Privacy Policy
Findspark ApS (FindSpot) Last updated: 9 August 2026 Effective from: 31 August 2026
1. Who we are
FindSpot is a campus discovery app that helps students find events, groups, communities and local offers relevant to their university, study programme and interests.
The data controller for the personal data described in this policy is:
Findspark ApS CVR no. 39312573 Lunagervej 22, 2650 Hvidovre, Denmark Email: hello@findspot.io Website: https://findspot.io
We are established in Denmark, and our lead supervisory authority is the Danish Data Protection Agency (Datatilsynet). We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy questions go to hello@findspot.io.
2. What this policy covers
This policy applies to the FindSpot mobile app, the findspot.io website, our sign-up and application forms, and our email communications (together, the Service).
FindSpot is a developing product, and its features change over time. This policy therefore describes the kinds of data we handle and the reasons we handle them, rather than listing every screen and feature. Where a new feature involves a genuinely new kind of data, or a new reason for using it, we will update this policy and tell you.
It does not cover the websites of advertisers, universities or student organisations that you reach through links in FindSpot, or the way your university handles data about you in its own systems.
3. Summary
| We collect | Your account and student-verification details, what you publish, how you use the app, technical device data, and your approximate location. |
| We use it to | Run the app, verify you are a real student, decide what to show you, keep the platform safe, and improve the product. |
| We do not | Sell your personal data. Target advertising using sensitive characteristics. Give universities or advertisers access to individual profiles or activity. |
| You can | Ask us to access, correct, export or delete your data, object to certain uses, and withdraw consent at any time, by emailing hello@findspot.io. |
4. The personal data we collect
4.1 Data you give us
Account and verification data. Your name or display name, university email address and the university it belongs to, your study programme and expected year of graduation, and optionally a profile photo and short bio. We also hold authentication data: a hashed password, or the identifier returned by your sign-in provider if you sign in through a third party.
For student organisations and businesses, we also collect the organisation’s name, the role of the person administering the account, and any evidence provided to obtain verified status.
Preferences. The audiences you choose when publishing, and the interests, groups and communities you follow.
Content you create. The cards you publish, including text, images, dates, locations and links; items you save; and reports you submit about other users’ content.
Communications. Messages you send us and our replies, and information you provide through forms on findspot.io.
4.2 Data generated by your use of the Service
We record how you use FindSpot: the content shown to you, how you respond to it, what you save or search for, and how you interact with notifications. Where sponsored content is shown, we record whether it was displayed and whether it was interacted with. We also keep records of moderation decisions, warnings, appeals and account restrictions.
4.3 Technical and device data
Device model, operating system and version, app version, language and time zone; IP address and the approximate country or city derived from it; push notification token; crash reports, performance data and diagnostic logs. We collect your device’s advertising identifier only if you grant tracking permission.
4.4 Location data
We use your approximate location, usually derived from your IP address, to show geographically relevant content. If we introduce features that use your device’s precise location, we will ask for your permission first, and you can withdraw it at any time in your device settings. Declining location permissions does not prevent you from using FindSpot.
4.5 Data about you from others
Content another user publishes that mentions or tags you, and reports another user files about your content.
4.6 Sensitive data
We do not ask for special category data as defined in Article 9 GDPR: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. Our interest categories are lifestyle categories, and we do not use them to infer any of the characteristics listed above.
Content you publish is visible to other students, and you may reveal sensitive information about yourself by choosing to publish it. Where you do, you are manifestly making that information public within the meaning of Article 9(2)(e) GDPR. Please consider this before you post.
5. Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account, and authenticating you | Contract — Art. 6(1)(b) |
| Verifying that you are a student at a participating university | Contract — Art. 6(1)(b) |
| Operating the Service: showing you content, deciding what appears in your feed, letting you publish, and notifying you about your content and activity | Contract — Art. 6(1)(b) |
| Showing aggregated engagement signals on content, such as how many students on a programme saved something | Legitimate interests — Art. 6(1)(f): making discovery useful, using aggregates that do not identify individuals |
| Moderating content, enforcing our Terms, and detecting fake accounts, spam and abuse | Legitimate interests — Art. 6(1)(f), and legal obligation — Art. 6(1)(c) for our obligations under the Digital Services Act |
| Understanding how the product is used and improving it | Legitimate interests — Art. 6(1)(f) |
| Keeping the Service secure, investigating incidents and maintaining backups | Legitimate interests — Art. 6(1)(f) |
| Selecting and displaying sponsored content based on context rather than individual profiling, and reporting aggregated results to advertisers | Legitimate interests — Art. 6(1)(f) |
| Providing aggregated, anonymised statistics to university partners | Legitimate interests — Art. 6(1)(f) |
| Using a device advertising identifier, or personalising advertising based on your individual activity | Consent — Art. 6(1)(a) |
| Using your device’s precise location | Consent — Art. 6(1)(a) |
| Sending marketing emails or promotional notifications | Consent — Art. 6(1)(a), or the existing-customer exception under the Danish Marketing Practices Act |
| Complying with legal obligations, including bookkeeping and responses to authorities | Legal obligation — Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed our interests against your rights and freedoms. You can request a summary of that assessment, and you can object to the processing, at any time.
