Legal

Privacy Policy

Spotlit is a page for your portfolio, stats, media kit, links, and brand inquiries. This policy says what we collect to run that page, including when you connect YouTube, TikTok, or Instagram.

Last updated 29 October 2026

Who we are

Spotlit is operated by Annastacia Kioko. For privacy questions, access requests, or deletion, email annetotoh@gmail.com. This policy is written for the EU and UK General Data Protection Regulation and for the Kenya Data Protection Act, 2019. If those laws apply to you, Annastacia Kioko is the data controller.

The short version

  • We collect the account and page details you give us.
  • Connecting YouTube, TikTok, or Instagram lets us read that account so you can fill your own page. We do not post, message, advertise, or train models with it.
  • A published page is public. We do not sell personal data.
  • You can disconnect a platform in the editor. You can delete the whole account yourself in Settings → Manage, or email us.

Account

When you create an account we store your name and email. A password is stored only as a hash, so we cannot read it back. If you continue with Google, we also receive the name, email, and profile image Google sends, plus the sign-in tokens Google issues for that login. Signing in with Google can attach to an existing Spotlit account that uses the same email.

Each session stores a login token, and the IP address and browser (user agent) of that session. We use those to keep you signed in and to investigate abuse. If you use Forgot password, we email a one-time reset link to the address on the account. The legal basis is the contract to provide your account, and our legitimate interest in keeping logins secure.

Your page

You decide what the page contains: name, handle, niche, location, headline, bio, a public email, a management contact, social handles and links, stats, featured videos, an audience summary, rates, partners, case studies, and link-in-bio links. The audience summary is totals you type (age bands, a women percentage, and locations). It is not a list of individual fans, and we do not pull that breakdown from YouTube, TikTok, or Instagram.

If you publish, anyone with the link can see the sections you left on, including a public email you chose to show. Unpublishing removes the page from its public URL. We host this content to provide the service you signed up for.

YouTube

Connect is optional. Google asks you to allow the read-only scope youtube.readonly. With that permission we read:

  • The channel id, title or custom URL, and subscriber count, unless the count is hidden.
  • View, like, and comment counts on recent uploads, used only to calculate average views and an engagement rate.
  • When you pick a video to feature: its title, view count, length, watch link, and thumbnail.

We store the access and refresh tokens encrypted, plus the channel id, handle, and profile URL. We do not upload, comment, or change the channel. The recent-video list is loaded so you can choose what to feature. We do not keep a video you do not add to the page, apart from the totals already written into your stats.

TikTok

Connect is optional. TikTok asks you to allow user.info.basic, user.info.profile, user.info.stats, and video.list. With those permissions we read:

  • Your open id, username or display name, and follower count.
  • View, like, comment, and share counts on recent videos, used only to calculate average views and an engagement rate.
  • When you pick a video to feature: its id, title or the first line of the description, view count, duration, share link, and cover image.

We store the access and refresh tokens encrypted, plus the open id, handle, and profile URL. We do not post videos, send messages, read your inbox, or collect your followers as people. TikTok data is used only to fill and display the Spotlit page of the creator who connected it. We do not sell it, use it for advertising, share it with other creators, or give it to Meta or Google. A video you do not add to the page is not kept, apart from the totals already written into your stats.

Instagram

Connect is optional. It uses Instagram API with Instagram Login for a professional account. Meta asks you to allow instagram_business_basic and instagram_business_manage_insights. With those permissions we read:

  • Your Instagram user id, username, and follower count.
  • Recent media: id, caption, like count, comment count, permalink, and image or thumbnail URL. If you feature a post, we keep the first line of the caption as its title.
  • View counts from media insights, used with likes and comments to show average views and an engagement rate.

We store the access token encrypted, plus the user id, username, and profile URL. We do not publish, comment, or read direct messages, and we do not receive a list of who follows you. Instagram data is used only for the page of the creator who connected it. We do not use it to build ads or to profile followers, and we do not give it to TikTok or Google.

Why platform access is allowed

You start each connection yourself, on that platform’s consent screen. That is consent. You withdraw it by choosing Disconnect in the editor, which deletes that platform’s tokens from Spotlit immediately. Stats, handles, and videos already copied onto your page stay until you edit or remove them. Disconnecting inside Spotlit does not, by itself, remove Spotlit from the platform’s own app list. You can also remove it there:

  • TikTok: Settings, then Security, then Apps and permissions.
  • Instagram: Settings, then Website permissions, or Apps and websites.
  • Google: myaccount.google.com/permissions.

