Your data. Your control.

Last updated: 2026-06-16 · Version 1.0

This Privacy Policy explains what data SpotlyBD ("we", "us") collects, why we collect it, how long we keep it, and what control you have over it. It applies to both visitors and registered vendors of the platform at https://spotlybd.com.

Plain-English summary: we collect the minimum needed to run a vendor-discovery service. Anonymous visitors can browse without giving up any personal data. Vendors who sign up share their shop info so customers can find them. Location data is only collected when a vendor explicitly opts in — and they can turn it off or delete it at any time.

1. What we collect

From all visitors (automatically):

IP address (used for rate-limiting and abuse prevention; not used to build a profile of you)
Browser type and language, referring page, and the URLs you visit on the site (page-view analytics)
Search queries you type into our search bar (so we can improve discovery)
If you submit a review without an account, the name you give the form and your IP address

From registered vendors:

Shop name, owner name, mobile number, email, and address (required for listing)
Photos and menu information you choose to upload
Approximate GPS coordinates of the shop (you set these manually on the map; they appear on the public listing)
Login activity — last login time and password (hashed, never stored in plain text)

Optional — only with explicit consent:

Live GPS location while a vendor is actively sharing it. This is opt-in, time-limited, and visible to customers in real-time only while sharing is on.
Location history — only stored if the vendor enables it from their panel. Retained for the period set in the global Tracking settings (default 30 days), then auto-deleted.

2. Why we collect it

To show street-food customers where vendors are and whether they are open right now
To prevent fraud, spam, abuse, and brute-force login attempts
To measure platform usage so we can improve the product (aggregated, not personalised)
To respond when you contact us

3. Third parties

If the admin enables them, the site loads Google Analytics 4 and/or Meta (Facebook) Pixel on public pages. These third parties may set their own cookies and process your IP under their own policies. You can block them with a browser extension (e.g. uBlock Origin) or by opting out at Google's opt-out. The map uses tiles from OpenStreetMap; their attribution and usage policy applies to that traffic.

4. How long we keep it

Account and listing data: while the account is active. Deleted within 30 days of account closure.
Reviews: until the review is deleted by an admin or by you.
Page-view analytics: 90 days (configurable by the admin).
Search log: configurable retention (default 90 days), then auto-pruned.
Vendor location history: configurable retention (default 30 days), then auto-pruned.
Server access logs: as long as Hostinger retains them under their policy.

5. Your rights

You can, at any time:

Stop sharing location. Vendors: hit "Stop Tracking" in your panel. The next stored point is your last one.
Delete your location history. Vendors: ask from your panel; we remove all GPS points for your shop.
Delete your account. Email us at info@Spotlybd.com; we delete within 30 days.
Request a copy of the data we hold on you. Same email; we reply within 30 days.
Switch the site to Bangla or English via the EN/বাং toggle. Your choice is stored in a cookie for 1 year.

6. Security

Traffic is forced over HTTPS. Passwords are hashed with bcrypt (cost 12). Database access uses prepared statements. Admin and vendor login attempts are rate-limited. We do not transmit credentials in plain text. If a breach affects you, we will email you within 72 hours of discovery.

7. Children

The platform is not intended for anyone under 13. We do not knowingly collect data from children. If you believe a child has registered, please contact us so we can remove the account.

8. Jurisdiction

SpotlyBD operates from Bangladesh. By using the site you agree that disputes are governed by Bangladeshi law. If you are visiting from a jurisdiction with stricter local privacy law (e.g. EU GDPR), the stricter rules apply to your data.

9. Changes to this policy

We may update this policy as the platform evolves. The "Last updated" date at the top of the page changes whenever we do. Significant changes (e.g. new third parties, new categories of data) are notified to registered vendors by email.

10. Contact

For any privacy question, email info@Spotlybd.com. We reply within 30 days, usually faster.