Overview
Spots (spots.fm) is a sponsorship marketplace where independent creators list sponsorship spots on their channels and advertisers book them. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. Spots is operated by Nerd North Inc., a company based in British Columbia, Canada ("Spots", "we", "us"), which is responsible for (the "controller" of) the personal information described here.
Information we collect
Account information. When you sign up we collect your name, email address, and password (stored only as a secure hash). Creators also add a username, profile details, and an avatar.
Waitlist sign-ups. If you join the waitlist on spots.fm, we collect your email address, whether you're interested as a creator or a business, and anything you choose to tell us about your channel or company.
Channel and listing information. Creators provide details about their channels (such as names, descriptions, links, artwork, and audience stats) and the sponsorship spots, prices, and availability they offer. You can enter this by hand or import it from a connected platform.
Booking information. Advertisers who book a spot give us their company name, email address, and the details of their sponsorship, including ad creatives and brand assets.
Payment information. Payments and payouts are processed by Stripe. Card and bank details go directly to Stripe; we receive only limited information such as payment status, amounts, and the last digits of a card.
Connected platform credentials. If you connect a newsletter or podcast platform with an API key, we store that key encrypted so we can keep your channel stats up to date. You can remove it at any time.
Usage and device information. Like most websites, our servers log basic technical information such as IP address, browser type, and pages visited. We use cookies to keep you signed in and to secure your session. Our support chat, provided by Crisp, sets its own cookies so it can keep your conversation going between pages and visits. We don't use advertising or analytics trackers.
Support conversations. If you contact us by email or through the in-app chat, we keep that conversation so we can help you.
YouTube data
Creators can choose to connect a YouTube channel to fill in their channel details automatically. Spots uses YouTube API Services to do this. By connecting, you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
When you connect, we ask Google for read-only access to your YouTube account and read:
- your channel's name, description, URL, and artwork
- your channel's subscriber count, total views, and video count
- the publish dates and view counts of your recent uploads, to work out posting cadence and average views
We use this only to fill in your channel listing on Spots, which you can review and edit before saving. We never post, upload, or change anything on YouTube.
To keep your listing accurate, we store an encrypted Google refresh token with your channel and use it to read the same details again every day. Each refresh updates your stats, and updates your channel's description, YouTube link, posting frequency, and artwork only if you haven't changed them yourself since they were imported. If we can't refresh imported details for 30 days, we delete them, as YouTube's API policies require. We fill in your channel name from YouTube when you connect, and never change it on a refresh. If you haven't changed it, it's replaced with a placeholder name when you disconnect YouTube or we lose access; a name you edited yourself is kept. Disconnecting YouTube removes the imported channel name but keeps your channel's short link (its web address on Spots), which you can change at any time in your channel settings.
The details you save become part of your public channel page so advertisers can see them. We do not sell YouTube data or use it for advertising, and we do not share it with anyone except as described in this policy. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
You can edit or delete the imported details from your channel settings at any time. To stop the refreshes, choose Disconnect YouTube in your channel settings: as YouTube's API policies require, we delete the stats and channel details we imported and replace an unedited channel name with a placeholder (anything you edited yourself stays), then revoke Spots' access straight away, unless another of your Spots channels still uses the same YouTube account (if Google can't be reached at that moment, we keep retrying until it can). Deleting the channel or closing your account also removes the data and revokes our access on the same terms. You can also revoke Spots' access from your Google security settings. We check for this every day, and when we find that access was revoked we delete the imported data and stored token and let you know by email.
How we use information
- to run Spots: create accounts, publish creator pages, and process bookings, payments, and payouts
- to send messages about your account, bookings, and payments
- to contact waitlist sign-ups about early access and onboarding
- to respond to support requests
- to keep Spots secure, prevent fraud and abuse, and fix problems
- to improve Spots and understand how it is used
- to meet legal, tax, and accounting obligations
What is public
Creator pages are public by design. Your creator profile, published channels, stats, and sponsorship spots can be seen by anyone with the link, and may appear in search results. Advertisers' booking details are shared with the creator they book.
Who we share information with
We do not sell or share personal information for advertising. We share it only:
- between the creators and advertisers involved in a booking, as needed to deliver it
- with team members a creator invites to their account
- with service providers that help us run Spots, under agreements that limit how they use it: Stripe (payments and payouts), Hatchbox and our cloud server provider (hosting), Cloudflare (file storage and network delivery), Bento (email), and Crisp (support chat)
- when required by law, or to protect the rights and safety of our users and Spots
- with a successor if Spots is involved in a merger or sale, subject to this policy
How long we keep information
We keep your information while your account is open. To close your account, email help@spots.fm. When we close it, we delete or anonymise your personal information within 30 days, except records we must keep for legal, tax, or accounting reasons, such as payment history, and copies in backups, which expire on their own.
We keep waitlist sign-ups until you join Spots or ask us to remove you. You can unsubscribe from any email we send or email help@spots.fm, and we'll delete your sign-up.
Legal bases
Where privacy laws such as the GDPR apply, we rely on these legal bases:
- Contract: to run your account, publish your pages, and process bookings and payments
- Legitimate interests: to keep Spots secure, prevent fraud, provide support, and improve the service
- Legal obligation: to keep tax and accounting records and respond to lawful requests
- Consent: when you join the waitlist or choose to connect a platform such as YouTube. You can withdraw it at any time
International transfers
Spots is based in Canada, and our service providers process personal information in the United States and other countries. When we transfer personal information out of the EU, UK, or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
Your choices and rights
You can view and update most of your information in your account settings. You can ask us for a copy of your information, to correct it, or to delete your account by emailing help@spots.fm. Depending on where you live, you may also have the right to restrict or object to our use of your information, to receive it in a portable format, and to complain to your local data protection authority. We will honour these rights as the law requires.
Security
We use encryption in transit, hashed passwords, and encrypted storage for connected-platform credentials, and we limit who can access personal information. No service can guarantee perfect security, so please use a strong, unique password.
Children
Spots is not intended for anyone under 16, and we do not knowingly collect information from children. Creators aged 16 or 17 need a parent or legal guardian's agreement to use Spots (see our Terms of Service). If you believe a child under 16 has given us information, email help@spots.fm and we will delete it.
Changes to this policy
We may update this policy as Spots changes. When we do, we will update the date at the top, and for significant changes we will let you know by email or in the app.
Contact
Questions about privacy? Email help@spots.fm.