Spotogram

Privacy Policy

Last updated: 18 August 2026

1. Introduction

Spotogram ("we", "us", or "our") operates https://spotogram.app (the "Service"). We are based in Bosnia and Herzegovina. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit the site or use the studio.

If you do not agree with this policy, do not use the Service.

2. Information we collect

We may collect the following types of information:

  • Personal information: name, email address, and account identifiers.
  • Device information: browser type, operating system, and device type from hosting logs.
  • Usage data: actions in the studio such as generations, mixes, exports, and credit use.
  • User-generated content: scripts, briefs, client records, uploaded music, and generated audio.
  • Cookies: a session cookie required to stay signed in. If we run ads, Meta Pixel may set marketing cookies after you consent.

We do not collect phone numbers, physical addresses, or credit card numbers. Payments are handled by Polar.

3. How we use your information

  • To provide, maintain, and improve the studio (contract).
  • To see product funnels (sign-up, generate, export, billing) with PostHog in the EU, using account id after you sign in (legitimate interest).
  • To see aggregate visits with Vercel Web Analytics, without cookies (legitimate interest).
  • To respond to support and privacy requests (legitimate interest).
  • To comply with legal and accounting obligations.
  • To detect, prevent, and address security issues and fraud.
  • If you consent, to measure ads with Meta Pixel and show you relevant Spotogram ads.

We do not send marketing newsletters.

4. Third-party services

We share data with processors only as needed to run the Service:

  • Supabase: authentication, database, and account records.
  • Vercel: hosting, private audio storage, and cookieless Web Analytics (page views, no advertising profile).
  • PostHog (EU): product analytics and masked session replay. Events are product actions (generate, export, checkout), not the text of your scripts. Inputs in recordings are masked. The project is hosted in the EU.
  • Polar: subscriptions, checkout, and invoices. Card details stay with Polar.
  • Meta (Facebook Pixel): advertising and conversion tracking, only if you accept marketing cookies.

We also use contracted processors for infrastructure and audio production, including generating voice-over from your script, storing files, and delivering the studio. They only receive what they need to do that job. We do not list every production vendor by name.

Each processor has its own privacy policy for how it handles data.

5. Cookies

  • Essential: sign-in session. The Service does not work without this.
  • Analytics: PostHog cookies / local storage so we can tell returning studio sessions apart. Used for product analytics, not ads.
  • Marketing: Meta Pixel, only after consent, so we can measure and retarget ads.

We use Vercel Web Analytics for page views. It does not set analytics cookies and is not used to advertise to you. PostHog is for product analytics (what people do in the studio), hosted in the EU. We do not use Google Analytics. You can also control cookies in your browser.

6. Data retention

We keep account data, clients, and spots while your account is active. If you delete your account, we remove or anonymize that content within a reasonable period, except records we must keep for billing, tax, or legal claims.

7. Your rights (GDPR)

If you are in the EU/EEA, or where the same rights apply in Bosnia and Herzegovina or Serbia, you may:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion
  • Receive a portable copy
  • Object to or restrict certain processing
  • Withdraw consent where processing is based on consent

Write to privacy@spotogram.app. We will answer within one month.

8. International transfers

Some processors are outside the EU/EEA, including in the United States. Polar is in the EEA. Where we transfer data out of the EU/EEA, we rely on Standard Contractual Clauses or another lawful mechanism.

9. Children

The Service is for radio stations, agencies, and businesses. It is not intended for children under 16. We do not knowingly collect their data. If you believe a child has created an account, contact us.

10. Changes

We may update this policy. The new version is effective when posted on this page, with a new "Last updated" date.

11. Contact