Legal · Android / Google Play
Last updated: June 18, 2026 · Spotly / Novalco — GDPR & Google Play compliant · Android application
The data controller for personal data collected through the Spotly Android application is: Novalco Co-founders: Romane (on-site selection) and Esteban Villalon (technical director) Contact: esteban.villalon@novalco.fr
When you use the Spotly app on Android, we may collect the following data: Account data (on registration) • First and last name • Email address • Password (encrypted, never stored in plain text) • Profile photo (optional, provided by you or via Sign in with Google) Usage data • Restaurants saved as favorites • Reviews and ratings submitted by you • Pages and features accessed within the app (via our internal analytics system) Location data (only when explicitly authorised) • Your approximate or precise location, used solely to display nearby restaurants • Location is never stored on our servers and is only processed locally on your device We do not collect sensitive data (racial origins, political or religious beliefs, health data).
Your data is collected for the following purposes: • Managing your account and authenticating your identity • Providing app features (favorites, reviews, nearby restaurant search) • Improving the app through anonymised usage analytics • Sending transactional emails (account confirmation, password reset) • Complying with our legal obligations Legal basis: performance of a contract (accepted Terms of Service), consent (location permission), and legitimate interest (service improvement).
Your data is retained for the following durations: • Account data: for the duration of your registration, then 3 years after your last login • Usage analytics: 13 rolling months • Published reviews: for the lifetime of the platform (data dissociated from your account on request) • Location data: never stored — processed in real time on your device only Beyond these periods, your data is deleted or anonymised.
Spotly does not sell your personal data to third parties and does not share it for advertising purposes. Your data may be shared with the following processors as part of delivering the service: • Supabase — database and authentication hosting — servers in Europe (EU) • Vercel — web platform hosting — servers in Europe (EU) • Resend — transactional email delivery • Google Places API — used to display restaurant photos and reviews from Google Maps. No personal data about you is sent to Google. Reviews and photos are fetched in real time and never stored on our servers. • Google (Sign in with Google) — if you choose to sign in with Google, your identity is authenticated via Google's servers. We only receive your name, email and profile photo. All processors are bound by contractual obligations to protect data in compliance with GDPR.
The Spotly Android app may request the following permissions on your device: Location — ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION (optional) Used to show restaurants near you. You can use the app fully without granting this permission. Location is never transmitted to our servers and is processed only on your device. Notifications — POST_NOTIFICATIONS (optional) Used to notify you of relevant activity (e.g. a reply to your review). You can disable notifications at any time in your Android system settings. Internet — INTERNET / ACCESS_NETWORK_STATE Required for the app to communicate with our servers and load content. No access to your camera, photo library, microphone, contacts, SMS, call logs, or other restricted permissions is ever requested.
In line with the Google Play Data Safety section, we declare the following: Data collected and linked to your identity • Personal info: name, email address, profile photo • App activity: favorites, reviews, in-app actions (analytics) Data accessed but not collected/stored by us • Approximate / precise location — used in real time on-device only, never sent to or stored on our servers How your data is handled • All data is encrypted in transit (HTTPS/TLS) • You can request deletion of your data and account (see section 8) • We do not sell user data and do not share it with third parties for advertising This declaration matches the information provided in our Google Play Console Data Safety form.
You can delete your account and associated personal data at any time: In the app Go to Profile → Settings → Delete my account. This permanently removes your account, favorites and personal data. By request Alternatively, email esteban.villalon@novalco.fr with the subject "Account deletion" from the address linked to your account. We will process the request and confirm deletion within 30 days. What is deleted: your account, name, email, profile photo, favorites and personal usage data. What may be retained: published reviews may be kept in anonymised form (dissociated from your identity), and limited data may be retained where required by law. You can also request account deletion via the web page: https://spotly.life/privacy-android
Under the General Data Protection Regulation (GDPR), you have the following rights: • Right of access: obtain a copy of your personal data • Right of rectification: correct inaccurate data • Right to erasure: request deletion of your data • Right to data portability: receive your data in a structured format • Right to object: object to certain types of processing • Right to restriction: temporarily suspend a processing activity To exercise any of these rights, contact us at esteban.villalon@novalco.fr, specifying your request and confirming your identity. We will respond within 30 days. If your request is not resolved to your satisfaction, you may lodge a complaint with the CNIL (www.cnil.fr).
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration: • Password encryption (bcrypt via Supabase Auth) • Encrypted communications (HTTPS/TLS) • Data access restricted to authorised team members only • Row-level security (RLS) policies isolating sensitive data in the database
The Spotly app is intended for users aged 16 or over. If you become aware that a minor under 16 has created an account, please contact us so that we can delete their data promptly.
Spotly reserves the right to modify this policy at any time. In the event of a material change, you will be notified by email or within the app at your next login. The date of the last update is shown at the top of this document.
For any questions regarding the protection of your personal data: Novalco — Spotly Romane — Co-founder · on-site selection and restaurant evaluation Esteban Villalon — Co-founder · technical director esteban.villalon@novalco.fr