Privacy Policy
Last updated: 19 September 2026
This Privacy Policy explains how FreeSpot App NL (KVK 42160400, registered address Ploegstraat 34, 3075 NG Rotterdam, Netherlands, "FreeSpot", "we", "us") collects, uses, shares, and protects personal data when you use freespot.app and partner.freespot.app (together, the "Service"), in accordance with the EU General Data Protection Regulation (GDPR / AVG).
FreeSpot is the data controller for the personal data described below. If you have questions or requests about your data, contact us at support@freespot.app.
1. Who this applies to
This Policy covers personal data of:
- Customers — people who create an account to browse and book Deals;
- Partners — people who apply on behalf of a business to list Deals, and the business contact details they provide;
- Visitors — people who browse public pages (like Explore) without creating an account.
2. What personal data we collect
Account data (Customers). Email address, password (stored only as a salted hash, never in plain text), first and last name, date of birth, and address (street, house number, postal code, city, country).
Account data (Partners). Business name, category, business address (street, house number, postal code, city, country), contact email and phone number, KVK number, website or social media link, and — separately, via Stripe — the bank account and identity information Stripe requires to pay you out (FreeSpot itself never sees or stores your bank details).
Booking and payment data. Which Deals you view, book, or cancel; booking status and timestamps; the amount paid and the Service Fee; and payment metadata from Stripe (such as a payment reference). We do not store full card numbers — Stripe processes and stores payment card data on our behalf.
Communications. Emails we send you about your account, bookings, and (if you're a Partner) applications and approvals, and any correspondence you send us at support@freespot.app.
Technical data. IP address, browser/device type, and basic usage logs, collected automatically to operate, secure, and troubleshoot the Service. As of the date above, FreeSpot does not run third-party analytics or advertising cookies; if and when it does, this Policy and the cookie banner referenced in Section 9 will be updated first.
3. Why we process it, and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and managing your account | Account data | Performance of a contract with you |
| Verifying you meet our 16+ minimum age requirement to use the Service | Date of birth | Performance of a contract with you (see open item 1 above — must match actual product behavior) |
| Processing bookings and payments | Booking and payment data | Performance of a contract with you |
| Sending transactional emails (confirmations, approval requests, cancellations, refunds) | Account, booking, and communications data | Performance of a contract with you |
| Verifying a Partner's business before it can list Deals | Business/KVK data | Legitimate interest (marketplace trust and fraud prevention) |
| Preventing fraud, abuse, and enforcing our Terms | Account, booking, and technical data | Legitimate interest |
| Complying with tax, accounting, and other legal obligations | Booking and payment records | Legal obligation |
| Responding to your emails and support requests | Communications data | Legitimate interest / performance of a contract |
Where we rely on legitimate interest, you have the right to object — see Section 8. We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
4. Who we share your data with
We share personal data only as needed to operate the Service, with the following categories of recipients — all of whom act as our data processors under a data processing agreement, except where noted:
- Supabase (database hosting and authentication) — stores your account, booking, and business data.
- Stripe (payment processing, Stripe Connect payouts) — processes payment card data and, for Partners, payout/identity verification data. Stripe may act as an independent controller for some purposes under its own privacy policy.
- Resend (transactional email delivery) — used to send account, booking, and application emails.
- Vercel (application hosting) — hosts the Service's infrastructure.
- Google Workspace — used for our own business email; if you email support@freespot.app, that message is handled through Google Workspace.
A Partner sees a Customer's name and email address only for bookings made at that Partner's business, solely to fulfill and manage that booking. We do not sell personal data to anyone, and we do not share it with third parties for their own marketing purposes.
We may also disclose personal data if required by law, court order, or governmental request, or to protect the rights, property, or safety of FreeSpot, our users, or the public.
5. International data transfers
Some of the providers listed in Section 4 may process or store data outside the European Economic Area (EEA), including in the United States. Where that happens, we rely on the safeguards those providers offer for such transfers (such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses). Contact us if you would like more information about a specific transfer.
6. How long we keep your data
- Account data is kept for as long as your account is active, and for a reasonable period afterward in case you return, unless you ask us to delete it sooner (see Section 8).
- Booking, payment, and invoicing records are kept for at least 7 years, as required by Dutch tax law, even if your account is deleted.
- Business/KVK verification records (including rejected applications) are kept for as long as needed to demonstrate compliance with our verification process and to prevent repeat fraudulent applications.
7. Data breaches
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of it, as required by law, and will notify affected users directly without undue delay where the breach is likely to result in a high risk to them.
8. Your rights
Under the GDPR/AVG, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data (much of this you can already edit yourself in your profile settings);
- erase your data ("right to be forgotten"), subject to our legal retention obligations described in Section 6;
- restrict or object to certain processing, including processing based on legitimate interest;
- data portability — receive your data in a structured, machine-readable format;
- withdraw consent at any time, where processing is based on consent, without affecting past processing;
- lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local EU data protection authority.
To exercise any of these rights, email support@freespot.app. We will respond within the timeframes required by law.
9. Cookies
The Service currently uses only the cookies strictly necessary to keep you logged in and to remember your language preference. These do not require consent under the ePrivacy rules because they are essential to the Service functioning. If FreeSpot adds analytics, advertising, or other non-essential cookies in the future, we will ask for your consent first through a cookie banner before any such cookie is set, and this section will be updated to list them individually.
10. Children's privacy
The Service is intended for individuals aged 16 and over. Under Dutch law (implementing Article 8 GDPR), 16 is the age from which a person may consent to their own personal data being processed for an online service, so we do not require separate parental consent for our processing of data belonging to a 16- or 17-year-old. (Separately, the Terms of Service require a 16- or 17-year-old to confirm they have parental or guardian permission to actually use the Service and make bookings — that is a contract-law requirement, not a data-protection one, and is explained there.)
We do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has provided us with personal data, contact us at support@freespot.app and we will take appropriate steps to delete it.
11. Security
We use reasonable technical and organizational measures to protect your personal data, including encrypted connections (HTTPS), password hashing, and access controls limiting who can see your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated version on the Service with a new "Last updated" date, and for material changes will make reasonable efforts to notify you (e.g. by email).
13. Contact us
FreeSpot App NL KVK: 42160400 Registered address: Ploegstraat 34, 3075 NG Rotterdam, Netherlands Email: support@freespot.app
You also have the right to contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) directly with any concerns about how we handle your data.