Last updated October 3, 2026
What changed: Said that nothing sent through a form counts until you confirm your email address.
Privacy
This policy covers openspotlocal.com, run by Ezekiel Madrigal.
The short version. We collect what you type into our forms so hosts and vendors can reach each other. We don't sell it or share it for advertising, and we don't show ads. Visit counting is cookieless and skipped if your browser asks us not to track. You can download or delete your details yourself at any time.
What we collect
- When you list a space: the venue's name, address and type, a contact name and role, email, optional phone, a public link (website, Instagram or map listing), the space's details, house rules and open dates.
- When you request a spot or join as a vendor: your business name, email, optional phone, a public link, your concept and rig, the space and power you need, any notes, and your local health permit number and who issued it.
- When you add a permit or insurance policy on your page: its type, number, who issued it and when it expires. We don't store copies of documents.
- When you sign up for pop-up alerts: your email address, and your town if you give one.
- When you follow a vendor: your email address and which vendor you follow.
- When you leave a review: your star rating and anything you write.
- Automatically: the IP address a form was sent from, kept with the submission for 90 days and in a rate-limit log for two days so we can spot fake or automated sign-ups. Our hosting keeps standard request logs.
- Your agreement: the date you accepted these terms and this policy, and which version. On each booking we also record that you accepted the Independent Operator Agreement, when, and the IP address it came from.
How it's used
- To make the match. A space's listing, including its address and host contact name, is public on the site. When you request a spot, the host sees your request and your contact details so they can answer you.
- To keep the directory real. We check sign-ups for signs they're fake, and we review permit numbers before a vendor goes live. Nothing you send through a form goes in the directory, reaches a host or starts an email until you click the link we send to confirm your address.
- To email you about your own listing or request: confirmations, a host's answer, a reminder the day before, and a request for a review the day after. The weekly pop-up email goes only to people who asked for it or follow a vendor, and every email has an unsubscribe link.
We don't sell or rent your information, and we don't use it for advertising.
Who else handles it
These services run parts of the site for us and see only what they need to do that:
- Vercel hosts the site. If you allow it, Vercel Web Analytics also counts page views, without cookies.
- Neon stores the database.
- Cloudflare handles the domain and sits in front of the site.
- Resend sends our email.
- OpenStreetMap draws the map tiles when you open the map, which means your browser asks their servers for them. When a host lists a space, we look its address up once through OpenStreetMap's Nominatim service to put it on the map.
Besides the host or vendor on the other side of your own request, we share information with anyone else only if the law requires it.
What our staff see
The people who run OpenSpot Local see listings, vendor profiles, requests, permit and insurance details, and the signals we use to spot fake sign-ups (including the IP address a form came from), because checking and moderating the directory is their job. They can't see secrets: not the link that opens your page, not confirmation or reset codes, not passwords. They can't download your data or answer, dismiss or delete anything on your page as you. Every change staff make is recorded in a log.
Information about other people
OpenSpot Local doesn't collect information about your customers or your staff. If you put someone else's details into a listing or a note, such as a manager to ask for on the day, you decide to share them and you're responsible for telling that person. For that information you are in charge of it (the "controller") and we handle it only to run the directory for you (as your "service provider" or "processor").
Cookies and your browser
The public site sets one cookie, and only after you send a form: it holds the link to your status page so "See where your ask got to" can find it. If you send a request, it keeps your business details in your own browser so you don't have to type them again. Page views are counted by Vercel Web Analytics, which sets no cookie and doesn't follow you to other sites, and it isn't loaded at all if your browser sends a Global Privacy Control or Do Not Track signal. The cookie policy lists each item and how to change your mind.
