Privacy Policy

Effective date: September 15, 2026
Last updated: September 15, 2026

Atspots (“we,” “us,” “our”) operates the Atspots mobile application and related services (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service.

1. Who we are

Data controller: AtSpots
Address: 8 Wailers Circle, Cooreville Gardens, Kingston 20, St. Andrew, Jamaica
Contact: support@atspots.com

2. Information we collect

2.1 Account and profile information

When you register and complete profile setup, we collect:

• Account: email address, password (stored hashed by our auth provider), account type (Rookie/Sophomore), profile completion status
• Rookie profile: first name, last name, username, age, gender, occupation, bio, interests, profile photo
• Sophomore (venue) profile: venue name, description, categories, venue photos, venue location (latitude/longitude), geofence radius

We do not display your email on your public profile. For Rookie profiles, public profiles show display name, username, age, gender, occupation, bio, interests, and profile image as configured. Venue (Sophomore) public profiles show venue name, description, categories, and images—not a personal age or gender.

2.2 Location information

• Device location (GPS): When you use Discover, join venue chat, or other geofenced features, we collect your current coordinates to verify you are within a venue’s geofence. Location is sent to our servers for validation and may be logged in security/audit records.
• Venue locations: Venue coordinates you provide as a Sophomore host are stored and shown on the map to other users.

You can deny location permission; some features (map centering, geofenced chat) will not work.

2.3 User-generated content

• Moments: photos and optional captions
• Venue chat: messages in venue lobby and private chats between users at a venue
• Reviews and reports: ratings, review text, report reasons and details (report details may be encrypted at rest)
• Feedback and bug reports: optional text you submit in-app

2.4 Device and technical data

• Push notification tokens (if you enable notifications): device token, platform, optional device identifier
• Notification preferences
• Product analytics events (e.g., signups, venue visits, chat activity, profile views)—see Section 5
• Error and performance diagnostics (if enabled): via Sentry or similar, may include device/OS version and crash data—not your message contents by default

2.5 Payment information (future)

At launch, paid subscriptions are not offered in the app. When we introduce subscriptions later, payment processing will be handled by Stripe and/or Apple App Store / Google Play. We will receive subscription status, billing history metadata, and customer IDs—not full card numbers.

3. How we use information

We use information to:

• Provide and operate the Service (authentication, profiles, map, chat, feed)
• Enforce geofence and safety rules (venue access, bans, moderation)
• Send push notifications you opt into
• Improve the Service (analytics, debugging, fraud/abuse prevention)
• Comply with law and respond to legal requests
• Communicate with you about the Service

Legal bases (EEA/UK): contract performance, legitimate interests (security, analytics, product improvement), consent where required (e.g., location, push notifications).

4. How we share information

We share information only as needed:

We do not sell your personal information.

5. Analytics

We collect product analytics events (e.g., signups, venue visits, chat joins, profile views) in our database for operational and product metrics. Aggregated metrics may be viewed by authorized staff in our admin dashboard.

You can limit some collection by disabling optional notifications; core security and geofence logs are necessary for the Service to function safely.

6. Data retention

See our Data Retention Policy for retention periods. Summary:

• Account data: retained while your account is active
• Chat, moments, and profiles: retained until you delete content or your account (account deletion process—see Account Deletion Workflow)
• Security/geofence audit logs: retained for a limited period for abuse investigation
• Analytics events: retained in aggregated form; raw events subject to retention limits

7. Your rights and choices

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data (via Edit profile in-app)
• Delete your account and associated data—see the in-app Delete account flow (Home → Delete account)
• Object to or restrict certain processing
• Data portability (where applicable)
• Withdraw consent (e.g., location, push)—may limit features
• Opt out of marketing (if we send any)

California (CCPA/CPRA): We do not sell personal information. You may request access, deletion, and correction via support@atspots.com.

EEA/UK (GDPR): You may lodge a complaint with your supervisory authority.

8. Children

The Service is not intended for users under 18 (or the minimum age in your jurisdiction). We collect age during Rookie profile setup to help enforce this. If you believe a child has provided us data, contact support@atspots.com.

9. Security

We use industry-standard measures including encrypted connections (TLS), row-level database security, server-side access controls for sensitive actions, and rate limiting. No system is 100% secure; use a strong, unique password.

10. International transfers

Your data may be processed in the United States and other countries where our processors operate. We rely on appropriate safeguards where required (e.g., Standard Contractual Clauses).

11. Changes

We may update this policy. We will post the new version with an updated “Last updated” date and, for material changes, provide in-app or email notice where required.

12. Contact

Privacy inquiries: support@atspots.com
Postal address: AtSpots, 8 Wailers Circle, Cooreville Gardens, Kingston 20, St. Andrew, Jamaica