Legal

Privacy Policy

Last updated September 28, 2026

1. Who we are

Spot is run by the Spot team. This policy covers spotmeplease.com, Spot links, the browser extension, and the Spot API and MCP server.

2. What we collect

• Carts: the store, items, prices, product links and images, and any note you add. If you share a screenshot, we read it to find the items.
• Requesters: your name, and when needed your email, phone number and shipping address. Venmo or Cash App handles if you add them.
• Payers: Stripe collects the card or wallet details; we receive only the payer’s first name, the email on the payment (used for Spot’s receipt, refunds, and to tell you when the gift was ordered), a fingerprint of the card used (to stop fraud), the amount and whether it succeeded. We never see or store the payer’s card number.
• Spot’s cards: Spot buys each cart with its own single-use card, issued to Spot by Stripe’s partner banks. Its details are used only by Spot’s checkout at that store, never shown to anyone, and never stored by Spot.
• Flights: each traveler’s name, date of birth and gender as on their ID, plus a contact email and phone, which airlines require.
• Accounts: if you sign in by text, your mobile number. If you sign in with Google or Facebook, we receive your name, email address and an account ID from them, and nothing else (no contacts, posts or friends). If you add a passkey (Face ID, Touch ID or similar), only its public key: your fingerprint or face never leaves your device. Your email, and anything you choose to save (your name, shipping address, travelers’ names and dates of birth), plus which Spots and AI connections belong to your account.
• Agents and developers: your email and API key usage.
• Technical: IP address, browser type and basic logs, for security and to keep Spot working.

3. How we use it

To create and show your links, take payments, buy and ship the carts you pay for and book flights, handle refunds and returns, send the messages you asked for, prevent fraud and abuse, provide support, and meet legal obligations.

4. Who we share it with

• Stripe, for payments, refunds and Spot’s cards.
• Stores Spot buys from, to ship your order (the requester’s name, shipping address, email and phone). Spot pays with its own card.
• Stores you pay directly: Spot sends the store the cart, the requester’s name and shipping address, and the buyer’s email, so the store can take the payment on its own checkout and send its receipt. Your card goes to the store’s payment provider, never to Spot.
• Your approver, if you name one: the cart your AI put together, the store and the total, why it came to them, and your first name and shipping address (so it can ship to you).
• Airlines and our flight-booking partner (Duffel), for traveler details and payment for your booking.
• Anthropic, which provides the AI that reads screenshots and fills in store checkouts. Card numbers are never sent to it.
• Twilio and Resend, to deliver texts and emails you asked for.
• Railway, which hosts Spot.
• Authorities, when the law requires it or to protect people from fraud or harm.

We don’t sell or rent personal information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are never shared with anyone except the providers that deliver our messages.

5. The person who paid, and the person who asked

A payer sees the cart, the requester’s first name and the store, never the requester’s address or card, except on a store’s own checkout when paying the store directly, where the ship-to address is shown. A requester sees the payer’s first name, never their card or contact details. Signed approval records contain the store, items, amount, whether the buyer or the requester approved, and which AI asked, but no names, addresses or card details.

6. How long we keep it

Cart and order records are kept for as long as needed for refunds, disputes, fraud prevention and accounting (generally up to 7 years for payment records). Screenshots are used to read the cart and aren’t kept. You can ask us to delete your information sooner where the law allows.

7. Your choices, and deleting your data

• Reply STOP to any Spot text to stop texts to that number.
• To delete your account and data, including anything received from Google or Facebook, email hello@spotmeplease.com from the address on your account with the subject “Delete my Spot account”. We confirm and delete within 30 days, keeping only payment records the law requires. You can also remove Spot from your Google or Facebook account settings at any time.
• Email hello@spotmeplease.com to access, correct or delete your information, or to ask a question. Depending on where you live (for example California or the EU/UK) you may have further rights, and we’ll honor them.

8. Security

Private links use long random keys; sign-in codes, sessions and API keys are stored only as hashes; passkeys are stored only as public keys; and all traffic is encrypted. No system is perfect, so keep your private Spot links to yourself.

9. Children

Spot is for adults. We don’t knowingly collect information from children under 13, and anyone under 18 should use Spot only with a parent or guardian.

10. Changes and contact

We’ll post updates here and change the date above. Questions: hello@spotmeplease.com.