Thumbnails

If you upload a thumbnail, we store that JPEG, PNG, or WebP file (up to 2 MB) in a public storage bucket so the page can show it. Anyone with the file’s address can view it. If you use the platform’s own image instead, we store that image’s URL, and a visitor’s browser loads it from YouTube, TikTok, or Instagram.

Brand inquiries

A person who uses the form on a published page sends their name, brand or company, email, campaign type, budget range, timeline, and message. We store that inquiry and show it to the creator who owns the page. The creator can delete it. We do not send it to anyone else, and we do not email it on. A hidden field catches bots; we do not keep what a bot types there. The creator asked for this form as part of the product. The person writing in is contacting that creator.

Payments

Pro is billed in Kenyan shillings through Paystack. We send Paystack your account email, the amount, and whether you chose card or M-Pesa. Card numbers, CVVs, and the M-Pesa prompt are handled on Paystack’s page. We do not store them. We do store the payment reference, amount, currency, channel (card or M-Pesa), billing interval, date paid, and Paystack’s customer and subscription codes. A card plan renews until you cancel it. An M-Pesa payment covers one period and does not renew by itself.

Cookies and storage on your device

  • A session cookie keeps you signed in. The service does not work without it.
  • A cookie named social_oauth lasts about ten minutes. It checks that a YouTube, TikTok, or Instagram connection was started by you.
  • Your light or dark choice is saved in local storage under spotlit-theme. That stays on your device.

We do not use advertising cookies or a third-party analytics product.

Who else processes it

We do not sell personal data. These companies process it only to run Spotlit:

  • Supabase stores the database and thumbnail files in the EU (Ireland).
  • Vercel hosts the application.
  • Google, when you sign in with Google or connect YouTube.
  • TikTok, when you connect TikTok.
  • Meta, when you connect Instagram.
  • Paystack, when you pay.

Vercel, Google, TikTok, Meta, and Paystack may process data outside Kenya and outside the EEA, including in the United States. Where the GDPR requires a safeguard for that transfer, we rely on the safeguard the provider offers, such as standard contractual clauses. A published page is visible to the public. A brand inquiry is visible to that creator.

How long we keep it

  • The account, the page, and billing records stay while the account is open.
  • Platform tokens stay until you disconnect or the account is deleted. They expire, and we refresh them only to keep a connection you have not removed.
  • Inquiries stay until you delete them or the account is deleted.
  • The session cookie lasts until you sign out or it expires. The connect cookie lasts about ten minutes.
  • An uploaded thumbnail stays until you replace it or the account is deleted. A replaced file may remain in storage until unused files are removed.
  • After deletion, a payment record may be kept where tax law requires it.

Your rights, and how to delete your data

Where the GDPR or the Kenya Data Protection Act applies, you can ask us to:

  • Confirm whether we hold personal data about you, and for a copy of it.
  • Correct it, or receive a portable copy of what you provided.
  • Delete it, or restrict or object to how we use it.
  • Withdraw consent for a connected platform, which you can do yourself with Disconnect.
  • Complain to a supervisor: the Office of the Data Protection Commissioner in Kenya (odpc.go.ke), or the authority in your EU or UK country.

Delete the Spotlit account yourself. Sign in and open Settings → Manage. Type DELETE to confirm. That removes the user, page, inquiries, YouTube / TikTok / Instagram tokens, uploaded thumbnails, and payment rows we store, and we cancel a renewing card plan with Paystack when those details are available.

Disconnect one platform. In the editor, open Stats or Socials and choose Disconnect. That deletes that platform’s tokens immediately. Text already copied onto your page stays until you edit or remove it.

Meta / Instagram data deletion callback. If you remove Spotlit from Instagram or Facebook and request deletion there, Meta calls our callback. We remove a matching connected Instagram account when we can identify it, and we give you a confirmation link under /deletion-status. You can also use Account deletion above.

Email annetotoh@gmail.com from the address on the account for any other request. We aim to answer within 30 days. There is no separate fee. If a request is manifestly unfounded or excessive, the law lets us refuse it or ask for more information to confirm it is you.

Children

Spotlit is for adults. We do not knowingly create accounts for anyone under 18. If you believe a child has an account, email us and we will delete it.

Changes

If this policy changes, the date at the top changes with it. The current version is always at this page. The Terms of Service cover the contract for using Spotlit.