Privacy Policy

Who we are

Spinlap is a software product company based in Chandigarh, India, and the operator of Spinlap Radar (“Radar”, “the platform”). Where this policy says “we”, it means Spinlap. Reach us at support@spinlap.com — that address handles data requests as well as support.

What we collect

If you create a workspace

• Account details — your name, email address, an optional organisation name, and a hashed password. We never store the password itself.
• Session records — each sign-in writes a session row with its IP address, device/user-agent string and expiry, so you can see and revoke your own active sessions and so we can spot account abuse.
• Workspace content — the domains, competitors, keywords, prompts, drafts and reports you create or that the platform generates for you.

If you run the free audit

• The domain you entered and the brand name detected in engine answers.
• Your email address, if you give one to unlock the full report. That is a lead, and we treat it as one: we may contact you about Radar.
• The requesting IP address and user agent. The audit endpoint needs no login and every run costs us money in engine calls, so this is recorded for rate-limiting and abuse accounting.

If you connect an account

Connecting Google Search Console or LinkedIn stores an access token (and where the provider issues one, a refresh token) so the platform can read your search data or publish on your behalf. Tokens are held server-side, used only for the feature you connected them for, and stop working the moment you revoke access at the provider.

Cookies

One session cookie, set when you sign in, which is what keeps you signed in. There is no advertising or cross-site tracking cookie on this site. The marketing pages load a webfont from Google Fonts; that request reaches Google’s servers as any font request would.

Why we collect it

• To run the platform — you cannot have a workspace, an audit result or a published post without the data that produces them.
• To keep it standing up — rate limits, abuse detection and cost control on endpoints that anyone can call.
• To improve the product. Radar gets better by learning which measurements and which content changes actually moved a citation. Where that learning crosses between customers it is aggregated and de-identified — we do not expose one customer’s workspace content to another, and we do not sell raw engine answers. See our terms.

Who else processes it

Radar is a thin layer over other people’s APIs, so being specific matters more than being reassuring. Depending on which features you use, data is sent to:

• OpenAI — content generation, quality scoring, and ChatGPT-side visibility checks.
• Perplexity and Google (Gemini / Generative Language) — visibility checks against those engines.
• DataForSEO — keyword, ranking and Google AI Overview data.
• Google Search Console — only if you connect it, and only to read your own property’s data.
• LinkedIn — only if you connect it, to publish what you asked us to publish.
• FormSubmit — the relay that emails us notifications, including audit leads. There is no mail server in this product.
• Supabase (managed PostgreSQL, ap-south-1), Amazon Web Services (application and jobs, ap-south-1) and Vercel (this website) — hosting and storage.

Prompts and page text sent to an AI engine are governed by that engine’s own terms while they are in its hands. We use official APIs only; we do not scrape these products.

What we do not do

• We do not sell your personal data.
• We do not resell raw engine output as a data product — the engines’ terms forbid it and it is not our business model.
• We do not run advertising trackers or share your data with ad networks.
• We do not write to your website. Radar reads public answers and, where you have explicitly connected a CMS, publishes only what you tell it to.

How long we keep it

Workspace content stays until you delete it or ask us to close the account. Sessions expire on their own and can be revoked at any time from your account. Audit records — including the domain, result and lead email — are retained so a returning visitor can find their earlier result and so we can measure change over time; ask us and we will delete yours. Backups roll off on our providers’ own schedules, so a deletion can take a short while to propagate through them.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email support@spinlap.com from the address on the account, or include the audited domain if the request is about an audit. We will not ask you to justify the request. Depending on where you live you may also have the right to complain to a data protection authority.

Security

Passwords are hashed. Traffic runs over HTTPS. Provider tokens and API keys are held server-side and are deliberately never shipped to the browser or baked into the frontend bundle. Workspaces are separated at the database level so one tenant’s queries cannot reach another’s rows. No system is perfect — if you find something, tell us and we will fix it.

Children

Radar is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.

Changes

When this policy changes we update the date at the top of the page. If a change materially affects how we handle your data, we will say so directly rather than relying on you re-reading this page.

A note on this document

This policy is written to describe the system accurately in plain language. It is not legal advice, and it has not been through external counsel. If you need a specific contractual or regulatory commitment — a DPA, a named legal entity, standard contractual clauses — ask us on the contact page and we will handle it properly rather than pointing at this page.