable businesses via the Google Maps Platform, including up to five review excerpts without the reviewers' names. The report texts are written with the help of the AI service Claude by Anthropic Ireland, Limited (processing in the USA). We send calculated figures and these review excerpts, but neither your email address nor any reviewer names.

The report can be viewed for 30 days; after that we delete its contents. We delete the request itself, including your email address, completely 90 days after it was received. We only use your email address for this report and do not send you marketing without your separate consent.

8a. Waitlist

Before Spotstar launches, you can join a waitlist on our website. For this we store your email address, the language you chose and the time of sign-up. You first receive an email with a confirmation link. Only once you click it are you on the waitlist (double opt-in); we then also store the time of confirmation. We only write to you to tell you that Spotstar has launched.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example with a short email to info@getspotstar.com; we will then delete your entry. We delete unconfirmed entries after 7 days and confirmed ones after the launch message, at the latest when you withdraw your consent.

9. Emails from Spotstar

We send Spotstar emails (report links, waitlist and sign-up confirmation, password resets, confirmations and notes about your Google profile) through the email service of Resend, Inc. (USA). The emails are sent via servers in the EU (Ireland). The service receives your email address and the content of the message for this purpose. The legal basis is Art. 6(1)(b) GDPR, and your consent for waitlist emails (section 8a).

10. Contacting us by email

If you write to info@getspotstar.com, we process your message and contact details to answer your enquiry. Our mailbox is hosted by IONOS SE in Germany. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR. We delete messages once they are dealt with and no retention obligation applies.

11. Recipients and transfers to third countries

Only these service providers receive personal data, and only for the stated purpose:

• Hosting (section 3): Sliplane GmbH, Berlin, with servers of Hetzner Online GmbH in Germany and encrypted backups at Impossible Cloud GmbH in Frankfurt.
• Mailbox (section 10): IONOS SE, Germany.
• Google Maps Platform (sections 7 and 8): Google Ireland Limited, Ireland. A transfer to Google LLC in the USA is possible.
• AI service (sections 5a and 8): Anthropic Ireland, Limited, Ireland; processing takes place at Anthropic, PBC in the USA.
• Email delivery (section 9): Resend, Inc., USA; sent via servers in Ireland. [please confirm: Resend's listing on dataprivacyframework.gov, otherwise standard contractual clauses]

Where data is transferred to the USA, this is based on [please confirm per provider: the adequacy decision for the EU-US Data Privacy Framework if the provider is certified, otherwise the EU Standard Contractual Clauses]. We sign data processing agreements with all providers that process data on our behalf.

12. Retention at a glance

• Customer account and business: until the account is deleted
• Sign-in session: 30 days or until you sign out
• Password reset link: 60 minutes at most
• Abuse protection counters: just over 3 hours at most, in memory only
• Card contacts: 24 months
• Report contents: 30 days; report request including email address: 90 days
• Waitlist: unconfirmed 7 days; confirmed until the launch message or until you withdraw consent
• Language choice (cookie): 1 year

An automatic job deletes expired data once a day.

13. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR) on grounds relating to your particular situation.

An informal email to info@getspotstar.com is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden.

14. Obligation to provide data, no automated decisions

We need the details in the customer account and the report form to provide the service. Without them we cannot create an account or a report. No automated decision-making within the meaning of Art. 22 GDPR takes place.

15. Last updated

30 September 2026