6. Advertising and sponsored content
FindSpot is free for students. Part of how we fund it is by allowing local businesses, student organisations and university bodies to pay to promote content in the app.
Sponsored content is always labelled. Every paid placement is marked as an advertisement and tells you who paid for it and the main reasons it was shown to you, as required by Article 26 of the EU Digital Services Act.
Sponsored content is selected by context, not by profiling you. Placements are chosen using the university, campus, community, interest category or approximate area associated with what you are looking at. We do not build an advertising profile of you from your individual activity, and we do not share your individual activity with advertisers.
We will ask before that changes. If we introduce advertising that uses your device’s advertising identifier, tracks you across other apps and websites, or personalises placements based on your individual activity, we will ask for your consent first, and you can withdraw it at any time. Declining will not reduce your access to any feature.
We never target advertising using special category data, and we do not use profiling-based advertising towards users we know to be minors.
Advertisers receive aggregated reporting only: how often content was shown, how many people engaged with it, and a breakdown by community or campus. They do not receive your name, contact details, profile, or any record of your individual activity.
We do not sell your personal data.
7. University partnerships and aggregated statistics
We work with universities and student organisations to help improve campus life, and we may provide them with statistics about engagement on the platform as part of those partnerships.
These statistics are aggregated and anonymised. They describe patterns across groups of students — for example how active a faculty is, which interest categories attract the most engagement, or how widely an event reached. We apply a minimum group size to every figure we disclose, so that no statistic can be traced back to an individual or to a group small enough to make an individual identifiable.
Your university does not receive your individual activity, the content you saved, your interest selections, your profile, or any list of which students do or do not use FindSpot. Nothing we share with a university affects your studies, your grades or your standing at the institution.
8. Who we share data with
Other users. What you publish is visible to the audience you chose when publishing it. Your name, photo and study programme appear alongside content you publish.
Service providers. We use third parties to run the Service, each acting as a processor under a written data processing agreement as required by Article 28 GDPR, and each permitted to use your data only on our instructions. They fall into these categories: cloud hosting, databases and file storage; website hosting and form handling; email and domain services; push notifications and crash reporting; product analytics; customer support tooling; content moderation tooling; and payment and accounting services for our business customers. A current list of the providers we use is available on request from hello@findspot.io.
Others. Professional advisers bound by confidentiality; public authorities and courts where we are legally required to disclose; and, in the event of a merger, acquisition or sale of assets, the acquiring party. We will tell you before your personal data becomes subject to a different privacy policy.
9. International transfers
We aim to keep personal data within the EU/EEA. Where a provider processes data outside the EEA, we rely on an adequacy decision by the European Commission, the EU–US Data Privacy Framework where the provider is certified under it, or Standard Contractual Clauses adopted by the European Commission together with an assessment of the transfer and any additional measures needed.
You can request details of the safeguards applying to a particular transfer by emailing hello@findspot.io.
10. How long we keep data
We keep personal data only for as long as we need it for the purposes described in this policy, and then delete it or anonymise it. In practice this means:
- Account, profile and published content — for as long as your account is active, or until you delete the content.
- After your account is deleted — we delete or irreversibly anonymise your data promptly, normally within 30 days, and remove it from routine backups within a few months.
- Usage and analytics data — normally around 14 months at an individual level, after which we keep it only in aggregated form.
- Security and server logs — normally around 12 months.
- Moderation records — for a reasonable period after the decision, so that we can handle appeals and identify repeat violations.
- Support correspondence — normally up to three years.
- Accounting records — five years from the end of the financial year, as required by the Danish Bookkeeping Act.
- Anything relevant to a legal claim — until the claim is resolved, plus the applicable limitation period.
11. Your rights
Under the GDPR you have the right to:
- Access your personal data and receive information about how we process it
- Correct inaccurate data
- Delete your data where one of the grounds in Article 17 applies
- Restrict processing while a dispute is being resolved
- Receive a portable copy of the data you provided, in a structured, machine-readable format
- Object to processing based on legitimate interests, including engagement signals and product analytics. You can object to direct marketing at any time and we will stop.
- Withdraw consent at any time, without affecting processing carried out before withdrawal
- Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects
How to exercise your rights. You can delete your account at any time from within the app. For everything else — access, copies, corrections, objections and any other request — email us at hello@findspot.io and tell us what you would like. We do not currently offer these as self-service tools in the app, so email is the way to reach us, and we handle every request personally.
We respond within one month, and will tell you if we need longer for a complex request. We may ask you to confirm your identity first, usually by writing from the university email address on your account.
If you are unhappy with how we handle your data, you can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, www.datatilsynet.dk. If you live in another EU or EEA country, you may instead complain to your local supervisory authority.
12. How your feed is put together
What you see in FindSpot is ordered automatically. The main factors may include your study programme, the interests and communities you have chosen, how recently something was published, the audience the publisher selected, aggregated engagement from other students, and geographic proximity. Sponsored content is placed into the feed and is always labelled. We adjust how this works as the product develops.
Automated systems may flag content or accounts for review. A person reviews any decision to remove content, restrict publishing rights or suspend an account before it takes effect, except where content is manifestly illegal and immediate action is necessary. You can appeal any such decision — see our Terms and Conditions.
We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.
13. Security
We protect your data using encryption in transit and at rest, access controls limiting who can reach production data, logging of administrative access, and regular review of our providers. No system is perfectly secure, but we take these obligations seriously.
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify Datatilsynet within 72 hours of becoming aware of it, and we notify you directly where the risk to you is high.
14. Age requirements
FindSpot is intended for university students aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close the account and delete the data. Contact hello@findspot.io if you believe someone under 18 is using the Service.
15. Cookies and similar technologies
Our website. findspot.io does not currently set analytics, advertising or other non-essential cookies, and so we do not ask you for cookie consent. If we introduce them, we will ask for your consent first, through a banner that makes rejecting as easy as accepting.
Our app. Apps do not use cookies, but the same rules apply to information stored on or read from your device. We use software components for purposes such as crash reporting and analytics, and we ask for your consent to any that are not strictly necessary. On iOS we request tracking permission through Apple’s App Tracking Transparency prompt. Declining does not reduce your access to any feature.
Our Cookie Policy explains this in full, including the categories of cookies we would use and how to change your choices.
This reflects our obligations under section 10 of the Danish Cookie Order, implementing Article 5(3) of the ePrivacy Directive.
16. Additional information for United States residents
This section applies if you live in a US state with a comprehensive consumer privacy law, including California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Florida, Indiana, Kentucky and Rhode Island.
Categories of personal information we collect, using the terminology of the California Consumer Privacy Act: identifiers such as name, email address, device identifier and IP address; customer records such as contact details; commercial information such as interactions with sponsored content; internet and network activity such as how you use the app; approximate geolocation data; and inferences such as interest and community affinity. We use these to run the Service, keep it secure, decide what to show you, measure advertising, and improve the product.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA and equivalent state laws.
Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics about you, so the right to limit its use does not apply.
Your rights. Depending on your state, you may have the right to know, access, delete, correct and obtain a portable copy of your personal information, to opt out of sale, sharing, targeted advertising and certain profiling, and to appeal a refusal. We do not discriminate against you for exercising these rights. To exercise them, email hello@findspot.io. An authorised agent may submit a request on your behalf with written proof of authorisation. We honour Global Privacy Control and other universal opt-out signals sent by your browser.
Appeals. If we decline your request, you may appeal by emailing hello@findspot.io with “Appeal” in the subject line. We will respond within 45 days with our decision and the reasons for it. If we deny your appeal, you may contact your state Attorney General.
California Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.
17. Changes to this policy
We will post any changes on this page and update the date at the top. If the changes are material, we will notify you in the app or by email at least 30 days before they take effect. Where a change requires your consent, we will ask for it rather than assume it.
18. Contact us
Findspark ApS, CVR no. 39312573 Lunagervej 22, 2650 Hvidovre, Denmark hello@findspot.io