Spotted Pony PR Privacy & Data Commitment

What we collect

Five kinds of information, plus the technical records named in the sections below:

• Account information. The name and email address used to create an account, and the organization records a user sets up.
• Diagnostic content. What SPOTTED researches and produces: findings, scores, the written reasons a person records when ruling on a score, and the deliverables built from them.
• What you choose to add. Notes a human in the loop writes, Strategic Questions posed at the start of a run, and any business measurements logged in the Correlation Tracker. All of it optional. None of it required to run a diagnostic.
• Billing state. For a subscribed account, which tier, monthly or annual, whether it is active, when it renews, whether the Founders' rate applies, and a record of any add-on run purchases. Never a card number. See Payments below.
• Support messages and public Trainer questions. Covered in their own sections below.

We do not ask for, and SPOTTED has no use for, government identifiers, payment card numbers held by us, health information, or any special category of personal data. The technical records are small and named where they arise: the one-way scrambled network address stored with a public Trainer question or a support message, and the short quotations from public web pages stored as the evidence behind a finding.

Our website is primarily geared towards a general audience and not children. The website is intended for users who are at least 18 years old and capable of forming legally binding contracts under applicable law. By accessing or using the website, you represent and warrant that you meet these requirements. Persons under the age of 18 are not permitted to use or register for the website.

If we learn that personal information from users under 13 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 13 or the equivalent age as specified by law in your jurisdiction, please contact us.

Claude (Anthropic)

SPOTTED uses the Claude API for AI research and analysis. Anthropic is the only AI provider that receives diagnostic content. Data passed through the API for diagnostic purposes is automatically deleted within 30 days and is never used to train Anthropic's models. This reflects Anthropic's standard commercial API terms. SPOTTED does not have a separate or special data-retention agreement with Anthropic.

Every call SPOTTED makes to Anthropic passes through a single point in our own code. That is a structural fact rather than a policy: it is what makes the terms above cover all of our AI traffic, instead of covering it only where someone remembered to apply them.

ChatGPT, Gemini and Perplexity

SPOTTED includes an AI Visibility Check that asks ChatGPT (OpenAI), Gemini (Google) and Perplexity directly how each currently describes an organization. What is sent to them is a set of short questions attached to that organization, built by default from its name and industry type, written in a way any prospective customer could type them into an AI search. The question set is visible to you and you can edit it, and whatever it says is what is sent to the AI. No findings, no intake, no notes, no scores and no measurements ever reach these three providers, and nothing about the person or account that asked is included.

Because the questions are editable, what reaches those three companies is under your control rather than ours, so please treat that field as public writing. And where a customer has asked SPOTTED to research a competitor, the competitor's diagnostic runs the same way, so that competitor's name goes to the same three providers, in a query set the customer can edit. The organization named there may be a company that has no relationship with us and did not ask to be looked at.

The deletion and no-training assurance above is specific to Anthropic. It does not automatically extend to these three providers. Each governs that query under its own published policy. Each of the three publishes terms for the API tiers we use stating that content sent through the API is not used to train or improve their models, and we use the paid tier in each case, but those are their published terms, not commitments SPOTTED has separately contracted.

The sources behind findings

When SPOTTED researches an organization, each finding records how it is known: found directly in a page the research retrieved, inferred from what it retrieved, or searched for and not found. A finding that says "found" stores the web address of the page it came from and a short quotation of the relevant passage, so the evidence can be checked rather than taken on trust.

That means SPOTTED stores small excerpts of third-party web pages alongside findings. They are publicly published pages, the excerpts are short and kept for verification, and they are shown to the account that ran the diagnostic. Before anything is saved, our own code checks each cited source against the pages the research actually retrieved, so a source that was not really read cannot be stored.

Research about organizations other than yours

At a customer's direction, a diagnostic can research and score competitor organizations the customer names, and produce a comparison. That research reads the same publicly available information as any other diagnostic. It reaches nothing private, it does not attempt to, and a competitor's score is never adjusted by hand by the customer or by us.

