Privacy Policy

Last updated: 2026-11-03

This policy explains what personal information SpotWise Data Group LLC, a New Jersey limited liability company ("SpotWise", "we", "us"), collects through the dashboard at app.spotdg.com and the website at spotdg.com, why we collect it, who sees it, and what you can ask us to do with it. The dashboard is in Beta.

1. What we collect

Dashboard (app.spotdg.com)

  • Sign-in details. When you sign in with Google, we receive your Google account email address, your display name, and whether Google has verified your email.
  • Session token. After sign-in, a session token is held in your browser's memory for up to 8 hours. It is lost when you reload the page or sign out. We do not set a persistent login cookie.
  • Sign-in cookie. One temporary cookie is used during the Google sign-in handshake to keep that step secure.
  • NDA acceptance. Your email address and the time you accepted the NDA.
  • My Markets. The zip codes you save, stored with your email address and the time you saved them.
  • Ask queries. The text of questions you type into Ask. The text is sent to an AI provider so it can be turned into filters. We send the query text only, not your name, email or other account details.
  • Server logs. Our hosting and database providers log requests, including your IP address. We use them to limit request rates and to alert us to abuse. See section 4 for how long they are kept.
  • Saved filter presets. Presets you save are stored in your own browser (local storage) on your own device. They are not sent to us.

The dashboard does not use analytics or advertising scripts.

Website (spotdg.com)

  • Aggregate page statistics. We use a website statistics service that does not use cookies and gives us counts of page visits, not profiles of individual visitors.
  • Forms. If you fill in a form, we receive what you type, such as your name, email address and message. Forms are handled by a form-handling service, which stores the submissions.

Maps. The dashboard map loads map tiles from a map-tile host that serves open map data. Your browser requests those tiles directly, so that host can see your IP address.

Market Signal Report. The PDF is created in your browser, and nothing in it is sent to SpotWise. In the current version, the library that builds the PDF may be loaded from a content-delivery network. Like any web request, that request lets the network's operator see your IP address.

2. Why we use it, and our basis for doing so

  • To let you sign in and to keep the dashboard secure. We need this to provide the Service you asked for.
  • To record that you accepted the NDA. We need this to meet our agreement with you.
  • To store the zip codes you save, so they are there when you return. You ask us to do this when you save them.
  • To turn your Ask text into filters. You ask us to do this when you submit a question.
  • To prevent abuse and keep the Service working (logs). This serves our legitimate interest in running a secure service.
  • To understand which pages of the website are visited (website statistics service). This serves our legitimate interest in improving the site, using data that is not tied to you.
  • To reply to your form messages. You ask us to do this when you send one.

We do not use your information for advertising, and we do not make decisions about you by automated means that have legal effects.

3. Where the data comes from for the scores

The scores in the dashboard are built from public, non-personal data: Zillow home-value and rent indices, the Census Bureau's American Community Survey, IRS Statistics of Income, OpenStreetMap, city-level crime indices, and state permit and business records. None of it is information about you.

4. How long we keep it

  • Session data: until you sign out, or 8 hours, whichever comes first.
  • Saved zip codes and NDA acceptances: until you ask us to delete them or your account is removed. We may keep the NDA record longer if we need it to show what was agreed.
  • Server logs: the dashboard's hosting provider, Railway, keeps application and request logs, which include visitors' IP addresses, for 7 days on our current plan. The database provider, Supabase, keeps API and database logs, which can include IP addresses, for up to 28 days depending on our plan. If more than five sign-in attempts are rejected within ten minutes, the dashboard emails the founders an alert that lists the attempted email addresses and IP addresses (up to twenty). Those emails stay in the founders' mailboxes until deleted.
  • Form submissions: until you ask us to delete them, or we no longer need them to answer you.
  • Website analytics: kept in aggregate form only. There is no personal profile to delete.

5. Who we share it with

We do not sell personal data. We share it only with the companies that help us run the Service, and only for that purpose:

  • A sign-in provider, for sign-in.
  • A database host in the United States, which hosts our database.
  • Hosting for the dashboard, and hosting for the website.
  • An AI provider, which processes Ask query text.
  • A form-handling service, which receives and stores website form submissions.
  • A website statistics service, which provides website page statistics.
  • Map-tile hosts, which serve map tiles to your browser.
  • An email service, which carries alert emails to our founders. These alerts can contain the attempted email addresses and IP addresses from rejected sign-ins.

The current list of these providers is on the Service providers tab.

We may also disclose information if the law requires it, or to protect our rights, our users or the security of the Service. If SpotWise is sold or merged, personal data may transfer to the new owner, who must honor this policy.

6. Security

Connections to the website and the dashboard use HTTPS. The database's public API keys are blocked from reading customer tables. The dashboard connects to the database with a privileged account whose credentials are held by the founders and by the services that run the dashboard for us. No system is perfectly secure. If we learn of a breach that affects you, we will tell you as the law requires.

7. Your rights

You can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct anything that is wrong;
  • delete your personal data, including your saved zip codes and NDA record (the dashboard checks for your NDA acceptance record before it serves data, so deleting that record ends your access to dashboard data from your next sign-in).

To make a request, email legal@spotdg.com. We may need to confirm you are who you say you are, and we will reply within a reasonable time. Depending on where you live, you may have additional rights under local law, and you may complain to your local data protection authority.

8. Children

The Service is for people who are 18 or older. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

9. Where data is stored

Our database is hosted in the United States, and our other providers may process data in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to and handled in the United States.

10. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date at the top. If a change is material, we will tell signed-in users, for example on the sign-in screen or by email.

11. Contact

Questions or requests about privacy: email legal@spotdg.com.

The business responsible for your information is SpotWise Data Group LLC, 991 US Highway 22 West, Suite 200V, Bridgewater, New Jersey 08807.