Privacy policy

Who we are

Spots (spots.ng) is run by Basil Hub Ltd, a company registered with the Corporate Affairs Commission (CAC) in Nigeria and based in Abuja. We decide how the information described here is used, and we follow the Nigeria Data Protection Act 2023.

Questions or requests: privacy@spots.ng. We reply within 72 hours.

Spots is not meant for children under 18.

When you visit

• Your session: each visit opens a session on our server. It holds your IP address, your browser's details (its make and version, as your browser reports them) and what the site needs from one page to the next, such as a security token. It's deleted automatically after about two hours without activity, in a routine clear-out, so it can stay a little longer.
• Contact taps: when you tap to call, message, get directions or visit a spot's website or Instagram, we count the tap for that spot, with a code made from your IP address, browser and the date. The code changes every day, so taps can't be linked to you or across days.
• Searches: what you search for isn't stored with you. When a search finds nothing, we keep the words searched, how many times and when (nothing about who searched), so we know which spots to add. We also keep daily totals of the words searched, how many spots they found, whether a result was tapped and which filters found nothing, again with nothing about who searched.
• Browsing now: while a page is open and in front of you, it tells us now and then that it is still open. It sends a random code that your browser keeps for that tab only (it is gone when you close the tab) and the page's address without anything after a "?". We keep only a scrambled form of the code and the address, for at most an hour, to see how many people are browsing at once. No IP address, account or cookie is involved. Vote, My Spots and sign-in pages never take part.
• Pages you open: your browser keeps a random code, and with it we note the pages you open here and in what order, roughly how long you stay on each, which buttons you tap (such as Call or Save), what you search for and how many spots it found, the names of the filters you use (not what you picked), whether you are on a phone or a computer, and the kind of site that brought you (for example Google, Instagram or WhatsApp, never the exact link). We never keep the part of an address after a "?". We keep only a scrambled form of the code. You can turn this off at any time under Privacy choices, and then none of this happens and only the totals above are counted.
• Daily totals: we count a few things per day, such as how many people tapped Save and how many finished signing in. These totals identify no one.
• Web analytics: Cloudflare Web Analytics counts page views and measures how fast pages load. It uses no cookies, and nothing for advertising or tracking.
• Spots near you: if you use "Spots near you", your location is used in your browser to sort nearby spots by distance. It isn't sent to us or stored.
• On your device only: if you saved spots on this device before accounts were needed, that list stays in your browser's storage (only the spots' numbers) until you sign in on this device, when it joins your account. Plan my bill also stays on your device. Clearing your browser's site data removes both.

Cookies

Every visitor gets two:

• spots-session keeps your session (above). It ends after about two hours without activity.
• XSRF-TOKEN is a security token that stops other sites sending forms as you. It lasts as long as the session.

Some features add their own: member_sign_in_browser when you ask for a sign-in code (below); a "remember me" cookie when you sign in; spots_voter when you open a group vote, so you can vote once and change your mind (30 days); and, if you start a vote without an account, a cookie that lets you close or delete it (until the vote is deleted). We don't use advertising or tracking cookies.

Your choice about how you use the site is kept in your browser's storage, not in a cookie: spots-consent holds your answer and when you gave it, and spots-vid holds the random code, unless you turned it off. Clearing your browser's site data removes both.

If you have an account (My Spots)

Saving spots needs an account. It keeps your saved spots on every device and lets you share your list. We store only:

• Your email address, to sign you in and identify your account.
• Your first name, if you add it or sign in with Google. It's shown on your shared list and nowhere else.
• Your Google account number, if you sign in with Google, so we recognise you next time. We don't get your Google password or contacts.
• Your saved spots and when you saved them, and your shared link if you turn sharing on.
• Whether you want emails about new spots and menu updates: off unless you tick the box, and we don't send any yet. If you say yes, we keep when and where you agreed (signing in with Google, with email, or on your account page). Untick it on your account page at any time.

We use this to run your account, because you asked for one (and, for emails, because you agreed).

Our admins can see which spots a member has saved and their sign-in details, to run the site, understand which spots people like and support accounts.

