Privacy Policy

1. Introduction

Sphot One (“Sphot”, “we”, “our”, “us”) operates sphot.one and the Sphot application. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Data We Collect

Account Information: Name, email address, and hashed password when you register. If you connect Instagram or Google, we receive your profile name, email, and username from those services.

Instagram Data: Username, user ID, and a long-lived access token necessary to publish Reels on your behalf. We use this token solely for publishing actions you direct.

Google Drive Data: A read-only OAuth token to import video footage you select from your Drive. We do not modify, delete, or access any Drive files you have not explicitly selected.

Payment Data: Subscription and payment metadata (plan, amount, transaction ID) is stored to manage billing. We do not store card numbers, CVV, or bank account details — these are handled entirely by Razorpay.

Usage Data: Pages visited, features used, production run history, and performance metrics to operate and improve the Service.

Device and Log Data: IP address, browser type, and server logs retained for security and debugging purposes.

3. How We Use Your Data

• To provide, operate, and improve the Service
• To process payments and manage your subscription
• To publish Reels to Instagram on your instruction
• To send transactional emails (account activation, billing receipts, security alerts)
• To detect and prevent fraud, abuse, or security incidents
• To comply with legal obligations

We do not sell, rent, or trade your personal information to third parties for their independent marketing purposes.

4. Third-Party Processors

We share data with the following sub-processors solely to operate the Service:

• Amazon Web Services (AWS) — ap-south-1 (Mumbai): Cloud infrastructure, file storage, and database hosting. Your data is stored in India.
• Razorpay: Payment processing (India). Subject to Razorpay's Privacy Policy.
• Google Gemini AI: AI-based content generation (script, captions, strategy). Video frames and content briefs are sent to Gemini for processing.
• Meta / Instagram Graph API: Publishing Reels on your behalf.

Cross-border transfers: Gemini AI is operated by Google LLC (USA). When content data is sent for AI processing, it may be transferred outside India. By using the Service, you consent to this transfer for the purpose of AI generation. We will update this section if additional cross-border transfers are introduced.

5. Data Retention

We retain your personal data for as long as your account is active. Upon account deletion, we retain your data for 90 days to handle disputes or legal requests, after which it is permanently deleted from our systems. Anonymised aggregate analytics may be retained indefinitely.

6. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate personal data via Settings or by contacting us
• Deletion — request deletion of your account and associated data
• Portability — export your data via Settings → Danger Zone → Export Data
• Withdraw consent — disconnect Instagram or Google Drive at any time via Settings

To exercise any of these rights, email privacy@sphot.one. We will respond within 30 days.

7. Security

We implement industry-standard security measures including TLS encryption in transit, bcrypt password hashing, and access controls. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities within 72 hours of becoming aware of the breach, as required by applicable law.

8. Cookies

We use essential session cookies to maintain your login state. We do not use third-party advertising or tracking cookies. Analytics are collected server-side and do not require browser cookies.

9. Children

The Service is not directed to persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice in the app. Continued use after the effective date constitutes acceptance of the updated policy.