SpotReedem Privacy Notice
This notice explains what personal data the SpotReedem website collects, why it is collected, who can see it, how long it is kept, and how to ask for it to be removed. It is part of the agreement set out in the Terms of Service and Sale. Words defined there, such as "Buyer" and "key", have the same meaning here.
1. Who Is Responsible
SpotReedem, operating the SpotReedem website, decides what data is collected and why, and is the controller of that data. Contact: support@spotredeem.com.
2. What We Collect
Account data. When you create an account you give us a username, an email address, and a password. The email address is stored in lower case. The password is never stored as typed: only a salted one-way hash is kept, which cannot be read back.
Order and key data. The key you bought or redeemed, the product it relates to, the order it came from, and the time it was issued, redeemed, or expired.
Redemption records. Each redemption is logged against its key and your account, with the time, your IP address, and your browser's user-agent string. This is what lets us look up which access was issued to you and handle a replacement under the warranty.
Delivered access. The sign-in details, session, file, token, or balance supplied to you on redemption are held in our database so that we can show them to you and replace them if they stop working.
Session data. When you sign in we create a session record containing a random session identifier, your account, the creation and expiry times, your IP address, and your user-agent string.
Security and audit records. Sensitive actions on the service are written to an audit log with the type of actor, the action, a target, and, where available, the IP address.
Rate-limit counters. To slow down guessing of keys and passwords, we count requests per bucket (for example per IP address) in a short time window.
Messages. If you email support or open a ticket, we keep what you send and our replies.
Payments. On a reseller shop, payment is made in cryptocurrency. Payment details such as the invoice, the amount, and the transaction are handled for that order. We do not collect card numbers on this website.
We do not ask for your real name, postal address, or date of birth.
3. Why We Use It
- To create and operate your account and keep you signed in.
- To validate a key, deliver access, and honour the 30-day warranty and replacements.
- To prevent fraud, key sharing, brute-force attempts, and other misuse, and to enforce the Terms.
- To keep the service secure and to investigate faults.
- To answer your emails and tickets, and to act on removal requests.
- To meet legal obligations.
Where the law requires a legal basis, we rely on performance of the contract with you (accounts, keys, delivery, warranty), our legitimate interest in security and preventing abuse, and legal obligation. We do not sell your data and we do not use it for advertising or profiling.
4. Cookies and Local Storage
The website sets two cookies, both strictly necessary for the service to work:
sr_sessionkeeps you signed in. It carries only the session token, not your personal details.sr_csrfprotects forms and requests from being submitted on your behalf by another site.
We do not use advertising or analytics cookies, and the website does not load third-party scripts. Because these two cookies are strictly necessary, they are set without a consent banner. Blocking them will stop you from signing in.
5. Who Can See Your Data
Access is limited to SpotReedem and the providers we need to run the service. We do not share your data for marketing. Those providers act on our instructions:
- Neon, which hosts our PostgreSQL database.
- Vercel, which hosts the website and runs the application.
- Our email provider, to receive and answer support messages.
These providers may process data in countries outside your own. We may also disclose data when a law or a valid legal request requires it, or to protect SpotReedem and others from fraud or abuse.
Approved resellers run shops under the SpotReedem domain and set their own prices. The key is still supplied by SpotReedem. Information you give a reseller directly is handled by that reseller.
6. How Long We Keep It
- Session records are deleted when you sign out, and expired sessions are deleted automatically.
- Rate-limit counters are deleted automatically after about one hour.
- Account, key, delivery, and redemption records are kept while your account exists and for as long as we need them to run the warranty, handle disputes, and prevent abuse.
- Audit records are kept for as long as we need them for security and investigation.
- Support messages are kept for as long as needed to deal with the matter and any follow-up.
When you ask for removal under Section 8, we delete what we hold about you except what we must keep by law or to deal with a dispute, fraud, or abuse.
7. Security
Passwords are stored only as salted hashes. Traffic to the website is sent over HTTPS, and our database connection is encrypted. Access to the database is restricted. No system is perfectly secure, so please use a unique password and keep your key and delivered access private.
8. Your Rights and Data Removal
Depending on where you live, you may have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. You may also complain to your local data protection authority.
To have all information we store about you removed, open a ticket after signing in, request the removal, and state the reason. If you cannot sign in, email support@spotredeem.com from the address on your account. As the Terms explain, removal means any key linked to the account is lost, with no refund and no replacement. We may need to confirm that you control the account before we act.
9. Age
The service is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a minor has given us data, contact us and we will remove it.
10. Changes
We may update this notice by publishing a new copy on this page and changing the date at the top. Continued use after that date means you accept the updated notice. Text on the site may have been translated using AI, and if a translation differs from the English text, the English text governs.
11. Contact
Questions about this notice or your data: support@spotredeem.com.