Privacy

What Spot stores, and what it doesn't. Last updated 14 October 2026.

Who's responsible

Spot is an independent rental-alert service for the Netherlands, reachable at hello@spotnl.com. For the GDPR, the operator of Spot is the data controller for everything below. Spot is not affiliated with Funda, Pararius, Kamernet, HousingAnywhere, or any landlord or agency.

What we collect

• How you sign in. Your email address, and if you use Apple or Google, the account ID and name they pass on. With Apple you can hide your address; we then only see Apple's relay address. We never see a password: email sign-in uses one-time codes.
• Your phone, if you use the app: a push token, so alerts reach it. Nothing else about the device.
• Your search. Cities, maximum rent, rooms, floor area, kind of place, and which sites you want to hear from.
• Delivery records. Which listings we sent or replied to and when, so nothing is sent twice and daily limits work. Plus anything you saved or hid.
• Purchase records. If you buy a pass: which plan, when it starts and ends, and the payment reference from Apple.
• Rental-site credentials, only if you switch on auto-apply. Covered separately below.

Cookies on this website

A few cookies keep you signed in after you log in, and one remembers your language if you pick one. They are needed for the site to work, so there is no banner. There are no analytics, no advertising and no third-party scripts. One thing to know: listing photos on your account page load straight from the rental site that published them, so that site sees your browser's request.

Emails we send

Sign-in codes when you ask for one. And, if no phone with the Spot app is getting your alerts, one email a day at 18:00 with that day's new matches, only on days there are some. Every one of those has an unsubscribe link, and the switch is on your account page. No newsletters, no marketing.

Why we're allowed to hold it

Your account, search, settings and delivery records are processed to provide the service you asked for (GDPR Art. 6(1)(b)). Purchase records are kept on the same basis and for accounting. Rental-site credentials are processed on your explicit consent, given when you tick the box and connect, and you can withdraw it at any time.

Rental-site credentials

If you never connect an account, Spot never asks for a login to anything and this section doesn't apply to you. Auto-apply works by signing in to Kamernet as you and sending your message to rooms that match your search. That needs your Kamernet email and password, so:

• The password is encrypted at rest and only decrypted at the moment a sign-in is made.
• It is used for one thing: replying to listings that match your search. Never to read your messages or change your account.
• It is never shared, and never sent anywhere except Kamernet's own login.
• Disconnecting on your account page deletes it. Switching auto-apply off stops all use of it immediately.

Letting another service sign in as you may go against Kamernet's terms. You decide whether that is worth it; we won't pretend the question doesn't exist.

Who else sees your data

We don't sell it, rent it, or give it to advertisers, landlords or agencies. It is shared only with:

• Supabase, which runs our database and the sign-in, on servers in the EU.
• Resend, which delivers our emails.
• Vercel and Cloudflare, which serve this website and carry traffic to our server.
• Apple or Google, if you sign in with them: they confirm who you are to us.
• Apple and Expo, if you use the iPhone app: purchases and push notifications go through them.
• Kamernet, only if you connected it, and only your login and the message you wrote.

How long we keep it

Your account, search and settings are kept while your account exists. Delivery records are kept so we don't resend what you've seen. Purchase records are kept as long as accounting rules require. Deleting your account on your account page, or in the app, removes all of it at once, sign-in included.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to its use, or take it with you. Email hello@spotnl.com and we'll answer within 30 days, free and without needing a reason. You can disconnect your Kamernet login, or delete your whole account, yourself at any time on your account page. If you think we've handled your data badly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We'd appreciate the chance to fix it first.

Listing data

Listings are published publicly by the rental sites. We store a copy to tell new listings from ones already seen, and always link back to the original. We don't claim ownership of any of it.

Changes

If this policy changes in a way that affects your data, we'll tell you. The date at the top is always current.