How long we keep it
| What | How long |
|---|---|
| Listings, vendor profiles, permit and insurance details, requests and reviews | Until you delete them from your page or ask us to. A permit or policy past its date stays marked expired until you replace or delete it. |
| Alert sign-ups | Until you unsubscribe. After that we keep only the address, marked as unsubscribed, so we never email it by mistake. |
| Vendors you follow | Until you unsubscribe or delete your details, when the list is erased. |
| Your email switches and policy notices you've dismissed | Until you delete your details. |
| The IP address stored with a form | 90 days. |
| The IP address recorded with a booking's Independent Operator Agreement | Two years, because it's the evidence of who agreed if a claim comes in. The record that you agreed, and when, stays with the booking. |
| Rate-limit records | Two days. |
| Email confirmation and password reset codes | Deleted 30 days after they expire. |
| Our staff's log of actions they took | Three years, to handle disputes and meet legal obligations. |
| Our hosting provider's request logs | Kept by Vercel for a short period under its own policy. |
A daily job enforces the limits above. We handle no payments, so we keep no billing records. The only thing we keep after you delete your details because the law or a possible claim needs it is the record on a past booking that each side accepted the Independent Operator Agreement.
When you delete your details, we erase your contact details, listings, profile, permits, requests and reviews straight away. What remains is a record with no name or contact on it, so the other side of a past booking still sees that a date was booked.
Your choices
- See, fix, download or delete your details: open the link in any email from us (each one works for 45 days), or ask for a new one. The page it opens has "Download my data" and "Delete my details" buttons. You can also email [email protected].
- Choose your emails: the Emails section of your page switches off reminders, review requests and permit expiry notices one by one. The unsubscribe link at the bottom of those emails stops them all, takes you off pop-up alerts and unfollows every vendor. We'll still email you when someone asks for your spot or answers your request, and about changes to these policies, because that's the service you asked for.
- Analytics: turn on Global Privacy Control or Do Not Track in your browser and visit counting isn't loaded.
State privacy notice
Several US states give their residents specific privacy rights, such as California under the California Consumer Privacy Act. We give the same rights to everyone in the United States, wherever you live.
- Know, access and take a copy: what we hold about you, where it came from, why we use it and who receives it. Your status page shows it all and downloads it as a file, and this policy lists the rest.
- Delete: the "Delete my details" button on your status page, or email us.
- Correct: fix your details on your status page, or email us.
- Opt out of sale, sharing and targeted advertising: we don't sell personal information, share it for cross-context behavioral advertising, or use it for targeted ads or profiling, so there is nothing to opt out of. We honor Global Privacy Control signals anyway.
- Sensitive information: we don't collect any beyond what a form asks for, and we use nothing for purposes that would need your permission to limit.
- No penalty: using any of these rights never changes the service you get.
What we collect, in the law's terms. Identifiers (name, email, phone, IP address), commercial information (your listings, requests and bookings), professional information (your business, rig and permit numbers), and what you write in reviews and notes. It all comes from you or your browser. We use it for the purposes above and disclose it only to the services listed under "Who else handles it", for running the site. We sold or shared none of it for advertising in the last 12 months.
How to ask. Use your status page, or email [email protected]. We confirm a request by sending a link to the email address on file, and we answer within 45 days. Someone you authorize can ask for you if they show us your signed permission. If we turn a request down, you can reply to ask us to reconsider, and if you're still not satisfied you can contact your state attorney general.
If you're in the EU, UK or Switzerland
OpenSpot Local is run from the United States for businesses there, and your information is stored in the US. If data protection law in the EU, UK or Switzerland applies to you:
- Why we're allowed to use it: to do what you asked (a listing, a request, a profile), which is a contract; our legitimate interest in keeping the directory real and safe; your consent for pop-up alerts; and legal obligations.
- Your rights: access, a copy you can take elsewhere, correction, deletion, restriction, objecting to how we use it, and withdrawing consent at any time without affecting what came before. Use your page or email us.
- Complaints: you can complain to the data protection authority where you live or work. We'd like the chance to fix it first.
Age
OpenSpot Local is for adults acting for a business. You must be 18 or older to use it, and we don't knowingly collect information from anyone under 18. If we learn we have, we delete it.
Changes
Each policy shows the date it last changed and what changed. When a change affects how we use information, your rights, or money, your status page shows a notice until you dismiss it, and we may also email you.