Privacy Policy

The data controller responsible for processing your personal data is:

Spoyy (“we”, “us”, “our”) operates the Spoyy platform (spoyy.com), a content creator and brand campaign management platform. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our services.

2.1 Account Information

When you register, we collect:

• Full name
• Email address
• Password (stored encrypted, never in plain text)
• Profile avatar
• Selected interests and content categories

2.2 Profile Information (Content Creators)

Content creators may optionally provide:

• Gender
• Date of birth
• Portfolio bio and links
• Additional biographical information

2.3 Social Media Platform Data

Kada povežeš naloge na društvenim mrežama (Instagram, Facebook, TikTok, YouTube), primamo podatke sa tih platformi putem njihovih zvaničnih API-ja. Meta podaci su opisani u Odeljku 3, a Google i YouTube podaci u odeljku Google i YouTube API podaci.

2.4 Usage Data

We automatically collect:

• Session data (login times, browser type)
• Pages visited within the platform
• Campaign interactions (applications, favorites)

Spoyy koristi YouTube API usluge kada kreator sadržaja dobrovoljno poveže svoj YouTube kanal. Povezivanje YouTube kanala je opciono i odvojeno je od registracije ili prijavljivanja na Spoyy nalog.

Podaci kojima pristupamo

Uz tvoje odobrenje, Spoyy zahteva pristup samo za čitanje sledećih podataka:

• Podaci o YouTube kanalu: ID kanala, naziv kanala, korisnička oznaka, opis, profilna slika, datum kreiranja kanala, broj pretplatnika, broj videa, broj pregleda i povezani metapodaci kanala.
• Podaci o YouTube video sadržaju: ID-jevi postavljenih videa, naslovi, opisi, sličice, trajanje, oznake, kategorije, jezik, javne statistike angažovanja i kanal povezan sa videom.
• YouTube Analytics podaci: pregledi, vreme gledanja, prosečno trajanje i procenat gledanja, sviđanja, komentari, deljenja, dobijeni i izgubljeni pretplatnici, kretanje rezultata kroz vreme i zbirni podaci o publici kao što su država, starosna grupa, pol i tip uređaja, kada su dostupni.

Spoyy zahteva samo YouTube dozvole za čitanje youtube.readonly i yt-analytics.readonly. Ne tražimo pristup adresi e-pošte tvog Google naloga niti opštem Google profilu i ne tražimo dozvolu za postavljanje, izmenu ili brisanje sadržaja na YouTube-u.

Kako koristimo YouTube podatke

YouTube API podatke koristimo isključivo da bismo:

• Povezali i identifikovali YouTube kanal koji je kreator sadržaja izabrao.
• Prikazali podatke o kanalu, javne videe i relevantne metrike na Spoyy profilu kreatora.
• Proverili da YouTube video dostavljen kao rezultat kampanje pripada povezanom kanalu.
• Obezbedili izveštaje o profilu kreatora i rezultatima kampanje, uključujući analitiku YouTube kanala i videa.
• Učinili relevantne podatke o kanalu i videima, kao i zbirne analitičke metrike, dostupnim prijavljenim kompanijskim korisnicima koji procenjuju kreatore ili upravljaju saradnjama preko Spoyy platforme.

Deljenje i ograničena upotreba

OAuth tokeni nisu dostupni kompanijskim korisnicima. Spoyy ne prodaje YouTube API podatke, ne koristi ih za oglašavanje, ne prenosi ih trgovcima podacima i ne koristi ih za nadzor. Pružaoci usluga mogu obrađivati podatke samo u meri potrebnoj za hosting, bezbednost i rad Spoyy platforme i obavezani su odgovarajućim ugovornim obavezama.

Spoyy će informacije primljene putem Google API-ja koristiti i prenositi drugim aplikacijama u skladu sa Pravilima o korisničkim podacima Google API usluga, uključujući zahteve ograničene upotrebe.

Google obrađuje podatke u skladu sa Google politikom privatnosti.

Čuvanje, opoziv pristupa i brisanje

YouTube OAuth tokene, podatke o povezanom kanalu, keširani YouTube sadržaj i sačuvanu YouTube analitiku čuvamo dok je kanal povezan i samo onoliko dugo koliko je potrebno za pružanje opisanih funkcionalnosti. Podaci o kampanji, kao što je javni URL videa dostavljen kao rezultat kampanje, mogu biti sačuvani zbog legitimnih poslovnih i pravnih razloga, ali se YouTube analitika pribavljena putem prekinutog odobrenja uklanja.

YouTube možeš u svakom trenutku odvojiti u podešavanjima društvenih mreža na Spoyy platformi. Prekidanje veze opoziva Google odobrenje dato Spoyy-u i briše sačuvanu YouTube vezu, tokene, podatke o profilu kanala, keširani sadržaj i sačuvanu YouTube analitiku povezanu sa tim odobrenjem. Ova radnja ne briše niti menja bilo šta na tvom YouTube kanalu.

Spoyy pristup možeš opozvati i preko dozvola Google naloga. Ako je odobrenje opozvano ili ga više nije moguće potvrditi, Spoyy uklanja povezane odobrene YouTube API podatke što je pre moguće, a najkasnije u roku od sedam kalendarskih dana od otkrivanja opoziva.

This section specifically addresses data we receive from Meta Platforms, Inc. (“Meta”) through their APIs, as required by Meta’s Platform Terms.

