Last updated: 7 August 2026
Who controls your data
SPOT ON, a French SASU with registered office at 140 rue Saint-Charles, 75015 Paris, France, is the controller of personal data described in this policy. Privacy requests can be sent to handles@spot.news.
Information we collect and why
Inquiries and correspondence
If you submit a partnership, funding, press, consulting, or general inquiry, we collect the details you provide, such as your name, organisation, role, email address, website, project information, budget, timeline, and message. We use this information to evaluate and respond to your request, take steps before entering a contract where relevant, and pursue our legitimate interests in operating Spot On and developing professional relationships.
When you submit an inquiry form, we also attach the first landing-page path, the form page and route, the referring site's hostname and a broad referrer category, plus any source, medium, campaign, content or term values present in standard UTM fields in the link you used. We do not attach the full referrer URL, other query-string values, a cookie identifier, or a user or device identifier. We use these limited fields to understand which outreach and discovery routes produce relevant inquiries.
The site also records a limited form-submit or direct-email-click signal containing the date, channel, form or page route, first landing path, broad referrer category, referring hostname and named UTM values. This signal does not contain the person's name, email address, message, form answers, full referrer URL, IP address, cookie identifier, or persistent visitor or device identifier. A random event identifier is created for that single action so duplicate signals can be avoided; it is not reused to follow the person around the site.
When you open a direct email link on a contact or professional-inquiry page, the draft email includes a short source-context block with the same limited landing, page, referrer and campaign fields. It is visible in the draft and can be removed before sending.
Job applications
If you apply for a role by email, we process the information in your application to assess your candidacy, communicate with you, and manage recruitment. The legal basis is taking steps at your request before a possible employment contract and our legitimate interest in recruiting.
Website and security data
Our hosting provider processes technical information needed to deliver and secure the site, which may include IP address, request time, requested URL, browser and device information, and diagnostic logs. Spot On uses Netlify Web Analytics, which provides aggregate, cookie-free traffic statistics, to understand site performance and readership.
Spot On also uses a narrow first-party counter for visits referred by ChatGPT, Claude, Gemini, Perplexity and Copilot. It records only the referring service category, the date, the landing-page path and an aggregate count. It does not store the original referrer, query strings, cookies, user or device identifiers, or IP addresses in the counter. The legal basis is our legitimate interest in understanding how readers discover our public-interest journalism and improving the site.
Required and optional information
Using our inquiry forms is optional. We need enough contact information and context to respond; without it, we may be unable to handle your request.
Who receives the information
Personal data is available only to authorised Spot On personnel who need it for the relevant request. It may also be processed by service providers acting for us, including Netlify for hosting and form handling and our email and collaboration providers. We do not sell personal data.
How long we keep it
- Business, press, funding, and consulting inquiries, including the limited attribution fields attached to them: up to three years after our last substantive contact, unless a longer period is needed for a contract, legal obligation, or dispute.
- Limited form-submit and email-click source signals: up to three years for trend and source comparison. These records contain no form answers or persistent visitor identifier.
- Unsuccessful job applications: deleted after the recruitment process, unless you agree that we may retain the application for future roles for up to two years.
- General and corrections correspondence: for as long as reasonably needed to respond and, where relevant, to maintain an appropriate legal or editorial record.
- Technical and security logs: for the periods set by the relevant service provider or as reasonably needed to investigate security and reliability issues.
- Aggregate AI-referral counters: retained for trend comparison. These records contain no visitor-level identifier.
International transfers
Some providers may process information outside the European Economic Area, including in the United States. Where required, transfers are protected by an adequacy decision, participation in the EU–US Data Privacy Framework, Standard Contractual Clauses, or another lawful safeguard. You may contact us for information about the safeguards relevant to your data.
Third-party services
Video pages use YouTube’s privacy-enhanced embed domain. YouTube may receive technical information and may store or read data when you play an embedded video. Links to Substack, social networks, and other external websites take you to services governed by their own privacy policies.
Cookies
Spot On does not currently use advertising trackers or analytics cookies on this website. Netlify Web Analytics is server-side and does not place analytics cookies or use client-side tracking code. The first-party AI-referral counter and limited lead-source signals do not set a cookie or create a visitor profile. To carry the limited inquiry-attribution values to a form during the same browser tab, the site uses session storage rather than a cookie. It stores no identifier and normally ends with that browser page session. The one-action event identifier used for a form submit or email click is not stored in session storage and is not reused. Essential storage or security mechanisms may be used by our hosting infrastructure. Third-party services may set or access data after you interact with them, such as by playing an embedded video or following an external link.
Your rights
Subject to the conditions in data-protection law, you may ask to access, correct, erase, restrict, or receive a portable copy of your personal data, and you may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
Send requests to handles@spot.news. We may need to verify your identity. You may also lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL).
Automated decisions and changes
We do not use personal data covered by this policy to make decisions based solely on automated processing that produce legal or similarly significant effects. We may update this policy as our services or legal obligations change; the current version and update date will remain available on this page.