What we hold, and why.

Your email address, because it is how you sign in and how we reach you about your account.

Your name, only if you sign in with Google and Google supplies it. We do not ask for it.

What you tell us on the one optional screen after sign-in: a role and a dealership or company. Both are optional and you can change or clear them at any time.

What the account does: which pages it opened, the valuations it ran and the registration lookups it made, each with a time. Registration lookups keep the plate, because a plate already looked up is served from our record instead of billed again.

Sign-in records kept by our authentication provider: the time, the IP address and the browser of each sign-in.

Requests for dealer access: the name, dealership, email, phone and note you give on that form, and who reviewed it.

Requests for an API key: the name, organisation or project, email and description you give, tied to your account, and who reviewed it. A key itself is stored only as a one-way fingerprint; each call made with it is logged with its time, the endpoint and whether it was answered, so the daily allowance can be counted.

The report by email, if you ask for it: the address, which reports, the page you asked from, a one-way fingerprint of your IP address and browser kept as the record of your consent, and when you confirmed. Each email carries an unsubscribe link that takes effect at once. We keep a record of every email we sent you and, where your email app reports it, when it was opened or a link in it clicked. Nothing else is sent to that address.

Dealership contact addresses published on dealers’ own websites, kept with the page they were found on. We write to such an address once, about that dealership’s own stock, and a second time ten days later if there was no answer; a no, a bounce or an unsubscribe is kept so we never write again.

Directly from you, when you sign in and when you use the site. Nothing is bought, inferred or scraped about a person; the car listings we observe are dealers’ public advertisements and are not personal information.

Account data is held in a Supabase database in Sydney, Australia. The site runs on Vercel, whose servers and network edge may handle a request outside Australia. Sign-in and report emails are sent through Resend in the United States; the reports come from taj@spotlot.io, a Google Workspace mailbox, and a reply goes to Taj. If you sign in with Google, Google sees that you signed in to Spotlot. A registration lookup sends the plate and state to CarRegistrationAPI (carregistrationapi.com.au), which answers it. Donations run through Stripe; card details never touch this site.

We use no advertising trackers and no third-party analytics scripts. Two cookies at most: the one that keeps you signed in, and, if you arrive from one of our emails or posts, a marker of which one, kept for 30 days and read only if you subscribe or create an account. Your browser also remembers, on your device only, whether you closed the report card.

To run the service and keep it working; to meter the registration lookups that cost us money per plate; to understand which parts of Spotlot are used so we build the right things next; to review requests for dealer access and API keys; and to tell you what has changed since you were last here, if you ask us to.

We do not sell personal information, share it with advertisers, or use it for any purpose other than these. Spotlot is funded by donations and there is no intention to change that.

See and correct. Your account page shows the address, the sign-in methods and what you told us, and lets you change the latter. For anything else, email us.

Delete. The same page deletes the account: the sign-in, what you told us and the record of what the account did are removed at once. Some things are separate and stay: a report subscription keeps running until you unsubscribe from any of its emails, the record of emails we sent is kept, dealer access you held is marked as ended and kept as history, an API key is switched off and its call log kept with no account against it, requests you made are kept as the record of what was decided, a plate you looked up stays in the shared record without your name, and a valuation you ran keeps its inputs with no account against it. Car observations were never about you and stay.

Retention. Account data is kept while the account exists and removed when it is deleted. Dealer-access and API-key requests are kept as a record of who was granted what, and why, and so is a key’s call log. A report subscription is kept after you unsubscribe, marked as stopped, so that address is never written to again.

Complaints. Email taj@spotlot.io and we will answer within a fortnight. If that does not resolve it, the Office of the Australian Information Commissioner at oaic.gov.au takes complaints about the handling of personal information.