Privacy statement

Last updated: 20 October 2026

This statement explains what personal data Spotdisco processes, why, and what your rights are. We keep it short and plain. If something is unclear, email us.

Who we are

Spotdisco is a trade name of Clupea Code. KvK (Dutch Chamber of Commerce) number: 86262637. Email: info@spotdisco.com.

We are the controller for the data described below.

Visitors of spotdisco.com

• Two cookies: a session cookie, which remembers the language you chose, and a security cookie that protects forms. Both are needed for the site to work. No tracking by third parties.
• Your session (the language you chose, your IP address and browser) is kept on our server and deleted two hours after your last visit.
• Server logs. Our servers record technical data with each request, such as your IP address, browser and the page requested. We use it only to keep the site running and secure, and delete it after one month.

Influencers with an account

Your account. Your name, email address and password (stored encrypted), and your settings. We need these to provide the service you signed up for (performance of a contract).

Your Instagram account, when you connect it. With your permission, we receive your profile (name, username, profile photo, bio) and your recent posts with their images and captions, through Instagram's official login. We use them to build your page:

• we copy the photos you use on your page to our storage, because Instagram's image links expire;
• we take a colour palette from your photos;
• we use your captions only to write your intro text, and don't keep them afterwards.

The legal basis is your consent, which you can withdraw at any time by disconnecting Instagram in your settings.

The AI step. If you agree to it separately, your bio and captions are sent to an AI service (Anthropic's Claude) to write a short intro text in your voice. Anthropic processes them on our behalf and doesn't use them to train its models. Without your consent, we skip this step.

Your page and products. The links you add, the product details we read from shop pages (name, image, price, availability), your collections and the texts you write. You decide what's on your page; it is public once you publish it.

How you use Spotdisco. When you add, change or remove products and collections. We use this to improve the product and, during the pilot, to measure whether Spotdisco works (legitimate interest).

Email. We send emails that belong to the service, such as login links and alerts when a product sells out. You can turn off alerts and summaries in your settings.

Visitors of influencer pages

Pages on spotdis.co belong to the influencers who make them. To show influencers which products get clicked, we count visits and clicks without cookies:

• we don't store IP addresses;
• unique visitors are counted with a code made from the IP address and browser that changes every day, so we can't recognise you on another day or across pages;
• we store the country, the app or site you came from, and whether you used an in-app browser.

The legal basis is our legitimate interest, and the influencer's, in knowing how a page is used.

When you tap a product, you go to the shop or affiliate platform through our link. From then on, that party's privacy statement applies.

Cookies

Influencer pages set no cookies. On spotdisco.com we set a session cookie, which remembers the language you chose and keeps you logged in, and a security cookie that protects forms. When you log in, we also remember your display settings. These cookies are needed for the site to work, so they don't need consent.

Who processes data for us

• Amazon Web Services: hosting, storage and email, in the EU (Frankfurt).
• Anthropic: the AI step, only with your consent. Anthropic is in the United States; the transfer is covered by standard contractual clauses.
• Meta: the source of your Instagram data when you connect it. Meta's own privacy policy applies to your Instagram account.
• Stripe: payments, if you take a paid plan.

We have a processing agreement with each processor. We don't sell personal data.

How long we keep it

• Account and page data: as long as you have an account. After you delete it, everything is gone within 30 days, including backups.
• Instagram data: until you disconnect Instagram or delete your account. Captions are deleted as soon as your intro text is written.
• Visits and clicks: the individual records for 13 months; after that only totals.
• Server logs: one month.

Delete your data

• Delete your account in your settings. We delete your page, products, Instagram data and photos within 30 days.
• Disconnect Instagram in your settings, or remove Spotdisco under Apps and websites in Instagram's settings. We then delete the data we received from Instagram within 30 days, except the photos and texts still on your published page, until you remove them.
• Or email info@spotdisco.com and we'll do it for you.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, and to receive it in a format you can take elsewhere. Where we rely on your consent, you can withdraw it at any time. Email info@spotdisco.com; we answer within a month.

If you think we handle your data wrongly, please tell us first. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We don't make decisions about you by automated means only.

Changes

When we change this statement, we update the date at the top. If a change matters for you, we'll email you before it applies.