Privacy Policy

Last Updated: October 4, 2026

This Privacy Policy ("Policy") describes how MMJI CHILLZ, LLC, a Delaware limited liability company, operating as Spotful ("Spotful," "we," "us," or "our"), collects, uses, and shares personal information when you use the Spotful website at spotful.io and its related domains, the Spotful booking and venue management tools, and the emails we send (collectively, the "Services"). Spotful is a marketplace that helps people find venues for private events and group gatherings, and request, plan, and pay for bookings with those venues.

Please read this Policy together with our Terms of Service. This Policy is a notice of our privacy practices; it is not a contract and is not part of the Terms of Service. If you have questions, contact us at support@spotful.io.

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1.1 Who We Are

Spotful is operated by MMJI CHILLZ, LLC, a Delaware limited liability company. We and our affiliates may also operate other online services. Spotful may run on technical systems, and be supported by staff, that are shared with our affiliates, our predecessors, and other services that we, they, or a company that provides those systems to us operate, as described in Section 5.3.

1.2 People This Policy Covers

This Policy applies to:

Hosts: People who browse venues, send booking requests, receive quotes, and pay for bookings through the Services.
Guests: People who attend an event that a host has booked. The booking flow generally asks for the number of guests rather than their names (see Section 2.7).
Venue Team Members: People who manage a venue's listings and bookings through our venue management tools.
Visitors: Anyone who browses the Services without making a booking.

1.3 What This Policy Does Not Cover

Each venue listed on Spotful is an independent business. This Policy does not describe how a venue handles the information it holds about you, including information it collects directly from you or receives from us to manage your booking. The venue's own privacy practices apply to that information (see Section 5.1).

Where we process personal information on a venue's behalf and on its instructions, for example, where the Services allow it, contact records that a venue uploads or imports, messages that a venue sends using our tools, or information synced from third-party services that a venue connects, we act as the venue's service provider for that processing, and the venue's own privacy practices apply to it. We may also use that information as the law permits a service provider to, including to build and improve the Services, to detect and prevent security incidents, fraud, and abuse, to comply with legal obligations and establish, exercise, or defend legal claims, to create de-identified or aggregated information, and to maintain records of opt-out requests across the Services.

This Policy also does not cover third-party websites and services that we link to (see Section 13), or the way Stripe, the payment processor, handles the payment information you enter into its payment form, which is described in Stripe's own privacy policy.

2. INFORMATION WE COLLECT

2.1 Booking Information You Provide

When you start a booking request, we save the information you enter as you go, so that you can return to it later. This happens before you submit your request. We collect:

Contact Information: First name, last name, email address, and phone number. These are required to send a booking request.
Event Details: The venue and space you choose, the date and time, the number of guests, and the type of event, either chosen from a list (such as a birthday or corporate event) or described in your own words.
Food, Beverage, and Add-On Selections: The packages and items you choose, their quantities and durations, and your choice of who is responsible for any food and beverage minimum spend (you, your guests, or a combination), including any limit you set.
Booking Progress: The steps of the booking flow you have completed.

Booking information you have entered but not yet submitted is stored in our systems and may be visible to the venue.

Spotful currently uses email sign-in. When you sign in, or when you verify your email address during a booking, we may send a one-time code or a sign-in link to your email address. If no account exists for that email address, we create one. We collect your email address, the account identifier we assign to you, and records of your sign-ins.

If you start a booking before signing in, we create a temporary guest session for your browser. When you verify your email address, the booking is attached to your account, and earlier booking activity associated with that email address may also be linked to your account.

To protect the Services from abuse, we may limit how often certain actions, such as requesting sign-in codes or submitting forms, can be performed. For this purpose we and our rate-limiting provider may process your IP address and email address.

If you save venues to a list, we store that list with your account.