Two things about that research are worth stating. The competitor's name is sent to the three AI providers named above, inside the same editable query set described in that section, as part of the Visibility Check any organization receives. And findings about a competitor store the same short quotations from the public pages they came from as any other finding, for the same reason: so the claim can be checked rather than trusted.

Where client data lives

Client records, diagnostic results, scores, reports, stored sources and any measurement indicators are held in the SPOTTED platform database, which runs on Supabase (managed PostgreSQL), with the application hosted on Render. Data is stored in the United States (AWS us-east-2, Ohio). Our records are never stored on Anthropic's servers or on those of any other AI provider.

How data is protected

• Everything moves over encrypted connections — browser to application, application to database, and application to every AI provider. The database encrypts everything at rest.
• Accounts are separated by the database itself. Row-level security is enforced by PostgreSQL, underneath the application, on every table. The practical consequence: even a fault in our application code cannot hand one account another account's data, because the wall does not sit in the application.
• Credentials live only in server configuration, never in our code.
• The working application sits behind sign-in, and pre-release addresses are kept out of search results.

Who can see your data

Inside your account, your own users see your data, under two roles: an Administrator runs diagnostics and rules on scores, and a Contributor reads the record and works the plan. Roles decide what a person can do, never what they can see within the account.

Across accounts, nobody. No user on any other account can reach your records, including Spotted Pony PR staff working in a different account.

And the honest part, which many policies leave out. Spotted Pony PR operates this service, so it holds the infrastructure credentials to the database, exactly as the operator of any software service does. That access is credentialed and logged at the platform level rather than anonymous, and there is no staff-browsing surface: no support tool and no administrative screen that opens a customer's account and reads diagnostic content. The one internal view shows signup information such as account email, account type and creation date, platform usage counters, messages sent through the Support page, and the public Trainer's question log described above — never the contents of a diagnostic.

Backups

SPOTTED's data is included in Supabase's automated backup system, kept so that client data can be recovered if the platform itself ever fails. This is separate from the AI-provider deletion terms above, which govern content sent out for analysis rather than the platform's own stored records. Backups are used only to restore service. They are never read for any other purpose and never sent to any AI provider. A deletion request is carried out on the live platform immediately; because backups exist for disaster recovery, a deleted record may persist in a backup snapshot for a limited period before it ages out. Supabase's own data protection policy is at supabase.com/privacy.

The free Brand Trust Assessment

The Brand Trust Assessment on our public pages asks nine questions about how confident you are in the way your brand is experienced. It stores nothing, tracks nothing and transmits nothing. There is no account, no email address is requested, and the answers do not leave your browser. Close the tab and there is nothing to delete, because nothing was kept.

The SPOTTED Trainer

The Trainer answers questions about SPOTTED, and it works differently depending on where you meet it.

On our public pages, anyone can ask without signing in. We store the question, the answer, the time, and a one-way scrambled form of the network address the question came from, which exists only to stop one visitor from exhausting the daily limit. The address itself is never stored and cannot be recovered from the scrambled form. These records are read by Spotted Pony PR and no one else, are never used to train AI models, and are never sold or shared. The question text is sent to Anthropic to produce the answer, under the same terms as everything else on this page. Please do not type anything confidential into a chat box on a public web page.

Signed in, the Trainer works as an advisor inside your account, and it reads what an advisor needs: your organizations, completed-run scores and their trend over time, the current state of the remediation plan, and any open Strategic Questions, all of it your account's own human-reviewed record, alongside our documentation. It never answers from an AI's general memory. The one part of your record it deliberately does not receive is the private business measurements logged in the Correlation Tracker: those reach AI in exactly one place, the Correlation Report a person explicitly triggers (described below), so the Trainer points measurement questions to that page rather than carrying the data itself. When a question falls outside its documentation and your account's data, it says so.

