Privacy Policy

1. Who is responsible

The operator of The Spotlight is responsible for personal information used to run www.claimspotlight.com. The operator is The Spotlight. For privacy questions and requests, email mrearthguyscience@gmail.com.

This policy describes the current directory and board service. Live auctions are coming soon; public payment collection is not enabled.

2. Information we handle

• Account information: a site-specific user identifier and sign-in information supplied by ChatGPT, including an email address used for access checks. We do not receive your ChatGPT password or chat history through sign-in.
• Submitted content: product and board names, descriptions, public author names, uploaded board cover photos, destination links, offers, video links and ownership records.
• Your activity: saved listings, moderation reports, report details, decisions and related timestamps.
• Visit records: for signed-in visitors, the visited listing, account identifier and date. Spotlight visits also record the placement week. We use these to count visits and reduce duplicate counts; a visit count is not a guarantee of unique people or sales.
• Technical information: hosting and sign-in providers may process network addresses, browser and device information, request logs and security information to deliver the service. Sites also provides site traffic analytics.
• Earlier test records: auction and moderation history and any Stripe test customer, setup or payment references created during development may be retained. Card details entered in Stripe are processed by Stripe; our application stores references and limited card details such as brand and last four digits, not full card numbers or security codes.

3. Why we use information

If you accept analytics cookies, Google Analytics measures visits and interactions, including page addresses and browser/device information. The Google tag loads on live-site visits. Before consent or after declining, analytics cookies are disabled; Google may receive cookieless measurement signals. Accepting enables analytics cookies. Advertising signals and ad personalisation are disabled. You can decline or withdraw through Cookie settings at the bottom of the site. Development visits are excluded.

We use account and listing information to provide the features you request, associate content with its owner and allow you to manage it. Where applicable, the legal basis is performing our agreement with you or taking steps you request before an agreement.

We use security records, moderation reports and limited visit records to prevent abuse, investigate complaints, maintain the service and measure listing engagement. We rely on legitimate interests for these purposes where those interests are not overridden by your rights. We may also process information to comply with legal obligations.

Where consent is required for an optional feature or tracking technology, we must obtain it before that processing starts. You may withdraw consent without affecting earlier lawful processing. We do not use this policy as consent to unrelated marketing.

4. What becomes public

Published listings and boards, including their descriptions, links and the public author name you choose, can be viewed and copied by other people and may be indexed by search engines. Do not include private information you do not want to publish. Aggregate Spotlight visit counts can appear publicly. Report details and payment settings are not intended for public display.

5. Providers and external services

We use OpenAI Sites for hosting and ChatGPT sign-in, with Cloudflare-backed application infrastructure and database and image storage. Uploaded cover photos are resized for display and stored with the board; replacing or removing a cover stops it being displayed but does not immediately erase earlier stored files. Authorised administrators can access records needed to operate and moderate the service. Stripe processes information when authorised administrators use the current payment testing tools.

When no cover is uploaded, we may search Wikimedia Commons using a general topic derived from your board text and store a matching public-domain or CC0 image. We do not send your account details to that search. Website icons are fetched through our server using Google’s favicon service. If that fails, your browser may request an icon directly from Google, exposing standard connection information such as your IP address. YouTube and Vimeo players load when you choose to load a video; those providers then receive connection information and may use their own storage technologies. Following an external link also shares information directly with its destination.

Providers may process information outside your country. Applicable provider arrangements and required transfer safeguards must be confirmed by the operator before this draft is finalised; we do not promise that all processing occurs in the UK. Relevant providers also explain their own processing in their privacy notices.

6. Cookies and browser storage

Hosting and sign-in services use the session and security mechanisms necessary for access. The Spotlight previously issued an HttpOnly, Secure cookie named __Host-spotlight-guest so guests could manage their submissions. New listings now require sign-in. An existing guest cookie can still identify earlier content when you choose to claim it into your account; its original expiry was up to one year after issue.

Clearing an existing guest cookie can remove your ability to claim earlier guest content. The cookie is a browser credential, not a publicly shared account identifier. Embedded video providers and direct favicon requests may involve additional provider technologies, as described above.

7. Retention and removal

We retain active account-linked content for as long as it is needed to provide the service. Editing or deleting a listing removes or changes what is displayed, but deletion currently archives the record rather than immediately erasing all associated data.

Moderation, security, visit and historical auction records are retained where needed to investigate abuse, resolve disputes or meet legal obligations. The application does not currently have an automatic timed deletion schedule for these records. The operator must confirm and implement a retention review schedule before this draft is finalised. Hosting backups and provider logs follow the relevant provider arrangements.

8. Your choices and rights

You can manage your public listings and boards through your account and choose whether to load external videos. Depending on applicable law, you may request access, correction, erasure, restriction or portability of personal information, and object to processing based on legitimate interests. These rights have exceptions, and we may need to verify identity before responding.

Send privacy requests to mrearthguyscience@gmail.com. If UK data protection law applies, you can also complain to the Information Commissioner’s Office, or contact the relevant authority where you live.

9. Security and automated checks

We use access controls, HTTPS, server-side ownership checks and restricted administrative features. No internet service is completely secure. Automated rules may reject a listing or URL; administrators handle reports and promotional review. We do not use the current listing checks to make decisions intended to have legal or similarly significant effects on individuals.

10. Changes

We will update this policy when our practices change, including before enabling live payments or introducing materially different tracking. We will identify the effective date and give appropriate notice of significant changes.