Privacy Policy

This Privacy Policy describes how Chris Karlin (“SpotHeld,” “we,” “us,” or “our”) handles personal information when someone visits SpotHeld, creates or uses a business account, receives a SpotHeld email, or opens a customer deposit, portal, or receipt link.

A service business decides what customer and appointment information to enter into SpotHeld and why it is used. For that information, the business is responsible for its customer relationship and SpotHeld processes the information to provide the software. A customer should contact the business shown on the customer page first about the appointment, its policy, or a refund decision.

Policy version: 2026-09-01-r1.

• Account information: name, email address, authentication and security events, organization membership, role, and policy-acceptance records.
• Business information: business name, owner name, optional phone, service area, timezone, services, pricing, deposit defaults, customer policy, Stripe account status, and subscription status.
• Customer and appointment information:customer name and contact details, service, appointment time and location, job notes, amounts, policy acceptance, link activity, and booking timeline.
• Payment-status information: Stripe account, Checkout, payment, refund, dispute, invoice, and subscription identifiers and states. Stripe—not SpotHeld—collects and processes full card and bank credentials.
• Device and service information: browser or device details supplied with web requests, IP-derived security signals, timestamps, application logs, error reports, rate-limit records, and first-party product-funnel events.
• Communications: support messages and the delivery status of transactional deposit requests, receipts, reminders, cancellation notices, and refund confirmations when email is configured.

• Provide, authenticate, secure, troubleshoot, and support SpotHeld.
• Create and display booking, deposit, portal, receipt, and account experiences.
• Coordinate Stripe payment and subscription status without storing full card data.
• Send service-related communications and record whether they were delivered.
• Prevent fraud and abuse, enforce limits, investigate incidents, and protect accounts.
• Measure setup and product usage, improve the service, and understand conversion.
• Meet accounting, tax, legal, dispute, audit, and provider obligations.

SpotHeld does not sell personal information. The current product does not use customer or account data for third-party targeted advertising.

Information is disclosed only as needed for the purposes above, including to:

• the account's authorized business owners, admins, and staff, according to their role;
• the customer and service business on the relevant customer page, receipt, or communication;
• Stripe for connected accounts, customer deposits, subscription billing, refunds, disputes, and fraud prevention;
• hosting, database, authentication, transactional-email, logging, security, and support providers acting for SpotHeld;
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business transaction subject to appropriate safeguards.

SpotHeld uses browser storage and similar necessary technologies to maintain an authenticated session, remember a validated plan choice, protect public flows, retain a temporary demo workspace, and measure first-party setup and conversion events. Clearing browser data may remove those local choices and the demo. The current product does not place third-party advertising trackers.

SpotHeld does not currently collect personal information about someone's activity over time across unaffiliated websites for third-party targeted advertising. Because the current service does not engage in that cross-site collection, it does not respond differently to a browser's “Do Not Track” signal. SpotHeld also does not currently sell or share personal information in a way that requires an advertising opt-out signal.

SpotHeld does not permit third-party advertising networks to collect personal information across different websites through the current service. Stripe and other providers may collect information when someone opens or uses a separately hosted page or service they operate, subject to their own privacy notices.

SpotHeld keeps each category only as long as reasonably needed to operate and secure the service, honor the business account, maintain financial and consent evidence, resolve disputes, and meet legal or provider obligations. Those needs differ by record type, so this policy does not promise one automatic deletion period for every record. Backups and fraud, audit, payment, consent, tax, and legal records may remain after an account closes when retention is necessary.

Owners and admins can download the workspace snapshot currently exposed in Settings and clear allowlisted browser-only data. Those controls do not represent a complete provider, authentication, email, or payment export and do not delete server records. Contact the privacy address below for a broader request.

Depending on where you live, you may have rights to ask about, access, correct, delete, or receive a copy of personal information, or to object to certain uses. SpotHeld will verify a request before acting and may keep information when law or a legitimate need permits. We will not discriminate against someone for exercising an applicable privacy right.

Email privacy@spotheld.com with the account or business name and the request. A customer whose information was entered by a service business should also contact that business, because it controls the underlying appointment record and may need to authorize the request.

SpotHeld uses access controls, tenant boundaries, signed provider events, rate limits, and other administrative and technical safeguards designed for the information it handles. No online service can guarantee absolute security. Do not put card credentials, passwords, authentication codes, government identifiers, medical details, or other unnecessary sensitive information in customer notes or support messages.

SpotHeld is a business service and is not directed to children under 13. If you believe a child provided personal information directly to SpotHeld, contact the privacy address.

If this policy changes materially, SpotHeld will publish a new effective date and version and provide notice through the service or an account contact address when appropriate.

Privacy requests: privacy@spotheld.com
Product support: support@spotheld.com