Privacy Policy

Last updated: July 14, 2026 · Effective date: [EFFECTIVE DATE]

Template notice. This is a starting template. Items in [BRACKETS] must be completed, and the policy should be reviewed by a licensed attorney and aligned with the data-handling requirements of Meta, Google, and applicable privacy laws (GDPR/CCPA) before publication. It is not legal advice.

This Privacy Policy explains how Cross Digital Solutions LLC, doing business as "Ryoken AI" and "SpotLight" ("we," "us"), collects, uses, and shares information when you use the SpotLight application and website (the "Service").

1. Information we collect

Account information: name, email, and authentication details (via email or Google sign-in).
Billing information: processed by Stripe; we do not store full card numbers.
Connected-account data: when you authorize integrations, we access data from those sources — for example, reviews and ratings, Instagram/Facebook reach, mentions and comments, Google Analytics traffic, Google Business Profile data, and competitor/ad-library information.
Usage data: log data, device and browser information, and how you interact with the Service.

2. How we use information

To provide, operate, and improve the Service.
To analyze feedback and signals using AI and generate insights, briefings, and recommendations.
To process payments and manage subscriptions.
To communicate with you about your account and the Service.
To maintain security and comply with legal obligations.

3. AI processing

We use third-party AI providers (including Anthropic's Claude models) to analyze content you submit or connect. Content sent for analysis is processed to produce Output such as sentiment scores, categories, summaries, and recommendations. [Describe whether data is used for model training — typically it is not for enterprise API usage; confirm and state explicitly.]

4. Third-party service providers (sub-processors)

We share data with vendors who process it on our behalf, including:

Provider	Purpose
Vercel	Application hosting
Supabase	Database & authentication
Stripe	Payment processing
Anthropic (Claude)	AI analysis
Meta, Google, and connected platforms	Data sources you authorize

We do not sell your personal information.

5. Data from Meta and Google platforms

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Meta (Instagram/Facebook) platforms is handled in accordance with Meta's Platform Terms and Developer Policies. We use this data only to provide features you have requested.

6. Data retention

We retain personal and connected-account data for as long as your account is active or as needed to provide the Service, and thereafter as required for legal, accounting, or security purposes. You may request deletion as described below.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing (e.g., under GDPR or CCPA). To exercise these rights, contact us at the address below. You can also disconnect any integration at any time from within the Service.

8. Security

We use administrative, technical, and organizational measures designed to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers

We may process and store information in the United States and other countries. Where required, we implement appropriate safeguards for international data transfers.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect their data.

11. Changes to this policy

We may update this Privacy Policy from time to time and will post the updated version with a new "Last updated" date.

12. Contact

Cross Digital Solutions LLC
[Business mailing address]
Email: [privacy@crossdigitalsolutions.com]