Privacy Policy

This Privacy Policy explains how Spot ("we", "us", or "our") collects, processes, stores, and protects your personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and applicable international data protection standards.

1. Personal Data We Collect

We collect only the minimum personal data necessary to operate the App and verify the authenticity of shared locations:

• Account & Authentication Data: Your email address, encrypted password hash, and email verification status.
• Profile Data: Your chosen username, optional biography, and profile avatar image.
• Device GPS Location Data: With your explicit device permission, we collect precise GPS coordinates (latitude and longitude) while the App is in use to display nearby places on the map and allow you to drop location pins. We do not track your background location when the App is closed.
• Photo EXIF Metadata: When you select or capture a photo to publish a spot, the App inspects embedded Exchangeable Image File (EXIF) metadata (specifically GPS coordinates and capture timestamps) solely to verify that the photo was genuinely taken at the pinned location. Please note that coordinates attached to a published post are visible to other users on the public map.
• User-Generated Content: Photos, location descriptions, comments, saved bookmarks, and content reports you submit.
• Technical & Diagnostic Data: IP addresses, device type, operating system version, language preference, and error logs required for security auditing, rate-limiting, and abuse prevention.

2. Legal Basis & How We Use Your Data

Under the Saudi PDPL, we process your personal data based on your explicit consent (granted upon registration and device permission prompts) and contractual necessity to provide the App's core features:

• To create and authenticate your account and prevent automated spam or disposable email abuse.
• To populate geographic feeds, render map pins, and verify the physical authenticity of uploaded spot photos.
• To enable cross-lingual search and discovery across Arabic and English content.
• To enforce our Terms of Service, process user reports, and maintain platform security.

3. Data Sharing, Storage & Cross-Border Processing

Spot never sells, rents, or trades your personal data to advertisers or data brokers. We share limited data strictly with essential technical infrastructure providers:

• Primary Data Hosting: Your core account data and user-generated content are hosted on secure cloud infrastructure located within the Kingdom of Saudi Arabia.
• Mapping & Translation Services: To display map tiles, convert coordinates into readable place names (reverse-geocoding via providers such as OpenStreetMap), and support cross-lingual search, anonymized coordinates or text strings are transmitted to external API providers that may process requests outside Saudi Arabia. No email addresses or account credentials are ever shared with these services.
• Legal Compliance: We may disclose specific records if strictly required to do so by a valid judicial order or competent regulatory authority in the Kingdom of Saudi Arabia.

4. Your Rights Under the Saudi PDPL

Subject to statutory conditions, you hold the following rights regarding your personal data:

• Right to Know & Access: To be informed about how your data is collected and to view the personal data held in your profile.
• Right to Rectification: To update or correct your profile details directly within the App settings.
• Right to Withdraw Consent: To revoke camera or location permissions at any time through your mobile device settings, or withdraw platform consent by deleting your account.
• Right to Erasure (Destruction): To permanently delete your account and personal data at any time.

5. Data Retention & Instant Account Deletion

We retain your personal data only for as long as your account remains active:

• In-App Account Deletion: You may permanently delete your account at any time by navigating to Settings > Delete Account inside the App. Upon confirmation, your profile, email address, uploaded photos, posts, and comments are immediately erased from our active production database.
• Backup Purge Cycle: Residual encrypted copies stored in automated disaster-recovery server backups are automatically overwritten and purged within thirty (30) days, unless retention is strictly required to investigate an active security breach or comply with a legal order.
• Unverified Accounts: Accounts that fail to complete email verification within fourteen (14) days of registration are automatically purged from our system.

6. Data Security

We protect your information using TLS/HTTPS encryption in transit, hashed authentication credentials, Web Application Firewall (WAF) filtering, and strict access controls. While we implement rigorous security standards, no method of electronic transmission or storage is infallible, and you are responsible for keeping your account password confidential.

7. Contact Us

To exercise your data rights or report a privacy concern, contact us at: spot.support.official@gmail.com