Privacy Policy

Last updated: 11 October 2026

Spotfluence ("we", "us") runs a marketplace at spotfluence.co.uk that connects local businesses with influencers. This policy explains what personal data we collect, why, who we share it with and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018). We are the data controller. Contact us at support@spotfluence.co.uk.

What we collect

• Account details: name, email address and a securely hashed password (we never store your password itself). If you turn on two-factor authentication we store an encrypted authenticator secret.
• Business profiles: business name, industry, town, address, phone, website and description.
• Influencer profiles: display name, bio, niche, town, social media handles, follower count, contact email and phone.
• Marketplace activity: jobs you post, applications and pitches, expert consultation notes, reviews you give and receive.
• Payments: what you bought, the amount and the payment status. Card details are entered on Stripe's secure page and are never seen or stored by us.
• Security and technical data: IP address, browser type, login times and security events (such as failed logins), used to protect accounts and prevent fraud.

Why we use it (and our lawful basis)

• To provide the service (contract): creating your account, publishing jobs and profiles, applications, expert services, payments and receipts.
• To show influencer profiles to businesses (contract): businesses on a paid plan can see influencer profiles, follower counts and contact details. This is the core of the service influencers sign up for.
• To send service emails (contract): email verification, password resets, receipts and updates about your jobs and applications. You can switch off non-essential notification emails under Security → Email notifications; emails you need for your account or payments are always sent.
• To keep the platform secure (legitimate interests): preventing fraud, abuse and unauthorised access, including rate limiting and audit logs.
• To meet legal obligations (legal obligation): keeping payment and tax records.

We do not sell your personal data and we do not send marketing emails.

Who we share it with

• Other users, as described above (e.g. businesses see influencer profiles and contact details; influencers see job adverts and business details).
• Amazon Web Services (hosting, database and email delivery), in the EU (Ireland).
• Stripe (payment processing). Stripe may process data in the United States under appropriate safeguards.
• Google Fonts, which serves the website's typeface; your browser connects to Google to load it.
• Authorities, where we are legally required to.

Cookies

We use only strictly necessary cookies: a session cookie that keeps you logged in and protects forms against forgery. We do not use advertising or analytics cookies.

How long we keep it

• Account and profile data: while your account is active, or until you ask us to delete it.
• Payment records: 6 years, as required for UK tax purposes.
• Security logs: up to 12 months. Database backups: up to 35 days.

Your rights

You can ask us to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Email support@spotfluence.co.uk and we will respond within one month. When you ask us to delete your account we erase your personal data, keeping only the payment records we are legally required to retain.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

All traffic is encrypted (HTTPS). Passwords are hashed, sensitive values are encrypted, and access to the platform's systems is restricted and protected by two-factor authentication.

Age

Spotfluence is for people aged 18 and over.

Changes

We will update this page if we change how we use your data, and tell you about significant changes by email.