Error and performance monitoring (Sentry)

When something in SPOTTED breaks, a technical error report is sent to Sentry so the problem can be found and fixed without waiting for someone to report it. Sentry also receives a sample of ordinary performance information, recorded when nothing has gone wrong, so that slow pages can be found and improved.

Both describe what the software was doing: the page involved, the type of error, and technical request details. They are not a copy of client records. Diagnostic content, scores, notes and organization identity are not what Sentry receives, by rule, and sensitive values such as keys and tokens are removed from reports before they are sent. Sentry retains reports under its own policy, at sentry.io/privacy.

Email (Resend)

SPOTTED sends email through Resend: sign-in email such as password resets and account confirmations, and messages submitted through the Support page. Resend handles the recipient's address and the contents of the message being sent, which for a support request is whatever was written in the form. Support messages are also stored in the SPOTTED database so a message is never lost if email delivery fails, because the Support page is where someone reports that email is broken, and a design that relies on email alone would fail exactly when it is needed. A support message is stored with the same one-way scrambled network address described in the Trainer section, and for the same reason: to limit abuse of a public form. Client diagnostic records are never emailed. Resend's policy is at resend.com/legal/privacy-policy.

Payments (Stripe)

Subscriptions are paid through Stripe, the payment processor. When you subscribe or buy an add-on run, checkout happens on a Stripe-hosted page: your card number goes to Stripe and only to Stripe. Payment card details never touch SPOTTED's servers. What SPOTTED stores about billing is the subscription's state: which tier, monthly or annual, whether it is active, when it renews, whether the Founders' rate applies, and a record of any add-on run purchases. Stripe receives your name, email address, billing address and card details, and uses them to process payment, calculate any applicable sales tax and prevent fraud, under its own policy at stripe.com/privacy. Updating a card or canceling happens on Stripe's hosted billing portal, reached from the Plan & usage page. Diagnostic content is never part of any of it.

Analytics

SPOTTED runs no analytics, anywhere on this site. No tracking pixels, no advertising tags, no third-party analytics service, and no cookies set for measurement. If that ever changes, this page changes first, the free assessment stays excluded, and we will say what was added and why.

Voluntary information

No non-public information enters SPOTTED unless a client has provided it directly. Two places invite it, both optional.

Human in the loop notes and Strategic Questions let the person running a diagnostic add context that research cannot find: internal knowledge, positioning nuance, the backstory behind a number. That text informs the research and is part of the record. It is handled as material to be read, never as an instruction that can change how the system behaves.

The Correlation Tracker lets a human in the loop log internal indicators such as referral rates, proposal close rates or conversion data, to track progress against trust gaps the diagnostic found. Sharing that data is entirely voluntary. By default it stays in the database and is seen only by your own account: it is never entered into AI research or analysis automatically, never shared with third parties, never part of the Trainer's context, and can be removed at any time.

Correlation Tracker: opt-in AI correlation

There is one deliberate exception to the paragraph above, and it only happens when a person triggers it. A human in the loop can ask AI to look for a correlation between brand-trust movement and business outcomes. This is never automatic. It runs one request at a time, capped per month, and only when someone deliberately selects the measurements for that request. When triggered, the request may include the measurement data selected, always researches the organization's public presence the same way any dimension research does, and accepts optional notes added for that request.

Every result is framed strictly as a correlation and never as a causation claim, and names its own limitations. Outside of that explicit action, private measurements reach no AI provider at all.

The founding cohort research opt-in

In-house accounts in the founding cohort are offered an optional research opt-in when they set up a diagnostic. It asks a few short questions about the experience: what you expected to find before the diagnostic ran, what surprised you, whether the AI Visibility Check returned anything wrong about your organization, and what you did afterwards. There is an optional field for a review, and you can take part in one without the other. Agency accounts can provide feedback directly to support@spottedbrand.com.

