Privacy Policy

SpasAndSprings, Inc. (“Spas & Springs,” “we,” “us,” or “our”) is committed to protecting and respecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at spasandsprings.com (the “Site”), use our mobile applications, or engage with our services (collectively, the “Services”).

Please read this privacy policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of our Services immediately.

1. Information We Collect

We collect information in several ways when you interact with our Services:

1.1 Information You Provide Directly

• Account Information: Name, email address, phone number, password, and profile picture when you create an account.
• Booking Information: Service preferences, appointment dates and times, special requests, and party size.
• Payment Information: Credit or debit card number, billing address, and payment details (processed securely through our third-party payment processor).
• Communications: Messages you send to us, to vendors, or through our platform, including reviews and ratings.
• Survey & Feedback Data: Responses to surveys, questionnaires, or feedback forms.

1.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, search queries, click patterns, and time spent on the Site.
• Location Data: Approximate geographic location based on your IP address, or precise location if you grant permission.
• Cookies & Tracking Technologies: See our Cookie Policy for more details.

1.3 Information from Third Parties

• Social Media: Information from social media platforms if you choose to log in using a social account.
• Vendors: Information from wellness providers related to your bookings and service history.
• Analytics Partners: Data from analytics and advertising partners to help us understand how our Services are used.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our Services.
• To process bookings, payments, and refunds.
• To personalize your experience and provide tailored recommendations.
• To communicate with you about bookings, promotions, updates, and customer support.
• To facilitate communication between you and wellness providers.
• To monitor and analyze usage trends to improve our platform.
• To detect, prevent, and address fraud, security issues, and technical problems.
• To comply with legal obligations and enforce our terms.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• With Wellness Providers: To facilitate your bookings and provide the services you request.
• With Service Providers: Third-party companies that perform services on our behalf, such as payment processing, email delivery, hosting, and analytics.
• For Legal Reasons: When required by law, subpoena, or legal process, or to protect the rights, property, or safety of Spas & Springs, our users, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets.
• With Your Consent: When you have given us explicit permission to share your information.

4. Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, and similar technologies to collect information about your browsing activities and to distinguish you from other users of our Services. This helps us provide you with a better experience and allows us to improve our Services. For detailed information about the cookies we use and your choices regarding cookies, please see our Cookie Policy.

5. Your Rights and Choices

5.1 General Rights

• Access and Portability: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain legal exceptions.
• Opt-Out: Unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any email.

5.2 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, the right to opt out of the sale of personal information (we do not sell personal data), and the right to non-discrimination for exercising your rights.

Categories of Personal Information Collected in the Past 12 Months

• Identifiers: Name, email address, phone number, IP address, and account credentials.
• Commercial Information: Booking history, transaction records, and service preferences.
• Internet or Other Electronic Network Activity: Browsing history, search queries, and interactions with our Site and Services.
• Geolocation Data: Approximate location derived from IP address or precise location when permission is granted.
• Inferences: Preferences, characteristics, and behavior patterns drawn from the above categories to create a profile.

Categories of Sources

• Directly from you when you create an account, make a booking, or communicate with us.
• Automatically through cookies, pixels, and similar technologies when you use our Services.
• From third-party partners, including wellness providers, social media platforms, and analytics providers.

Business Purposes for Collection

• Providing and improving our Services, including processing bookings and payments.
• Personalizing your experience and delivering relevant recommendations.
• Marketing and promotional communications (with your consent where required).
• Detecting, preventing, and responding to security incidents and fraudulent activity.
• Complying with legal obligations, including tax reporting and law enforcement requests.

5.3 European Economic Area Residents (GDPR)

If you are located in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with a supervisory authority.

6. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data only when we have a valid legal basis to do so. The legal bases we rely on include:

• Contractual Necessity: Processing that is necessary to provide and manage your account and bookings, including facilitating transactions with wellness providers.
• Consent: Processing based on your freely given consent, such as for marketing communications, non-essential cookies, and analytics. You may withdraw your consent at any time.
• Legitimate Interest: Processing that is necessary for our legitimate business interests, including fraud prevention, platform security, and service improvement, provided these interests are not overridden by your rights and freedoms.
• Legal Obligation: Processing that is necessary to comply with our legal obligations, such as tax reporting and compliance with law enforcement requests.

7. International Data Transfers

Your personal information may be transferred to, stored, and processed in the United States or other countries where our servers or service providers are located. These countries may have data protection laws that differ from the laws of your country of residence.

For transfers of personal data from the European Economic Area (EEA) to countries that have not been deemed to provide an adequate level of data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as a legal mechanism for such transfers.

We ensure that appropriate safeguards are in place to protect your personal information in accordance with this Privacy Policy, including encryption in transit and at rest, access controls, and contractual obligations on our sub-processors to maintain equivalent protections.

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer need your information, we will securely delete or anonymize it.

The specific retention periods we apply are as follows:

• Account Data: Retained for the duration of your account plus 30 days after account deletion.
• Booking Records: Retained for 7 years to comply with tax and legal obligations.
• Payment Data: Payment information is retained by our payment processor, Stripe, in accordance with their data retention policy. We do not store full payment card details on our servers.
• Marketing Data: Retained until you withdraw your consent or unsubscribe from marketing communications.
• Server Logs: Retained for 90 days for security monitoring and debugging purposes.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, secure servers, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include a description of the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it.

We will also notify the relevant supervisory authority as required by applicable law, including under Article 33 of the GDPR for breaches affecting EEA residents.

11. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last Updated” date at the top of this page and, for material changes, we will notify you by email or through a prominent notice on our Site. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

13. Sub-Processors

We engage certain third-party sub-processors to assist in providing our Services. These sub-processors process personal data on our behalf and are contractually obligated to implement appropriate data protection measures. For a current list of our sub-processors and their roles, please visit our Sub-Processors page.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

14.1 Data Protection Officer

Our Data Protection Officer (DPO) can be reached for any data protection inquiries or concerns:

14.2 EU Representative

For individuals in the European Economic Area, our EU Representative can be contacted at: