GDPR And Data Processing

Spontio acts as controller for consumer accounts, waitlists, marketplace operations, business onboarding, billing administration, and product safety decisions.

Service providers act as processors where they process data on Spontio instructions, including hosting, transactional email, payments, and push delivery.

Contract is used for account access, team invitations, business tools, billing, saved coupons, and redemptions.

Legitimate interests are used for service security, fraud prevention, launch planning, support, operational analytics, and product improvement.

Consent is used where required for optional marketing, certain notification preferences, and non-essential tracking.

Account data is retained while the account is active and then deleted or anonymized when deletion is requested, unless retention is needed for legal, billing, dispute, or abuse-prevention purposes.

Payment, invoice, dispute, and ledger records may be retained longer to meet accounting, tax, fraud, and legal obligations.

Launch subprocessors include Cloudflare for transactional email sending, Stripe for payment processing, Expo for push notification delivery, and the configured hosting/runtime provider.

Subprocessor and international-transfer details should be reviewed before public launch and kept aligned with the production vendor list.

Data subject requests are reviewed through the published support contact. Consumer profiles also support authenticated export and deletion through the mobile API.

Spontio will verify request identity before acting on access, deletion, correction, restriction, objection, or portability requests.