If we are noting how you use the site (you have not turned it off) and you are signed in, the pages you open are linked to your account, so our admins see them with your email address. You can turn this off on your account page at any time, which also deletes what was linked.

Signing in

• Email: we email you a 6-digit code to type in, and a link that does the same. Both work once and expire in 10 minutes. The code is also in the email's subject line, so it may show in your phone's notifications. The first time you sign in, your account is created.
• What a sign-in request holds: your email address; scrambled copies of the code and the link; how many wrong codes were tried; the page to take you back to afterwards; the spot you were saving, if you tapped Save; whether you ticked the box for emails; a scrambled copy of the sign-in cookie below; and when it was made, expires and was used. Requests are deleted once they're a day old, in a daily clear-out, so each one is kept for up to 48 hours.
• Google: Google tells us your email, whether it's verified, your first name and your Google account number. While you're at Google, your session holds the page to come back to, the spot you were saving and whether you ticked the box for emails.
• Sign-in cookies: member_sign_in_browser is a random value, unreadable by the page, that lasts 10 minutes and is removed when you sign in; it tells us whether the emailed link is opened in the same browser. Signing in sets a "remember me" cookie that keeps you signed in on that device for up to 400 days, or until you sign out.
• Limits against abuse: to stop people guessing codes or sending lots of emails, we keep short-lived counters (how many tries, from where) in our cache, labelled with a scrambled form of your email or network address, never the address itself. They stop counting after an hour.

Group votes

Anyone with a vote's link can vote without an account. We store the spots in the vote, an optional title, whether names are shown, when it closes and (if you're signed in) which account started it. For each vote cast: the spot chosen and a scrambled code made from the spots_voter cookie, so each person votes once. It isn't your IP address and can't be linked from one vote to another. In "Named" votes, a voter's first name is shown to everyone with the link; "Anonymous" votes keep no names.

Staff activity log

We keep a log of what our staff do to listings (who changed what, and when). It's about our staff's work, not about visitors or members.

Who else handles it

We don't sell or share your information. These services handle it for us, only to run the site:

• Laravel Cloud: hosting, the database and its backups.
• Cloudflare: network and security, photo storage, and web analytics.
• Google: sign-in with Google, and maps. Map images and the map come from Google, so Google sees your IP address when they load.
• Zoho (ZeptoMail): delivers sign-in codes and links.

Some of them may process data outside Nigeria, under safeguards the Act allows.

How long we keep it

• Your account and saved spots: until you delete your account.
• Sign-in requests: up to 48 hours.
• Sessions: about two hours after your last activity.
• Group votes: deleted 7 days after they close, or straight away if whoever started one deletes it (or deletes their account).
• Contact taps: 24 months, then only a daily total per spot is kept. Taps carry only the daily-changing code above.
• Searches that found nothing: 180 days after the words were last searched for. They carry nothing about who searched.
• Daily search totals: 180 days.
• Daily totals: kept, as they identify no one.
• Staff activity log: 2 years.
• Broken links and page counts: when a page on our site isn't found, we note its address and the website the visitor came from (no personal details) and delete that note after 90 days. We also count how often each spot's page and menu are opened, as totals with no personal details.
• Pages you open: 90 days after your last visit. Daily totals made from them, which identify no one, are kept.
• Backups: our hosting provider keeps backups for a limited period, and deleted data may remain in them until they expire.

Privacy choices

You can stop us noting how you use the site at any time with Privacy choices at the bottom of every page. Turning it off deletes the random code from your browser and asks us to delete what we noted with it, straight away. Only our admins can see what is noted; it is never sold or shared, and it is not used for advertising.

Change my choice

Your rights, and deleting your account

You can see, correct, download and delete your information. Signed in, open your account: Download my data gives you everything we store about you as a file, and Delete my account permanently deletes your account, your saved spots, your shared link and the group votes you started, straight away. It also deletes the pages you opened that were linked to your account.

You can also object to how we use your information, or ask us to limit it, at privacy@spots.ng. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Changes

If we change this policy, we'll update the date above, and tell signed-in members about important changes.