Privacy Policy
Effective date:19 July 2026. AutoHotspots (“we”) is the data controller for personal data processed through autohotspots.com. Contact: hello@autohotspots.com.
1. What we collect
- Account data — email address, password (stored as a hash by our authentication provider), username.
- Profile data you choose to add — display name, bio, avatar photo, Instagram handle, and vehicle details (make, model, spec, modifications). Profiles are visible to other members.
- Photos you upload — including embedded metadata (EXIF). We read the capture date and, if present, GPS coordinates to check the photo matches its tagged location; photos are re-encoded before publication, which removes the embedded metadata from the published file.
- Community activity — likes, comments, reports and the locations you tag.
- Payment data — handled by Stripe. We never see or store your card details; we store your Stripe customer and subscription identifiers and your membership status.
- Device location— only if you tap the “use my location” button on the map, and only in your browser to centre the map and sort spots by distance. We do not store it.
- Technical logs — IP address and request logs kept by our hosting providers for security and operations.
2. Why we process it (lawful bases)
- Contract — running your membership: accounts, billing, showing the map and community features.
- Legitimate interests— keeping the service safe: moderation, spam and abuse prevention, service emails about your membership status, and aggregate, non-identifying audience counts shown to advertisers (for example “number of BMW owners”).
- Legal obligation — tax and accounting records for payments.
We do not sell personal data, and advertisers never receive it. Ad targeting happens on our side at vehicle-brand level.
3. Who processes data for us
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, photo storage | EU (project region) |
| Stripe | Subscription payments | EU/US (SCC safeguards) |
| Vercel | Hosting and request logs | EU/US (SCC safeguards) |
| Resend | Email delivery | EU region sending |
| MapTiler | Map tiles (receives map-area requests from your browser) | EU |
| Open-Meteo / postcodes.io | Weather and postcode lookups (coordinates only, no account data) | EU/UK |
| Google Analytics | Anonymous site-usage statistics (see Cookie Policy) | EU/US (SCC safeguards) |
4. Retention
- Account, profile and content data: kept while your account exists. If you delete your account, personal data is deleted or anonymised within 30 days, except records we must keep (e.g. payment records, kept 6 years for HMRC).
- If your membership lapses, your account and content are retained so you can return; you can request deletion at any time.
- Moderation records are kept while relevant to enforcement.
5. Your rights
Under UK GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict certain processing, and withdraw consent where processing relies on it. Email hello@autohotspots.comand we’ll respond within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk).
6. Age
AutoHotspots is for users aged 16 or over. We do not knowingly process children’s data; if you believe a child holds an account, contact us and we will remove it.
7. Cookies
See the Cookie Policy. In short: essential sign-in cookies plus Google Analytics for usage statistics; no advertising or cross-site tracking cookies.
8. Changes
We’ll notify material changes to this policy by email or on-site notice before they take effect.