Privacy Policy

Who is responsible

RTA SCIENCE LLC operates Spotlock. This notice covers our website, accounts, booking tools, embedded pages and support services. We determine how information is used to operate and secure Spotlock. Providers separately determine how they use participant information to deliver experiences. For certain provider-directed processing, Spotlock acts on the provider’s instructions; the applicable relationship depends on the activity and agreement. A provider’s independent marketing and off-platform records are governed by its own notice.

Information we collect and sources

From you: names, email addresses, account credentials, business and support details, addresses, timezones, booking selections and quantities, messages, published images and descriptions, and information you choose to submit. Booking records include prices, discounts, taxes, cancellation terms, payment and refund references, status and relevant timestamps. We store password hashes rather than readable passwords.

From service interactions: session and security information, IP addresses and technical request data used for security and troubleshooting, and your language preference. From others: Google account information when you choose Google sign-in; Stripe connected-account and payment status; and information a provider or authorized booker supplies about an offering or reservation. Stripe collects card details on its payment interface; we receive transaction references and status rather than your full card number or security code.

How and why information is used

We use information to create accounts, authenticate users, publish provider pages, reserve capacity, process bookings and cancellations, route payments, communicate confirmations and reminders, respond to requests, translate content when requested, prevent abuse, resolve disputes and meet legal obligations. We do not need medical records, government identity documents or card details in ordinary booking or support messages. Please do not submit them there.

Where European or UK data-protection law applies, relevant bases include performing a contract or taking requested pre-contract steps, complying with legal obligations, and legitimate interests in securing and administering the service where those interests are not overridden by individual rights. Where consent is required for a particular optional use, it must be obtained for that use and can be withdrawn. A privacy notice itself is not consent. Mandatory account or transaction information is needed to provide the requested functionality.

Who receives information

The booked provider and its authorized staff or configured notification recipients receive information needed to manage a reservation. Information intentionally published on a provider page, including images and contact details, is public. Keep personal information out of public content unless you intend to publish it.

Service suppliers process relevant information to deliver their functions: Stripe for payments and connected accounts; Google for optional sign-in, image storage and requested translation; ZeptoMail for transactional and support email; Cloudflare Turnstile for abuse prevention; Vercel for hosting; and Turso for hosted database storage. The suppliers used can depend on the deployment and enabled features. Remote images supplied by providers may contact an external image host when viewed. Payment providers and other suppliers may also process information under their own privacy notices.

We may disclose information where legally required, to investigate abuse or protect legal rights, or in a business reorganization subject to applicable protections. This notice does not authorize selling personal information or using it for targeted advertising. Such a change would require a separate assessment, updated notice and applicable consent or opt-out mechanisms before use.

Cookies and browser storage

Spotlock uses session and security cookies for authentication and related protection, and browser storage to remember language preferences. Embedded booking tools and third-party sign-in, payment and spam-prevention tools can involve their own cookies or technical signals. Blocking essential storage may prevent sign-in or booking from working. Optional tracking must not be enabled without the notices and choices required in the visitor’s jurisdiction. Browser privacy signals must be respected where applicable law requires them; this notice is not a substitute for a working consent or opt-out mechanism.

Retention and security

Retention depends on the purpose of the record, account and booking status, support needs, disputes, tax and accounting obligations, legal holds and backup cycles. Deleting an account is not the same as immediately deleting all transaction records or a provider’s independent records. Contact us for the retention applicable to your information or to request deletion; legally required records may need to be retained and restricted.

The service uses access controls, hashed passwords, request validation and abuse-prevention measures. Access to booking details should be limited to authorized people; private booking links must be treated as confidential. No system can guarantee complete security. Report suspected unauthorized access through our contact form without including passwords or card details. Security incidents will be assessed and notifications made when required by applicable law. This notice makes no certification claim or guarantee of a specific data residency.

Your requests and choices

Use Privacy requests below to request access, a copy, correction, deletion, a restriction, or other applicable privacy rights. You can use that form without signing in. Include the email associated with your account or booking, your country or state and the kind of request; do not send sensitive identity documents initially. We may request proportionate verification and, for an authorized agent, evidence of authority. We respond within the deadlines applicable to the request and explain any lawful exception or extension. If a request concerns a provider’s independent records, we will identify the appropriate provider or assist with routing it.

If you disagree with a response, use the same form with the topic Privacy appeal. Where applicable, you can appeal a refusal, contact your state attorney general or complain to a data-protection regulator. Exercising applicable rights will not result in unlawful discrimination. Essential booking and security messages are distinct from optional promotional messages.

United States rights

State rights depend on residency, the law’s scope, business thresholds and exceptions. Where applicable, they can include confirmation and access, portability, correction, deletion, information about disclosures, and opting out of sale, targeted advertising or certain significant-effect profiling. Some laws require consent for sensitive information or recognize authorized agents and universal opt-out signals. California residents may also have rights to know categories, sources, purposes and recipients, and to limit certain uses of sensitive personal information. Contact us to exercise applicable rights or appeal a denial. These rights are not limited by a provider’s cancellation rules.

Health, biometric, education and children’s information can be subject to separate federal and state requirements even where a general state privacy statute does not apply. Do not use ordinary booking or support fields to solicit such sensitive records. Offering a wellness or children’s program does not by itself establish compliance with those laws.

International users and transfers

Information may be processed in the United States and other countries where our suppliers operate; protections can differ from your home country. Availability of Stripe in a country does not establish Spotlock’s legal eligibility to operate there. Where a transfer requires a legal mechanism, that mechanism must be established before the relevant processing. This notice does not claim that RTA SCIENCE LLC is certified under a privacy framework or that contractual transfer safeguards have already been executed.

EEA and UK: where GDPR or UK GDPR applies, rights can include access, rectification, erasure, restriction, portability, objection to certain processing and withdrawal of consent without affecting prior lawful processing. You may complain to your competent supervisory authority. Cross-border transfers may require adequacy coverage or appropriate contractual safeguards and related assessments; contact us for the mechanism applicable to your data. Swiss rules may impose corresponding requirements.

Canada: applicable federal or provincial law can provide access, correction and consent-related rights; Quebec may impose additional notice, assessment and cross-border requirements. Australia: where the Privacy Act applies, access, correction, complaint handling and overseas-disclosure requirements apply. Other countries, including Brazil, may provide additional rights and require local notices or transfer arrangements. This general notice does not replace country-specific assessments or required supplements.

Children and provider responsibilities

Spotlock accounts and booking checkout are intended for adults. Children’s activities should be booked by a parent, guardian or another authorized adult. Providers must collect only necessary participant information and obtain legally required permissions. We do not represent that an adult-booking rule alone satisfies COPPA, state child-privacy laws or education-record requirements. If a child has submitted information directly or you wish to exercise rights relating to a child’s data, contact us so we can investigate and take appropriate action.

Changes and contact

We will update this notice when practices change and give additional notice or seek consent where required. The effective date identifies the current version. Contact RTA SCIENCE LLC at contact@rtascience.com or use the public Privacy requests form below for questions, requests or appeals.