2.3 Payment Information

You enter your payment details, such as card, digital wallet (including Apple Pay and Google Pay), or other payment method details, directly into a payment form provided by Stripe, which collects your full card number and security code. We may receive and store limited details, such as the card brand, the last four digits, the expiration month and year, and the identifiers Stripe assigns to your payment method and customer record. Stripe may also ask for billing details, such as a postal code, to process your payment, and it handles that information under its own privacy policy. We also keep records of your payment schedule, the payments made and refunded, and their status.

To process booking payments, a customer record containing your name, email address, and phone number is created in Stripe for the account that receives your payment. When you pay, your payment method may be saved so that later scheduled payments for the same booking can be charged, as explained to you at the time of payment.

2.4 Profile Information

You may choose to add information to your profile, such as your name, phone number, a short bio, profile and cover images or videos, links, and a public profile handle. If you create a public profile handle, your profile page, including your name, images, bio, and links, may be viewed by anyone who visits it, and other signed-in users may be able to follow it. You may be able to remove your public profile handle in your profile settings.

2.5 Requests, Messages, and Other Content You Submit

Change Requests: If you ask to change a confirmed booking, we collect the details of the change you propose and any message you include.
Booking Agreements: If a venue requires you to sign a booking agreement, we may record the name you type as your signature, your email address, the terms you agreed to, the date and time, and the IP address and browser information of the device you used.
Venue Materials: Some venues may ask for contact details, such as your name and email address, before you can download materials such as brochures or menus. That information is provided to the venue.
Support Communications: Information you include when you contact us.

2.6 Information Venues Provide About You

A venue can create a booking on your behalf or edit a booking, and in doing so may enter your name, email address, phone number, event details, and notes. As a venue manages your booking, it also adds information such as quotes, prices, payment schedules, notes, and the reasons for declining a request or a proposed change. Some of this information is shared with you.

2.7 Information About Your Guests

The booking flow generally asks for the number of guests rather than their names or contact details; please do not provide guests' personal information to us unless a feature asks for it. If your guests pay for their own food or drinks, they generally pay the venue directly.

2.8 Information About Venue Team Members

Account and Role Information: Name, email address, and the roles and permissions assigned to you.
Activity Information: Actions you take in our venue management tools, such as issuing a quote or changing a booking, and when you took them.
Payment Account Information: Venues may set up payment accounts with Stripe, which collects the required business and identity information through its own onboarding process. We may receive information about the account, such as its status and account and payout details, from Stripe.
Venue Content: Information you add about the venue, its spaces, offerings, prices, and availability. When you enter a venue's address, we may use Google Maps Platform to look up and confirm the location.

2.9 Information We Collect Automatically

When you use the Services, we and our service providers automatically collect:

Device and Browser Information: IP address, browser type, operating system, device type, and language preference.
Approximate Location: City, region, country, time zone, and approximate coordinates derived from your IP address.
Usage Information: The pages you view, the page that referred you, campaign parameters included in links (such as "utm" tags), when you leave a page, and actions you take in the Services, such as starting, submitting, or paying for a booking.
Page View Records: When you view a venue's page or a booking page, we may record the view together with identifiers, device and location information, and the link used.
Error and Performance Information: Error reports, performance measurements, and, when an error occurs, recordings of recent activity on the page, as described in Section 3.1.
Activity Records: Records of changes made to a booking, including who made each change and when.

2.10 Information From Other Sources

Stripe: The status of your payments, refunds, and disputes, and the limited card details described in Section 2.3.
Cloudflare: The result of any bot check performed when you sign in or start a booking (see Section 3.1).
Venues: The information described in Section 2.6.
Our Affiliates and Other Services: If you have used the same email address with another service that we, our affiliates, our predecessors, or a company that provides our technical systems operate, your sign-in identity and basic profile information may already exist in our systems (see Section 5.3).
Third-Party Services Connected by Venues: Information synced from services that a venue connects to the Services, as described in Section 1.3.

