Privacy Policy

Last Updated: March 15, 2026

        Privacy Summary: We collect minimal data needed to provide our service. Uploaded files are processed using temporary storage, and working copies are cleaned up after parsing. We may retain secure internal copies in limited circumstances for parser testing and quality improvement. We don't sell your data to anyone.
        

1. Introduction

WebSystems Inc. doing business as SpotProof ("SpotProof," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

Data Type	Examples	Purpose
Account Information	Name, email, company name, password	Create and manage your account
Payment Information	Billing address, payment method (processed by Stripe)	Process subscriptions
Uploaded Files	Post-log files (Excel, CSV, text)	Provide parsing service
Communications	Support requests, feedback	Respond to inquiries

2.2 Information Collected Automatically

Data Type	Examples	Purpose
Usage Data	Files processed, API calls, features used	Billing, service improvement
Device Information	Browser type, operating system, IP address	Security, troubleshooting
Log Data	Access times, pages viewed, errors	Service maintenance

2.3 Information We Do NOT Collect

We do not retain uploaded files as part of normal customer-facing processing after parsing completes
We do not access or read the content of your files beyond automated parsing
We do not collect sensitive personal information (SSN, health data, etc.)
We do not track you across other websites

3. How We Handle Your Uploaded Files

            Key Privacy Protection: Your uploaded files are processed securely and used only for parsing and service improvement. Working copies used during parsing are cleaned up after processing. In limited circumstances, we may retain secure internal copies for parser testing and quality improvement. We never share your files with third parties except approved service providers operating on our behalf.
        

3.1 What Happens When You Upload

File is uploaded to our secure servers
File is processed using temporary storage during parsing
Structured data (spots, dates, times) is extracted
Secure internal copies may be retained in limited circumstances for parser testing and quality improvement
Structured results are returned to you

3.2 What We Store

After processing, we may retain:

Parse metadata: Filename, file size, processing time, confidence score
Structured results: Extracted spot data (dates, times, durations, ISCI codes)
Usage records: Number of files processed for billing
Archived uploaded files: Secure internal copies retained in limited circumstances for parser testing and quality improvement

3.3 Template Learning

Our system learns parsing patterns to improve accuracy. These "templates" contain only structural information (column positions, date formats, section markers) - never your actual data. Templates may be used system-wide to benefit all users.

4. How We Use Your Information

We use collected information to:

Provide the Service: Process files, return results, manage accounts
Process Payments: Bill subscriptions, send receipts
Communicate: Send service updates, respond to support requests
Improve the Service: Analyze usage patterns, fix bugs, develop features
Ensure Security: Detect fraud, prevent abuse, enforce terms
Comply with Law: Respond to legal requests, meet regulatory requirements

5. How We Share Your Information

We do NOT sell your personal information. We may share information with:

5.1 Service Providers

Supabase: Database and authentication
Stripe: Payment processing
Railway: Cloud hosting
Cloudflare: Security and CDN
Anthropic: AI-assisted format detection (samples of file content may be sent to identify column layouts for unrecognized formats; Anthropic does not retain submitted data for training)

These providers are bound by confidentiality obligations and only process data as directed by us.

5.2 Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect our rights, safety, or property.

5.3 Business Transfers

In a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership.

6. Data Retention

Data Type	Retention Period
Uploaded files	May be retained temporarily for quality improvement, then deleted
Parse results	Duration of your account + 30 days
Account information	Duration of account + 30 days after deletion
Billing records	7 years (legal requirement)
Server logs	90 days

7. Data Security

We implement appropriate technical and organizational measures to protect your information:

Encryption: Data encrypted in transit via TLS
Access Controls: Role-based access, principle of least privilege
API Security: API keys are hashed, never stored in plaintext
Infrastructure: Hosted on established cloud providers (Supabase, Railway, Cloudflare)
Monitoring: Security monitoring and logging

No system is 100% secure. Please protect your account credentials and report any security concerns immediately.

8. Your Rights and Choices

8.1 Access and Portability

You can access your account information and download your parse history at any time through the Service.

8.2 Correction

You can update your account information through your account settings or by contacting us.

8.3 Deletion

You can request deletion of your account and associated data by contacting us at [email protected]. We will delete your data within 30 days, except where retention is required by law.

8.4 Marketing Communications

You can opt out of marketing emails by clicking "unsubscribe" in any marketing email or updating your preferences. You will still receive transactional emails (receipts, security alerts).

9. Regional Privacy Rights

9.1 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

Right to Know: Request disclosure of information collected about you
Right to Delete: Request deletion of your personal information
Right to Opt-Out: We do not sell personal information
Non-Discrimination: We will not discriminate against you for exercising these rights

To exercise these rights, email [email protected] with subject "CCPA Request."

9.2 Canadian Residents (PIPEDA)

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act:

Access to your personal information
Correction of inaccurate information
Withdrawal of consent (subject to legal or contractual restrictions)
Complaint to the Privacy Commissioner of Canada

9.3 European Residents (GDPR)

While we primarily serve US and Canadian customers, if you are in the European Economic Area, you have rights under GDPR including:

Access, rectification, and erasure of personal data
Restriction of processing and data portability
Objection to processing
Withdrawal of consent
Complaint to supervisory authority

Our legal basis for processing is contract performance (providing the Service) and legitimate interests (security, improvement).

10. Cookies and Tracking

We use minimal cookies necessary for the Service to function:

Authentication cookies: Keep you logged in
Security cookies: Protect against attacks (CSRF tokens)
Preference cookies: Remember your settings
Free allowance cookie: Remembers this device's free parses so an office does not share one allowance (sp_device, kept for a year, holds no personal data)

We do not use advertising cookies or cross-site tracking.

11. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

12. International Data Transfers

Your information may be processed in the United States, where our servers are located. By using the Service, you consent to this transfer. We ensure appropriate safeguards are in place for any international transfers.

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or prominent notice on the Service at least 30 days before taking effect. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy-related questions or to exercise your rights:

SpotProof Privacy Team
Email: [email protected]
Website: https://spotproof.app

We will respond to requests within 30 days.