Privacy Policy

What we collect

• Account: name, email address, optional phone number, and when you accepted our terms.
• Bookings: spa, time, number of people, the name and phone number entered, and any note.
• Listings: business details, photos, videos and the business document you upload.
• Reviews and reports you submit.
• Location: to show nearby spas we use the approximate area of your IP address (city level). If you choose "Current location", your browser asks first, and we round the position to about 1 km before using it. We do not store it.
• Security logs: records of moderation actions and rate-limit counters used to prevent abuse.

Who can see it

• Spa owners see the name, phone, time and note for bookings at their own spa only.
• Referral partners see bookings they made themselves, and only counts (no personal details) for bookings made with their code.
• Reviews show your first name only. Reporters' identities are never shown to spa owners.
• Business documents are visible only to the owner and our review team.
• Our administrators can see account and booking data to moderate the site and respond to complaints.

Why we use it

To run the directory and bookings, to keep the site safe (moderation, fraud and abuse prevention), and to comply with the law.

Where it is stored

Data is stored with our infrastructure providers (Neon for the database, Cloudflare R2 for photos and documents, Vercel for hosting, Clerk for sign-in and account emails, and Google if you choose to sign in with Google), which may store it outside your country. Access is restricted by our server-side security checks, and files are only shared through short-lived private links.

Maps and address search

Maps are loaded from OpenFreeMap (map data © OpenStreetMap contributors). When you type in an address or place search, the text you type is sent to the Photon geocoding service (komoot) to find matching places. Like any website, these services receive your IP address when your browser loads from them. We do not send them your name or account details.

Disclosure to authorities

We share data with authorities only in response to a lawful request.

Your choices

You can update your name and phone in My account. To delete your account and data, contact us via the Complaints page. We may keep records related to reports or legal requests where the law requires.

Cookies

We use only the essential cookies needed to keep you signed in. No advertising or tracking cookies. We count page views anonymously: only the page, the day and your country (worked out from your connection), without cookies. To stop abuse, a scrambled, unreadable code made from your connection address is kept for up to 2 days; it is never linked to you or your account.