3. COOKIES AND SIMILAR TECHNOLOGIES

3.1 Technologies We Use

Cookies are small text files placed on your device when you visit a website. We and our service providers also use similar technologies, such as your browser's local storage and session storage, and scripts that collect information about your visit. We use:

Essential Technologies: Cookies that keep you signed in and secure your session, a cookie that remembers your language preference, and technologies used by our bot-detection service and by Stripe's payment form to help prevent fraud and abuse. The Services cannot work properly without these.
Functional Storage: Your browser's local and session storage, which we may use to remember your booking progress, your recent venue searches, your accessibility settings, and information that allows a booking you started as a guest to be linked to your account.
Our Own Page View Measurement: A first-party cookie containing a random visitor identifier, which we may use to count views of venue pages and booking pages, as described in Section 2.9, and to show you a consistent version of a page when we test changes to the Services.
Bot Detection (Cloudflare Turnstile): We may use Cloudflare Turnstile when you sign in or start a booking. When it runs, Cloudflare receives your IP address and information about your browser and device to help distinguish people from automated programs.
Product Analytics (PostHog): PostHog records the pages you view, when you leave them, and actions you take in the Services, such as starting, submitting, or paying for a booking, and stores an identifier in a cookie and in your browser's local storage. After you verify your email address, we associate this activity with your email address, name, and phone number. If session recording is enabled, PostHog may also record your interactions with our pages.
Website Analytics (Vercel Web Analytics and Speed Insights): These services measure page views, actions such as starting or submitting a booking, and site performance without using cookies.
Google Analytics: We use Google Analytics, a web analytics service provided by Google, to understand how visitors find and use the Services. Google Analytics uses cookies and similar technologies to collect information such as the pages you view, the page that referred you, the campaign or ad that brought you to the Services, information about your browser and device, your approximate location, and actions you take on the Services, such as starting a checkout or a booking, submitting an inquiry, or completing a purchase. You can control whether Google Analytics runs using Privacy choices (Section 3.3). Google's use of this information is described in How Google uses information from sites or apps that use our services.
Google Ads and Personalized Advertising: We also use Google Ads, and we may link Google Analytics to it and use Google Analytics Advertising Features, including remarketing and demographics and interests reporting. This lets us measure how our ads perform and show our ads to people who have visited the Services, on Google services and on other websites and apps. Third-party vendors, including Google, show our ads on sites across the internet and use cookies and similar identifiers to show ads based on your past visits to the Services and to other websites. We and these vendors use first-party cookies, such as the Google Analytics cookie, together with third-party cookies, such as Google advertising cookies, to inform, optimize, and serve ads based on your past visits, and to measure how our ads perform. If you are signed in to a Google Account, Google may also associate this information with your account, depending on your Google Account settings. We may also share hashed contact information, such as your email address or phone number, with advertising partners such as Google to measure and improve our ads. You can opt out of personalized advertising by turning off Advertising in Privacy choices (Section 3.3), in Google's Ads Settings, or on the Network Advertising Initiative's opt-out page, and you can stop Google Analytics from collecting information about your visits with the Google Analytics opt-out browser add-on.
Customer Relationship Management and Website Analytics (HubSpot): HubSpot's tracking script runs on our pages and uses cookies to record the pages you view. After you verify your email address, we may associate this activity with your email address in HubSpot, and when you sign in, we may create or update a contact record in HubSpot with your email address, name, and phone number.
Error Monitoring (Sentry): Sentry receives error reports, together with your account identifier, email address, name, phone number, and IP address if you are signed in. When an error occurs, Sentry may capture a recording of your recent activity on the page to help us diagnose the problem. These recordings may include information displayed on the page, such as booking details.
Maps: Map images are loaded from map providers such as CARTO and, depending on our configuration, MapTiler, Mapbox, or OpenFreeMap. These providers receive your IP address and the map area your browser requests.

3.2 Tags Added by Venues

A venue's profile page on Spotful may include the venue's own analytics or advertising tags, such as the Meta Pixel, Google Analytics, Google Tag Manager, the Snap Pixel, or the TikTok Pixel. If it does, those tags run when you visit that venue's profile page, and the tag provider may use cookies and collect information such as your IP address, browser and device information, the pages you view, and actions you take on that page, such as starting a booking. That information is collected by the provider for the venue, under the venue's and the provider's own terms and privacy policies. Venue tags may be subject to your Analytics or Advertising choices described in Section 3.3, depending on the type of tag. Spotful's own use of Google Analytics and Google Ads is described in Section 3.1.

Privacy Choices: You can choose whether to allow optional analytics and advertising technologies using Privacy choices, which you can open from the footer of our pages and from your profile settings. Technologies that are necessary for the Services, such as those used for signing in, payments, security, and keeping the Services working, are not covered by these choices.

Analytics includes Google Analytics, PostHog, session recordings, the visitor identifier cookie described in Section 3.1, and venues' analytics tags on their pages.
Advertising includes Google's advertising features described in Section 3.1, HubSpot's tracking script, and venues' advertising tags on their pages.

Depending on where you are, optional technologies may be off until you turn them on, or on until you turn them off. Your choices apply to the browser and website in which you make them. Turning a category off does not affect information collected before you did so, or information we process for other purposes described in this Policy, such as contact details we share with HubSpot as described in Section 3.1.

Global Privacy Control: If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information for targeted advertising for that browser.

Browser Settings: Most web browsers let you view, delete, and block cookies and clear local storage, and many offer private browsing modes and tracking-protection features that block third-party scripts. If you block essential cookies or storage, you may not be able to sign in, book, or pay. Our Services do not currently respond to "Do Not Track" browser signals, which are different from Global Privacy Control signals.

4. HOW WE USE YOUR INFORMATION

4.1 Providing the Services

Create and maintain your account and sign you in
Save your booking progress and let you return to an unfinished booking
Send your booking request to the venue and show you quotes, prices, and payment schedules
Process payments, save payment methods you authorize for scheduled payments, and record refunds
Let you propose changes to a booking and let the venue respond
Record booking agreements where a venue requires one
Provide customer support and respond to your requests
Operate optional features, such as saved venues and public profiles
Help venues manage their listings, availability, and bookings

4.2 Communications

Send sign-in codes and links
Send booking emails, such as confirmations of your request, quotes, payment receipts, and notices that a request has been declined, has expired, or has been canceled
Tell you about changes to our Services, our Terms of Service, or this Policy
Send information about Spotful where permitted by law, subject to your right to opt out (see Section 9.3)
Notify our internal team about booking activity so we can support hosts and venues

4.3 Safety, Security, and Legal Compliance

Verify that you control the email address you use
Detect and prevent fraud, abuse, automated misuse, and unauthorized access
Keep records of booking changes, agreements, and payments
Handle payment disputes, returned payments, and refunds
Comply with legal, tax, and accounting obligations
Enforce our Terms of Service and establish, exercise, or defend legal claims

4.4 Analytics and Improvement

Understand how the Services are used and measure views of venue and booking pages
Diagnose errors and improve the reliability and performance of the Services
Develop and improve features, including by testing different versions of pages and measuring the results
Create aggregated or de-identified information, which we may use for any purpose

4.5 Advertising

Subject to your choices described in Section 3.3, we use information about your visits to:

Measure how our Google ads perform, including which ads led to inquiries, bookings, and payments
Show ads for Spotful to people who have visited the Services, on Google services and on other websites and apps

4.6 Other Purposes

We may also use personal information for other purposes that we describe to you when we collect it, or with your consent.

5.1 With the Venue You Book

By starting a booking with a venue, you direct us to share the information you enter with that venue, including before you submit your request. When you start or submit a booking with a venue, the venue and the members of its team who manage bookings can see your booking, including:

Your first and last name, email address, and phone number
Your event type, number of guests, date and time, and requested space
The packages and items you selected, prices, the payment schedule, and payment status, including your card brand and last four digits
Change requests and the messages you include with them
Booking agreement records, including the signature information described in Section 2.5

The venue's team may also receive booking emails with these details, and your name, email address, and phone number may be added to the venue's customer records so it can manage your booking and communicate with you.

