Privacy policy

1. About this notice

Zspot8 is a marketplace for exterior advertising spaces in India. This notice describes the information collected when you browse, create an account, publish a space or request a booking. “We” means the operator of Zspot8. For privacy requests and complaints, contact shubham.ghotekar1996@gmail.com.

This notice is informed by the Information Technology Act, 2000, the applicable 2011 sensitive personal data rules, and the Digital Personal Data Protection Act, 2023 and Rules, 2025, as applicable. The DPDP framework has phased commencement; not every provision is in force as of this notice’s date. This page is not a certification of legal compliance. Official rules and enforcement timeline.

2. Information we collect and why

• Account information: name, mobile number, email address, account identifier and sign-in information, to create and secure your account and associate your listings with you. Passwords are processed by the managed authentication service, not stored as readable passwords in the marketplace’s profile records.
• Booking information: name, email, phone number, requested starting month, duration and optional campaign note, to send your request to the relevant space owner and coordinate the booking.
• Listing information: site address, city, state, PIN code, description, dimensions, monthly rent, photo and optional video, to advertise the space publicly. Do not upload identity documents, payment secrets or images of people without appropriate permission.
• Technical information: visitor analytics and error information described below, to understand usage and maintain the site.

Providing account or booking details is optional, but we cannot complete the corresponding service without its required information. The current forms do not request Aadhaar, PAN, card details or UPI PINs. Phone-format checks do not verify ownership of a mobile number, and email confirmation does not establish a person’s legal identity.

3. Who receives your information

Published listing details and media are intended for public browsing. Your booking contact details and campaign note are available to the relevant space owner; signed-in requesters can access requests linked to their account. Your profile name and mobile number are not part of the public listing feed.

Lovable Cloud provides hosting, account authentication, database and media storage. Lovable’s managed email service and its delivery providers process recipient addresses and authentication messages to deliver confirmations and recovery emails. If you choose Google sign-in, Google processes the sign-in and shares the authorised account information through Lovable’s sign-in service; Google’s own privacy terms also apply. These service providers handle data under their applicable terms.

Opening “Open in Maps” takes you to Google Maps with the listing address in the link; Google receives that request and handles it under its own privacy policy. It is a link, not an embedded map. We may disclose information when legally required or necessary to address fraud, security incidents or a legal dispute. We do not use account or booking details for unrelated marketing through the current marketplace workflow.

4. Visitor analytics and device storage

Lovable visitor analytics and click tracking are enabled. With no consent banner currently connected, clicks and the other information listed here are recorded for every visitor. Page visits, time on page, page speed and errors are recorded for every visitor, without cookies and without identifying anyone.

Analytics records pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and clicks on links and buttons. Detailed data is kept for 90 days and daily summaries for a year.

Lovable’s analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

Separately, account sign-in stores session information in your browser’s local storage to keep you signed in. Signing out removes the active local session. Sign-in providers may use their own storage on their services. Error reporting sends error messages, stack traces and page context to Lovable to help diagnose problems; avoid putting sensitive information in campaign notes or other free-text fields.

5. Security, retention and processing location

Database and storage access rules restrict profile access to the account holder and booking access to the parties authorised for that request. Public media access is limited to media referenced by published listings belonging to the uploading owner. These controls reduce risk but do not guarantee that a service can never be compromised.

Account, listing and booking records remain in the service until removed through an applicable process. A fixed automatic deletion schedule for these records is not currently configured. You can request deletion or correction by email; information required for applicable legal obligations, unresolved disputes, security or fraud prevention may need to be retained. Backups and service logs may remain subject to the providers’ retention terms.

We do not promise India-only storage or processing. Hosting, delivery and sign-in providers may process information outside India. Applicable transfer restrictions and provider arrangements must be reviewed by the operator before making any data-localisation commitment.

6. Your choices and privacy requests

Email the contact above to request information about your data, correction, deletion, withdrawal of consent for consent-based processing, or to raise a complaint. Include the email used for your account or booking and a short description; never send a password, OTP or UPI PIN. We may verify control of your account before acting to prevent unauthorised disclosure or deletion.

You may stop submitting information or using the service. Withdrawing consent does not undo earlier lawful processing and may prevent us from continuing an account or booking service. Where applicable law grants access, correction, erasure, grievance or nomination rights, you may ask us to facilitate them. We will handle requests under the applicable law; this site does not currently offer an automated privacy-request or account-deletion tool.

Raise grievances with us first. Where available under provisions in force, you may use the competent authority’s complaint mechanism. We do not claim that all DPDP complaint procedures are already operational.

7. Children and updates

The current service is not designed for children’s use and does not implement parental-consent or age-verification flows. If you believe a child’s information has been submitted, contact us so it can be reviewed and handled under applicable law.

Material changes to data use will be reflected in this notice. New uses that require consent should be presented separately rather than inferred from merely visiting this page.