What it collects is what you type into those fields, the choices you make on the opt-in, and which organization and account they came from. Nothing from your diagnostic. Opting in gives nobody access to your account: no score, finding, engine answer or report is read, exported or sent anywhere because of it, and the limit described under "Who can see your data" is unchanged. What you send goes to Spotted Pony PR in the same way a support message does, which also carries who sent it, and is held apart from your account records.

If you take part, you choose how you may be identified: by name, described but not named, or neither. A description is built only from the industry and structure you entered for your organization, shown to you when you choose it, and nothing else about you is used. What you write in the research fields is what may be quoted, as you wrote it. You can change your mind at any time. Before publication your contribution comes out entirely; after publication we will remove what we can and tell you plainly what we cannot.

The opt-in exists for the founding cohort and closes with it. After that it is not offered, and the choices above still apply to anything you have already written.

Keeping and deleting data

We keep client records for as long as the account exists, because the value of a diagnostic is comparison over time and a score means little without the earlier one to read it against.

An account administrator can delete the account from the Account page. Deletion is immediate and permanent on the live platform, subject only to the backup window described above. Individual records can be deleted on request, and a request to see what we hold about you, or about an organization we have researched, can be made at the email address below.

Certification

SPOTTED holds no security certification. There is no SOC 2 report, no ISO 27001, and none in progress.

What exists instead is described above and can be checked: account separation enforced by the database rather than the application, the deletion and no-training terms with our AI provider, a named person accountable for every score, and no staff-browsing surface. Our infrastructure providers maintain their own published compliance programs, which are theirs rather than ours; if that matters to your organization, we will point you to their documentation rather than imply their certificates cover us.

Third-party providers, in one list

Running SPOTTED requires a small set of providers that process data on its behalf, under their own commitments. These are all of them:

• Supabase — database, authentication, file storage and backups
• Render — application hosting
• Anthropic — AI research and analysis, the only AI provider that receives diagnostic content
• OpenAI, Google and Perplexity — AI Visibility Check queries only: the visible, editable query set described above, and nothing else
• Resend — transactional email and support messages
• Stripe — payment processing and subscription billing; the only provider that sees payment card details, which never touch SPOTTED's servers
• Sentry — error and performance monitoring, carrying no diagnostic content

Each receives only what its section above describes and nothing more. Beyond these named providers, no client information is shared with any third party, for marketing, resale or any other purpose, unless agreed with the client or required by law.

Your Rights

You have rights under certain US state data protection laws depending on where you live. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your Personal Information.
• Right to access your Personal Information or categories of Personal Information.
• Right to correct inaccuracies in your Personal Information.
• Right to request the deletion of your Personal Information, and we will be happy to do so unless we are prevented from doing so by law or regulation. Please note that even if a request is made to delete Personal Information, we may be permitted or required to retain a copy for our business and legal obligations as permitted or required under applicable law.
• Right to portability by requesting a copy of your Personal Information in a commonly used and machine-readable format to be provided to you or to such other third-party as you specify.
• Right to non-discrimination for exercising your rights.
• Right to opt out of the processing of your Personal Information if it is used for targeted advertising or cross-context behavioral advertising (or sharing as defined under California's privacy law).
• Right to request a list of third parties or categories of third parties to which we have disclosed or sold your Personal Information.

In addition to the rights described above, residents of certain jurisdictions may have the right to: (A) opt out of profiling conducted in furtherance of decisions that produce legal or similarly significant effects; (B) opt out of the sale of Personal Information and such profiling activities; and (C) limit the use and disclosure of sensitive Personal Information. We do not sell Personal Information, conduct profiling that produces legal or similarly significant effects, or otherwise process sensitive Personal Information in a manner that would trigger these rights.

How To Exercise Your Rights

To exercise these rights, you can contact us by submitting a data subject access request, by referring to the contact details at the bottom of this Privacy Policy.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use Personal Information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at support@spottedbrand.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

Changes to this page

The "Last updated" date above always reflects the current version. When a change affects how data is handled rather than how a sentence reads, we will say what changed, and account administrators will be told before it takes effect.