spoty

Legal notice & privacy

This is an English convenience translation. The German version is authoritative.

Disclosure per § 5 Austrian E-Commerce Act (ECG) and § 25 Austrian Media Act.

Service provider and media owner

spoty flexco
Mirabellplatz 7
5020 Salzburg, Austria

Legal form: flexible company (Flexible Kapitalgesellschaft)
Commercial register no.: FN 643966i
Commercial register court: Regional Court Salzburg
VAT ID: ATU 81664904
Managing director: DI Xaver M. Kienzerle B.Eng.

Contact: [email protected]
Business purpose: research, development and marketing of a social media platform
Membership: Salzburg Chamber of Commerce (Wirtschaftskammer Salzburg)

Privacy policy

Last updated: July 2026. This policy describes, per Art. 13 and 14 GDPR, how personal data is processed on this website (www.spoty.social) and in the Spoty application (spoty.social).

1. Controller

spoty flexco, Mirabellplatz 7, 5020 Salzburg, Austria
Email: [email protected]

2. This website

When you visit these pages, our server processes technically necessary access data (IP address, timestamp, requested URL, user agent) in log files. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Logs are deleted after 90 days.

This website sets no cookies, uses no tracking, and loads no third-party content; fonts are served from our own server.

3. The Spoty application

Account: Spoty can be used anonymously (device-bound random ID without personal reference) or with an account (email address, password hash). The legal basis is performance of contract (Art. 6(1)(b) GDPR).

Location data: To create posts, Spoty verifies that your device is inside the radius of the respective Spoty. For this, the device location is processed and used in short-lived, cryptographically signed permission tokens. Movement profiles are not stored permanently. Sharing your location is voluntary via the browser/device permission and is only required for posting.

Content: Posts, comments and reactions are publicly visible and attached to the respective place.

Payments: Premium subscriptions are processed by Stripe Payments Europe, Ltd. Payment data is processed directly by Stripe; see the Stripe privacy policy.

Maps: Map tiles are predominantly delivered through our own proxy (tiles.spoty.social). Some map resources are loaded directly from Mapbox Inc. (USA), which transmits your IP address to Mapbox; see the Mapbox privacy policy.

Hosting: The platform runs on our own cluster infrastructure in the EU. The database is hosted on MongoDB Atlas in the EU (Frankfurt) region.

4. Retention

Personal data is stored for as long as the account exists or statutory retention obligations require. When an account is deleted, the associated data is deleted or anonymised.

5. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Contact [email protected]. You may also lodge a complaint with the Austrian data protection authority (dsb.gv.at).