What we hold, and why.

What we collect

Your email address, because it is how you sign in and how we reach you about your account.

Your name, only if a sign-in provider such as Google or Microsoft supplies it. We do not ask for it.

What you tell us on the one optional screen after sign-in: a role and a dealership or company. Both are optional and you can change or clear them at any time.

What the account does: which pages it opened, the valuations it ran and the registration lookups it made, each with a time. Registration lookups keep the plate, because a plate already looked up is served from our record instead of billed again.

Sign-in records kept by our authentication provider: the time, the IP address and the browser of each sign-in.

Requests for dealer access: the name, dealership, email, phone and note you give on that form, and who reviewed it.

The report by email, if you ask for it: the address, which reports, the page you asked from, and when you confirmed. Each email carries an unsubscribe link that takes effect at once, and a record of every one we sent you. Nothing else is sent to that address.

Dealership contact addresses published on dealers’ own websites, kept with the page they were found on. We write to such an address once, about that dealership’s own stock, and a second time ten days later if there was no answer; a no, a bounce or an unsubscribe is kept so we never write again.

How, and where

Directly from you, when you sign in and when you use the site. Nothing is bought, inferred or scraped about a person; the car listings we observe are dealers’ public advertisements and are not personal information.

Account data is held in a Supabase database in Sydney, Australia. The site runs on Vercel, whose servers and network edge may handle a request outside Australia. Sign-in and report emails are sent through Resend in the United States; the reports come from taj@spotlot.io, a Google Workspace mailbox, and a reply goes to Taj. If you sign in with Google or Microsoft, they see that you signed in to Spotlot. Donations run through Stripe; card details never touch this site.

We use no advertising trackers and no third-party analytics scripts. The only cookie is the one that keeps you signed in.

Why

To run the service and keep it working; to meter the registration lookups that cost us money per plate; to understand which parts of Spotlot are used so we build the right things next; to review requests for dealer access; and to tell you what has changed since you were last here, if you ask us to.

We do not sell personal information, share it with advertisers, or use it for any purpose other than these. Spotlot is funded by donations and there is no intention to change that.

Your account, your call

See and correct. Your account page shows the address, the sign-in methods and what you told us, and lets you change the latter. For anything else, email us.

Delete. The same page deletes the account. Your address, what you told us and the record of what the account did are removed at once. Car observations were never about you and stay. A valuation you ran keeps its inputs with no account against it.

Retention. Account data is kept while the account exists and removed when it is deleted. Dealer-access requests are kept as a record of who was granted what, and why.

Complaints. Email taj@spotlot.io and we will answer within a fortnight. If that does not resolve it, the Office of the Australian Information Commissioner at oaic.gov.au takes complaints about the handling of personal information.