The venue is the seller of its services. Depending on the venue's payment setup, your payment is processed through the venue's own Stripe account or through a Stripe account that we designate to collect payments for the venue as its payment collection agent. The account that receives your payment holds the related Stripe customer record and any payment method you saved.

Venues are independent businesses and are responsible for how they use and protect your information, including any information they collect from you directly. A venue may contact you about your booking and may use your information for its own purposes under its own privacy practices. We encourage you to review a venue's privacy practices and to contact the venue directly with questions about them.

5.2 With Service Providers

We may share information with service providers that process it on our behalf to operate the Services, including:

Hosting and Infrastructure: Vercel (website hosting), Supabase (database, authentication, and file storage), and Upstash (rate limiting).
Payment Processing: Stripe.
Email Delivery: Resend.
Bot Detection: Cloudflare (Turnstile).
Analytics and Customer Relationship Management: Google Analytics, PostHog, Vercel Web Analytics and Speed Insights, and HubSpot.
Error Monitoring: Sentry.
Maps and Location Services: Map providers such as CARTO, MapTiler, Mapbox, and OpenFreeMap, and Google Maps Platform for venue addresses entered by venue team members.
Internal Communications: Tools we may use to notify our internal team about booking activity, which may include booking details.
Content Safety: Automated tools that may help us review images or text uploaded to the Services for safety and compliance with our policies.

5.3 Affiliates and Other Services

We may share personal information with our affiliates, which may use it for the purposes described in this Policy. Spotful may run on technical systems, and be supported by staff, that are shared with our affiliates, our predecessors, and other services that we, they, or a company that provides those systems to us operate, and information collected through Spotful may be stored in the same systems as information from those services and accessed by the same staff and service providers. If you use the same email address with another such service, your sign-in identity and basic profile information, such as your name, phone number, and profile images, may be shared across those services. If a venue also uses another such service, it may be able to see its Spotful customers together with its other customer records.

5.4 Legal Requirements and Protection of Rights

We may disclose information:

In response to a subpoena, court order, or other legal process
To comply with applicable laws and regulations
To protect the rights, property, or safety of Spotful, our users, venues, or others
In connection with an investigation of suspected or actual fraud or other illegal activity
To respond to a payment dispute or claim

5.5 Business Transfers

We may share or transfer information, including to an affiliate or to a successor or acquirer, in connection with a merger, acquisition, reorganization, financing, sale of assets, transfer of the Spotful business or brand to another company, or similar transaction, or in preparation for one. The recipient may continue to use your information as described in this Policy.

We may share information with other parties when you ask us to or consent to the sharing.

5.7 Aggregated and De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

5.8 Advertising and Sale of Personal Information

We work with advertising partners, including Google, that receive information about your use of the Services, as described in Sections 3.1 and 3.2. Under some U.S. state laws, this may be considered a "sale," "sharing" for cross-context behavioral advertising, or "targeted advertising." You can opt out as described in Section 3.3. See Section 10.1 for more information for California residents.

6. EMAILS AND OTHER COMMUNICATIONS

We may send emails through our email delivery provider. These may include sign-in codes and links, booking emails about your requests, quotes, payments, and changes, and important notices about the Services. Booking emails are part of the Services, so you cannot opt out of them while you have an account or an active booking. Please contact us at support@spotful.io rather than replying to automated emails.

Booking emails may contain a link that opens your booking. Anyone who has the link may be able to view the booking, so please do not forward these emails or share the link unless you intend to share the booking details. Some actions may require you to verify your email address or sign in. Booking links may be deactivated by the venue or by us.

If we send you text messages, we will obtain any consent required by law before doing so. Venues may contact you directly using the phone number and email address you provide, using their own systems or tools available through the Services. We do not control venues' messaging. A venue alone decides whether, when, to whom, and what to send, is the sender of its messages, and is solely responsible for them, including for obtaining any consent required by law and honoring your opt-out requests.

