Privacy

Who is responsible

The data controller is SpotIsland, publisher of SpotIsland (see the legal notice). Contact: contact@spotisland.com.

What we collect, and why

• Business listings (“Add my business” form): business name and contact details, contact email. To check, publish and keep the listing up to date. Business details are published; the contact email never is.
• Reviews, comments and trail updates: display name, text, email. The email is only used to confirm you wrote it; it is never shown.
• Member account (Google, Apple or email link): email, nickname, sign-in method, saved places, questions and answers. We never receive your Google or Apple password.
• Newsletter: your email, after you confirm with one click (double opt-in). One-click unsubscribe in every letter.
• Reports: your message, and your email only if you give it to get a reply.

Audience measurement, without cookies. To know which pages are useful, we count visits with our own tool, hosted with the site. For each page view we record the page, the site or campaign you came from, the country, the device type and the language, plus clicks on contact buttons (call, WhatsApp, email, website). Your IP address is never stored: it is only used to compute an anonymous identifier that changes every day, so you cannot be followed from one day to the next. These statistics are deleted after 13 months and shared with no one.

We never sell, rent or share data. There is no targeted advertising on the site.

Cookies and storage on your device

Only cookies needed for the site to work are used: keeping you signed in if you have an account (em_user, em_in) and securing Google or Apple sign-in (em_oauth, 10 minutes). No advertising or tracking cookies, which is why there is no cookie banner.

Your saved places, recent views, visit profile and the alerts you hide are stored only in your browser (local storage). You can clear them from your browser settings.

Service providers

• Netlify, Inc. (United States): hosting of the site and database.
• Brevo: sending emails (confirmations, sign-in links, newsletter).
• Google and Apple: only if you choose to sign in with them.
• Cloudflare Turnstile: anti-bot protection on some forms, when enabled.
• When showing some pages, your browser also contacts: Google Fonts (fonts), OpenStreetMap (map tiles), jsDelivr, unpkg and cdnjs (map libraries), YouTube in privacy-enhanced mode (webcam videos, only if you press play). Like any web page, these services receive your IP address.

How long we keep data

Account data is kept as long as the account exists. Newsletter emails are removed from the list when you unsubscribe. Sign-in links expire after 30 minutes. Listing data is kept while the listing is online, then deleted on request.

Your rights

Under the Mauritius Data Protection Act 2017 (and the GDPR if you live in the European Union), you can ask to access, correct or delete your data, or object to its use, by writing to contact@spotisland.com. You can delete your account yourself from “My account”: your email and nickname are erased and your messages remain as “Deleted member”.

You can also contact the Mauritius Data Protection Office.