3.1 Instagram Business Data

When you connect your Instagram Business account, we access:

• Account information: account type, Instagram user ID, username, display name
• Profile media: profile picture URL
• Account metrics: follower count, following count, media (post) count

Permissions requested: instagram_business_basic, instagram_business_manage_comments, instagram_business_manage_insights

3.2 Facebook Data

When you connect your Facebook account, we may access:

• Basic profile: name, profile picture, profile link
• Demographics: gender, birthday, age range, hometown, current location
• Interests: likes, favorite athletes, favorite teams, inspirational people
• Other: languages spoken, website, quotes

3.3 How We Use Meta Platform Data

We use Meta Platform Data exclusively to:

• Verify your identity as a content creator
• Display your social media profile information on your Spoyy creator profile
• Help brands evaluate content creators for campaign partnerships based on audience metrics
• Provide you with a seamless login experience via social authentication

3.4 Meta Platform Data Restrictions

In accordance with Meta’s Platform Terms, we:

• Do not sell, license, or purchase Meta Platform Data
• Do not transfer Meta Platform Data to any ad network, data broker, or other advertising or monetization-related service
• Do not place Meta Platform Data in a search engine or directory
• Do not use Meta Platform Data for surveillance
• Will delete all Meta Platform Data related to a user upon their request or when it is no longer necessary for the purpose for which it was collected

3.5 Token Management

We store OAuth access tokens securely to maintain your connection with Meta’s services. Instagram Business tokens are exchanged for long-lived tokens (valid for 60 days) and refreshed automatically. You can revoke access at any time by disconnecting your account from your Spoyy profile settings, or directly through Meta’s settings.

Under the General Data Protection Regulation (GDPR) and applicable Serbian data protection law (Zakon o zaštiti podataka o ličnosti), we process your personal data on the following legal bases:

• Consent (Article 6(1)(a) GDPR): When you connect your social media accounts, you explicitly consent to us accessing and processing the data from those platforms. You may withdraw consent at any time.
• Contract Performance (Article 6(1)(b) GDPR): Processing your account data is necessary to provide you with the Spoyy platform services, including campaign matching and creator profiles.
• Legitimate Interest (Article 6(1)(f) GDPR): We process usage data to improve our services, ensure platform security, and prevent fraud.
• Legal Obligation (Article 6(1)(c) GDPR): We may process data to comply with applicable laws and regulations.

We use your personal data to:

• Create and manage your Spoyy account
• Build your content creator profile visible to brands
• Match content creators with relevant brand campaigns
• Facilitate campaign applications and collaboration
• Display verified audience metrics to potential brand partners
• Send you notifications about campaign updates and platform news
• Provide customer support
• Improve and secure our platform
• Comply with legal obligations

We may share your personal data with:

• Brands and Companies on Spoyy: When you apply to a campaign, the brand can see your public creator profile, including connected social media metrics. They cannot access your private data, OAuth tokens, or raw Meta Platform Data.
• Hosting & Infrastructure Providers: Our servers and databases are hosted by third-party providers who may have access to data as part of providing their services. These providers are bound by data processing agreements.
• Legal Requirements: We may disclose data if required by law, court order, or governmental request.

We do not sell your personal data to third parties. We do not share Meta Platform Data with advertising networks, data brokers, or any unrelated third parties.

• Account Data: Retained for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.
• Social Media Platform Data: Retained while your social accounts are connected. When you disconnect a platform or revoke access via Meta, the associated platform data (tokens, profile data, metrics) is deleted.
• Meta Platform Data: Deleted promptly upon receiving a data deletion callback from Meta, or when you disconnect your Meta-linked account. We retain only a confirmation code for audit purposes.
• Campaign Data: Campaign-related data (applications, messages) may be retained for legitimate business purposes and legal compliance.

As a data subject, you have the following rights:

• Right of Access (Article 15): You can request a copy of all personal data we hold about you.
• Right to Rectification (Article 16): You can update or correct inaccurate data through your profile settings or by contacting us.
• Right to Erasure (Article 17): You can request deletion of your personal data. See Section 9 for the deletion process.
• Right to Restriction (Article 18): You can request that we limit the processing of your data in certain circumstances.
• Right to Data Portability (Article 20): You can request your data in a machine-readable format.
• Right to Object (Article 21): You can object to processing based on legitimate interests.
• Right to Withdraw Consent: You can withdraw consent at any time by disconnecting your social media accounts or contacting us.

To exercise any of these rights, contact us at info@spoyy.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti).

9.1 Deleting Your Account

You can request complete deletion of your account and all associated data by contacting us at info@spoyy.com.

9.2 Disconnecting Social Media Accounts

You can disconnect individual social media accounts from your Spoyy profile at any time through your account settings. This will delete the associated platform data (profile information, metrics, and tokens).

9.3 Meta Data Deletion Callbacks

When you remove the Spoyy app from your Meta (Facebook/Instagram) account settings, Meta sends us an automated data deletion request. Upon receiving this request, we:

• Delete all stored Meta Platform Data associated with your account
• Remove any locally stored avatars from Meta
• Delete your platform connection record
• Provide a confirmation code for you to verify the deletion status

You can check the status of a Meta data deletion request at spoyy.com/data-deletion/status/[confirmation-code]

We implement appropriate technical and organizational measures to protect your data:

• All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Passwords are hashed using industry-standard algorithms and never stored in plain text
• OAuth tokens are stored encrypted in our database
• Access to personal data is restricted to authorized personnel only
• We regularly review and update our security practices
• Meta webhook requests are validated using signed request verification

We use only essential cookies that are strictly necessary for the functioning of our platform:

• Session cookie: Maintains your login session and authentication state
• CSRF token: Protects against cross-site request forgery attacks
• Language preference: Remembers your selected language
• Theme preference: Remembers your dark/light mode setting

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. No data is shared with advertising networks through cookies.

Spoyy is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will notify you by:

• Updating the “Last updated” date at the top of this page
• Sending a notification through the platform for significant changes

We encourage you to review this Privacy Policy periodically.