7. DATA RETENTION

We keep personal information for as long as we need it for the purposes described in this Policy, including to provide the Services, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. How long we keep information depends on the type of information and why we have it:

Account and Profile Information: Kept while your account exists, and afterward as needed for the purposes above.
Booking and Payment Records: Bookings, quotes, payment schedules, payment and refund records, booking agreements, and the history of changes to a booking are kept as business records, including after a booking is completed, canceled, or expires, for as long as needed for tax, accounting, dispute, and legal purposes.
Unfinished Booking Requests: Booking requests you do not submit, and requests and quotes that are not accepted, may expire. Expired requests and quotes may be kept as records.
Rate-Limiting Data: Information used to limit requests is kept for as long as needed for that purpose.
Analytics and Error Monitoring Data: Kept according to the retention settings of our systems and of the providers described in Section 3.1.

When we determine that we no longer need personal information, we may delete it, de-identify it, or restrict it from further use. Information held by a venue, or by Stripe for the account that received your payment, is kept according to their own practices.

8. DATA SECURITY

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. Because anyone with access to your email account may be able to sign in to your Spotful account, please keep your email account secure, and contact us if you believe your account has been accessed without your permission.

9. YOUR CHOICES AND RIGHTS

9.1 Updating Your Information

You may be able to update your profile information, such as your name, phone number, bio, images, links, and public profile handle, in your profile settings. To correct other information, such as the details of a booking, contact the venue or contact us.

9.2 Access, Correction, and Deletion

Depending on where you live, you may have the right to request access to, a copy of, correction of, or deletion of the personal information we hold about you. To make a request, contact us at support@spotful.io.

If you ask us to delete your information, we may keep information we need for legal, tax, accounting, fraud prevention, dispute, or security purposes, such as records of bookings and payments, and we will tell you if we cannot fully meet your request where the law requires us to. Information that has already been provided to a venue is also held by that venue, and you may need to contact the venue directly about its copy.

9.3 Marketing Communications

If we send you marketing emails about Spotful, you can opt out at any time by using the unsubscribe link in the email or by contacting us at support@spotful.io. You will continue to receive sign-in and booking emails. We may keep a record of your opt-out so that we can honor it. Venues handle their own marketing, so contact a venue directly, or follow the opt-out instructions in its messages, to opt out of messages it sends you.

9.4 How to Make a Request

Send requests to support@spotful.io and tell us what you are asking for. To protect your information, we may verify your identity before acting on a request to access, correct, or delete personal information, for example by confirming that you control the email address associated with your account or booking, and we may ask for additional information where needed. We do not require identity verification for requests to opt out of the sale or sharing of personal information, although we may ask for information needed to locate your records. You may use an authorized agent to make a request on your behalf where the law allows; we may ask the agent for proof of authorization and ask you to verify your identity directly.

We will respond within the time required by applicable law. We will not discriminate against you for exercising your privacy rights.

10. ADDITIONAL INFORMATION FOR U.S. STATE RESIDENTS

10.1 California Residents

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to our processing of your personal information, you have the right to:

Know the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes for collecting it, and the categories of third parties to whom we disclose it
Delete personal information we have collected from you, subject to exceptions
Correct inaccurate personal information
Opt out of the sale of personal information or its sharing for cross-context behavioral advertising
Limit the use and disclosure of sensitive personal information, where that right applies
Not be discriminated against for exercising these rights

You can exercise these rights as described in Section 9.4.

Sale and Sharing: We may make identifiers, such as cookie identifiers, internet activity information, such as the pages you view and actions you take in the Services, commercial information, such as booking and purchase events, and approximate location available to advertising and analytics partners, including Google and the providers of venues' advertising tags on their venue profile pages (see Sections 3.1 and 3.2). This may be considered a "sale" or "sharing" under the CCPA. You can opt out of the sale and sharing of your personal information by turning off Advertising in Privacy choices (Section 3.3), by using a browser that sends a Global Privacy Control signal, which we treat as a request to opt out, or by contacting us at support@spotful.io.

Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use under the CCPA. Payment card numbers are collected by Stripe, not by us.

Retention: We keep each category of personal information for the periods, or according to the criteria, described in Section 7.

