Privacy information

Who to contact

Spotenda operates this booking platform. For privacy questions or requests to access, correct or delete personal information, email help@spotenda.com.

Information we use

• Account details such as name, email address and authentication status. Passwords are stored only as secure hashes.
• Business profiles, ownership evidence, services, staff, working hours and optional public contact details.
• Booking details including customer name, email, optional phone number, appointment history and, when the service takes place at the customer location, the service address.
• For date-based services, the requested fulfilment date, order requirements you provide, business decisions and date-change history. Do not put sensitive personal information in order requirements. Date requests are shared only with the business you choose, not sent to the AI assistant.
• Security and operational information such as short-lived abuse counters, request identifiers and limited audit records. Request bodies, passwords, cookies and full customer addresses are not written to application logs.

Why we use it

We use this information to create and manage accounts, show legitimate business listings, process booking requests, send service emails, prevent double-booking, protect the service from abuse, investigate problems and comply with legal obligations.

Our expected legal bases are providing the service requested by customers and businesses, our legitimate interests in operating and securing the platform, and compliance with legal obligations. These bases remain subject to the final privacy review.

Who receives booking information

A customer's booking details are shared with the business they choose so that business can review and provide the appointment. We also use infrastructure, object-storage and email suppliers where necessary to run the platform. We do not sell personal information or use it for third-party advertising.

Storage and retention

The production service uses a UK-hosted application server and private object storage, with encrypted off-site database recovery copies retained for 14 days. Live personal information is kept only while it is needed for bookings, account administration, security, disputes and legal obligations. The exact live-data retention and anonymisation schedule must be approved before launch.

Cookies

Spotenda uses cookies necessary for sign-in, security and form protection. If you save a statistics preference, an additional cookie remembers only on/off, not a visitor identifier, for up to 180 days. We do not use advertising or analytics identifier cookies.

Anonymous website totals

When enabled, our server counts visits to public page types and business profiles in daily totals, with broad device categories, error counts and response times. These totals help us improve the website. We do not store individual browsing histories, IP addresses, visitor or account identifiers, search text, full URLs, user-agent strings or referrers in these statistics. No statistics are sent to an external analytics provider.

Entry-page counts are estimates, not unique people. We exclude recognized bots and signed-in platform staff where possible. Daily totals are removed after 180 days; backups follow the separate backup retention schedule. This does not change retention of booking records.

Collection is currently enabled. You can choose not to be counted below. We also honour browser Do Not Track and Global Privacy Control signals; these take precedence over allowing statistics here. Security logs and essential booking records are unaffected.

Booking-linked Spotenda reviews

When enabled, an eligible verified customer can publish a star rating, short comment and chosen public alias after independent moderation. Approved business replies are also public. Booking references, email addresses, private addresses, order requirements, internal risk flags and report explanations are not published. Avoid including personal contact information in review text.

We keep the account and accepted-booking association privately to check eligibility, prevent duplicate counted ratings and investigate abuse. Reports, appeals and moderation decisions have restricted access. Fixed activity flags use account age and booking/review activity, not stored IP addresses, device IDs or fingerprints. We do not send review text to AI or external rating providers.

Withdrawal removes a review from public display and score totals; it does not automatically erase stored evidence or recovery copies. Your password-confirmed account export includes your own review records. Contact help@spotenda.com for wider access or erasure requests; the final retention policy still requires operator review. Read our review rules.

External review links and ratings

Businesses may link to their Google Maps and Trustpilot review profiles. Following a link opens that provider's website in a new tab, where its privacy policy applies.

When enabled, Spotenda requests a Google rating using the public business Place ID from our server. We do not send your account, contact details, IP address or booking information to Google for this request. We do not store the returned rating or reviews. Request counts are stored to limit usage; temporary keyed abuse counters help protect the allowance.

External ratings are not verified by Spotenda. See Google's Privacy Policy. Trustpilot is link-only; no Trustpilot widget is loaded.

Optional AI assistant

If you choose to use the assistant, your message, recent search criteria and relevant public listing details are sent to OpenAI to interpret your request. Do not include passwords, contact details, a full address or sensitive health information. We remove recognizable API keys, email addresses and phone numbers, but automated removal cannot identify every sensitive detail.

Booking form contact details and private account information are not sent to the model. The assistant cannot confirm appointments by itself: you review and submit the request, verify your email when required, and the business decides whether to approve it.

To let you return without starting again, we temporarily save your latest 12 message/reply exchanges, limited to 1,000 characters per message and 800 per reply, with recent search criteria and up to four public service identifiers in your existing server-side browser session. We apply the same automated contact/secret removal to saved text, but this cannot remove every sensitive detail. This is not cross-device account history.

Recovery expires 30 minutes after the last successful reply; viewing the page does not extend it. Returning restores the text without another AI call and checks the latest matching services and times again. Saved transcripts are not added to model requests. Use Delete conversation to clear the conversation, search context and current selection from your active session. This does not cancel any booking.

Expired conversation data is removed when next accessed; session cleanup and normal backup retention govern physical deletion. Expiry or deletion does not immediately erase backup copies or data already processed by OpenAI. Usage records contain request identifiers, keyed session hashes, token counts, estimated charges and status, not messages.

We disable OpenAI response storage. This is not zero-data-retention: OpenAI may retain API content for abuse monitoring, normally up to 30 days, and processing may take place outside the UK. See OpenAI's data controls. Its API data is not used for model training by default.

The assistant is optional. You can use regular service search and booking without sending a chat message to OpenAI.

Your choices and rights

Verified account holders can use Privacy & my data to download account details and matching booking snapshots or request account deletion. Password confirmation is required. The download excludes credentials, internal notes and other people's records; contact support for a more extensive access request.

Deletion requests and their review outcomes are recorded for follow-up. A request does not automatically erase data, cancel bookings or remove a business. We review the request and communicate the outcome to your verified email; retained records and backups remain subject to the applicable retention review.

You can ask us for a copy of your personal information or ask for inaccurate information to be corrected. Depending on the circumstances, you may also ask for deletion, restriction, portability, or object to processing. Email help@spotenda.com so we can verify and handle the request safely.

You may also raise a concern with the UK Information Commissioner's Office at ico.org.uk.