SPOTBOUNTY
LoginGet Vending
Legal

PRIVACY POLICY

Last updated: August 12, 2026

1. Introduction

SpotBounty ("SpotBounty", "we", "us") operates the SpotBounty website and preregistration/early-access platform (the "Service"). This Privacy Policy describes the information we collect during Phase 0, how we use it, who we share it with, and the choices available to you. It applies to information collected through the Service. It does not apply to third-party sites or services linked from the Service.

2. Information We Collect

The information we collect depends on how you interact with the Service.

2.1 Preregistration information (submitted by you)

  • Scouts — first name, last name, email address, phone number, ZIP code, US state, an optional response to how you heard about SpotBounty, and an optional referral code.
  • Operators — name, company name, email address, phone number, ZIP code, service radius, states served, machine types, preferred location types, minimum-preferred people count, optional website, and an optional referral code.
  • Businesses — business name, contact name, contact title, email address, phone number, street address, city, US state, ZIP code, business type, approximate people/traffic count, hours of operation, number of shifts, whether current vending exists, desired vending types, and free-form notes describing the request.
  • Creators — creator name, email address, phone number, platform(s), platform handle or channel URL, approximate audience-size range, content niche(s), and free-form notes.
  • Sellers (Seller Interest form) — seller name, email, phone, and residency state; seller type (existing location / turnkey location + machine / route); asset city, state, and ZIP; optional details about the location, machine, or route (type, duration, machine attributes, cashless-reader status, number of locations / machines, cities/states served); optional seller-provided financial figures (approximate monthly gross sales, asking price); optional reason for selling and free-form notes. Financial figures are seller-provided and are not independently verified during Phase 0.

2.2 Contact form

If you use our contact form we collect the name, email address, subject, and message you submit.

2.3 Referral attribution

If you arrive at the Service through a referral link (for example /r/<code> or /c/<code>), we set a first-party cookie named sb_ref to remember the referral code that referred you. See Section 7 for cookie details. When a preregistration is submitted we record the referral code, the referral event (link click or preregistration), a timestamp, and a link between the new preregistration and the code.

2.4 Security & abuse-prevention information (collected automatically)

  • A one-way salted hash of your IP address (we do not store the raw IP).
  • The user-agent string sent by your browser (truncated).
  • Information returned by Cloudflare Turnstile to confirm that a submission is likely from a human (challenge outcome, hostname verification, timestamp). We do not store the Turnstile challenge token beyond the verification step.
  • Basic timestamps and event records used to prevent duplicate submissions, spam, brute-force attempts, and other automated abuse.

3. Information We Do Not Collect

During Phase 0 we do not collect, and no field in our preregistration schemas accepts:

  • credit card, debit card, or other payment card numbers;
  • bank account or routing numbers;
  • Social Security numbers or other government identifiers;
  • tax forms, W-9s, or 1099-related information;
  • uploaded identity documents;
  • biometric information; or
  • precise device location (GPS) — we only receive the ZIP/state you enter voluntarily.

If we introduce fields that collect any of the above (for example, when the paid Scout bounty program launches and tax reporting becomes applicable), this Policy will be updated before those fields are used.

4. How We Use Information

  • To operate the preregistration platform and confirm receipt of your submission.
  • To manage the early-access waitlist and notify you if we open service in your area or invite you into a future launched program.
  • To respond to messages you send us through the contact form.
  • To send you service-related and preregistration communications (such as your confirmation email and any operational message that materially affects your preregistration).
  • To preserve pre-launch referral attribution.
  • To detect and prevent duplicate submissions, spam, automated abuse, fraud, and other security threats.
  • To administer, secure, monitor, and improve the Service.
  • To comply with applicable law and to enforce our Terms.

We do not use your preregistration information to send promotional or marketing email during Phase 0. If we introduce promotional email in the future it will be handled under legally required consent and opt-out mechanisms.

5. Service Providers

The Service is operated with the help of a small number of service providers. Each processes information on our behalf under its own terms and privacy policy:

  • Supabase, Inc. — managed PostgreSQL database and authentication for the owner administrative account.
  • Emergent Labs — application hosting and preview infrastructure.
  • Resend, Inc. — transactional email delivery (confirmation messages and related service email).
  • Cloudflare, Inc. — Turnstile challenge-based bot protection on the preregistration and contact forms.

Providers receive only the information necessary to perform their function (for example, an email address and message body to deliver a confirmation email).

6. Sharing

  • We do not sell your personal information for money.
  • During Phase 0 we do not share Business preregistration submissions with Operators as live marketplace inventory. Any future sharing for that purpose will be preceded by updated disclosures.
  • During Phase 0 we do not share Seller Interest submissions with prospective buyers or the public. Seller submissions are collected for future marketplace access planning only. Any future sharing will be preceded by updated disclosures.
  • We disclose information to the service providers listed above as necessary to operate the Service.
  • We may disclose information when required by law, subpoena, court order, or valid legal process; to protect the rights, property, or safety of SpotBounty, our users, or the public; to investigate fraud or security incidents; or in connection with a corporate transaction (such as a merger, acquisition, financing, or asset transfer), subject to appropriate confidentiality obligations.
  • We may disclose information with your consent.

7. Cookies & Similar Technologies

SpotBounty uses a limited set of cookies. During Phase 0 these are:

  • sb_ref — a first-party cookie set when you visit a referral link. Purpose: preserve referral attribution for a subsequent preregistration. Attributes: path=/, SameSite=Lax, non-HttpOnly, lifetime approximately 30 days. Not shared with third parties.

We do not use third-party advertising cookies, cross-context behavioral advertising trackers, or personalized-ad targeting during Phase 0.

8. Your Choices & State Privacy Rights

Regardless of where you live, you can:

  • request access to the preregistration information we hold about you;
  • request correction of information that is inaccurate;
  • request deletion of your preregistration record (subject to legal, security, or fraud-prevention retention requirements); and
  • opt out of future promotional email if we introduce it.

To exercise any of these choices, contact us through the contact form. We will respond within a reasonable time and will honor rights required by applicable law (including, where applicable, the California Consumer Privacy Act as amended by the CPRA, and similar U.S. state laws). Categories of personal information collected and categories of recipients are described above in Sections 2, 5, and 6.

SpotBounty does not currently sell personal information or share it for cross-context behavioral advertising, so no "Do Not Sell or Share" mechanism is currently required or offered. If this changes, we will provide a clear opt-out mechanism at the point where it becomes applicable.

9. Data Retention

We retain preregistration information for as long as reasonably necessary to operate the Service, manage early access, preserve referral attribution, prevent abuse, comply with legal obligations, and respond to disputes. If we no longer need information for these purposes and are not required to keep it by law, we will delete or anonymize it. You may request deletion at any time via our contact form.

10. Security

We use technical and organizational safeguards designed to protect the information you submit — including database access controls, row-level security, authenticated owner-only administration, and hashing of raw IP addresses. No online service is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident that materially affects your information, we will provide notice consistent with applicable law.

11. Children

The Service is intended for adults age 18 and over. We do not knowingly solicit or collect information from children under 18. If you believe a child has submitted information, contact us through the contact form and we will delete it.

12. International Users

The Service is operated from the United States and is intended for U.S. audiences. If you access the Service from outside the U.S., you understand that your information will be processed in the U.S. and other jurisdictions where our service providers operate, which may not offer the same data-protection framework as your country. Continued use constitutes your acknowledgment of this cross-border processing.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. When we launch new functionality that materially changes how we process information (for example, live marketplace transactions with Operators, or payout processing), we will revise this Policy and provide reasonable notice.

14. Contact

Questions or requests can be sent through our contact form.