10.2 Categories of Personal Information We Collect

In the 12 months before the Last Updated date of this Policy, we have collected the following categories of personal information, from the sources and for the business purposes described in Sections 2 and 4. We have disclosed each category for a business purpose to the recipients listed below, as further described in Section 5.

Category	Examples	Sources	Disclosed For a Business Purpose To
Identifiers	Name, email address, phone number, account and booking identifiers, IP address, and cookie and device identifiers	You; venues; automatically	Venues you book with; service providers; affiliates
Customer records described in California Civil Code Section 1798.80(e)	Name, phone number, and limited payment card details (card brand, last four digits, and expiration date)	You; venues; Stripe	Venues you book with; service providers; affiliates
Commercial information	Booking requests, quotes, selected spaces and packages, event type, number of guests, prices, payment schedules, and payment history	You; venues; Stripe	Venues you book with; service providers; affiliates
Internet or other electronic network activity information	Pages viewed, referring pages, campaign parameters, interactions with the Services, error reports, and page activity recordings	Automatically	Service providers; affiliates
Geolocation data	Approximate location, such as city, region, or approximate coordinates, derived from your IP address	Automatically	Service providers; affiliates
Audio, electronic, visual, or similar information	Profile and cover images you upload	You	Service providers; affiliates; anyone who visits your public profile, if you create one
Professional or employment-related information	For venue team members, the venue you work with and your role and permissions	You; venues	Service providers; affiliates

We may also make identifiers, internet or other electronic network activity information, commercial information, and approximate location available to advertising and analytics partners, including Google, which may be considered a "sale" or "sharing" for cross-context behavioral advertising, as described in Section 10.1.

10.3 Residents of Other States

Depending on the state where you live, you may have rights similar to those described in Section 10.1, including the rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. You can exercise these rights as described in Section 9.4. If we decline to act on your request, you may appeal our decision by replying to our response or by emailing support@spotful.io with the subject line "Privacy Appeal." We will respond to your appeal within the time required by law, and if you are not satisfied with the result, you may contact your state attorney general.

10.4 Nevada Residents

Nevada residents may submit a request to opt out of the sale of covered information, as defined in Nevada law, by contacting us at support@spotful.io.

10.5 California Shine the Light

If you are a California resident with an established business relationship with us, California Civil Code Section 1798.83 permits you to request information about our disclosure of certain categories of personal information to third parties for their direct marketing purposes during the preceding calendar year. To make a request, email support@spotful.io with the subject line "Shine the Light Request."

11. CHILDREN AND AGE REQUIREMENTS

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. As provided in our Terms of Service, you must be at least 13 years old to use the Services, sign in, or make a booking, and users under 18 need the consent of a parent or legal guardian. We do not verify the age of hosts or guests; venues are responsible for checking identification where required, including for the service of alcohol.

If we learn that we have collected personal information from a child under 13 in a way that the law does not permit, we will take steps to delete it as required by law. If you believe a child under 13 has provided us with personal information, please contact us at support@spotful.io.

12. INTERNATIONAL USERS

Spotful is based in the United States and is intended for use in the United States. We, our affiliates, and our service providers may process personal information in the United States and in other countries. If you use the Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries, where data protection laws may differ from those in your country. Where the law of your country gives you additional rights, you may contact us to exercise them.

13. THIRD-PARTY WEBSITES AND SERVICES

The Services may link to or display content from third parties, such as venue websites, virtual tours, and maps. We are not responsible for the privacy practices of those third parties, and this Policy does not apply to information you provide to them. We encourage you to review their privacy policies.

14. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our practices, the Services, or the law. When we do, we will post the updated Policy with its effective date, and we will provide any additional notice, or obtain any consent, required by law.

15. CONTACT US

If you have questions, concerns, or requests about this Policy or our privacy practices, please contact us:

Email: support@spotful.io

Mail:
MMJI CHILLZ, LLC, operating as Spotful
470 7th Ave, Suite 304
New York, New York 10018