Business privacy notice

Last updated 2026-10-17. This notice is for people who create a business account, claim a listing or connect a Google Business Profile. It adds to the general privacy policy.

1. Data we collect

1.1 Account data

Your email address, a salted hash of your password (never the password itself), the time of each sign-in, and the IP address of sign-in requests, which is used for rate limiting and fraud prevention.

1.2 Verification data

For a Google verification: the identifier of the connected Google account, the list of Business Profile locations it manages (name, address, Place ID and whether Google shows them as verified), and the connection time. For a manual claim: the evidence note and contact details you submit.

1.3 Listing changes

Every edit, photo you hide, claim and removal request is recorded with your account and the time, so the history of a public listing can be traced and reverted if needed.

1.4 Payments

Managing a listing is free. If you buy advertising, payment details are handled by the payment provider named at checkout; SpaSpot does not store card numbers.

2. Why we process it

To provide the account and claim features (contract); to make sure only the rightful owner controls a listing and to keep results fair (legitimate interest and platform integrity); to meet legal obligations; and, with your consent, to send occasional product updates that you can stop at any time.

3. Sharing

The business details you publish are shown publicly on the listing page. Sign-in codes are delivered through our email provider. When you connect Google, Google receives the authorisation request under its own terms. We disclose data to authorities when the law requires it. We do not sell account data and do not share it with advertisers.

4. Retention

Sessions expire after 30 days of inactivity and are deleted. Sign-in codes are deleted within 24 hours. Account data is kept while the account exists and removed within 30 days of a deletion request; the audit trail of changes to public listings is kept in anonymised form. Public listing content remains after a claim ends because it comes from public sources.

5. Security

All pages are served over HTTPS. Passwords are hashed with scrypt. Sign-in codes are single use, time limited and tied to the browser that requested them. Administrator accounts require a second factor. Secrets stored by the platform are encrypted at rest. If a breach affects your data we will tell you without undue delay.

6. Your rights

You can access and correct your account data from your account page, and ask for a copy or for deletion by writing to [email protected]. We answer within 14 days.

7. Related policies

Business terms, photo and image policy, content guidelines, terms of service.