Privacy Policy

1. Who we are

KSpa Online ("we," "us," or "our") operates the website at https://kspa.online. We are an online directory that helps people discover Korean spas, jjimjilbangs, and wellness centers across the United States.

If you have questions about this policy, contact us at hello@kspa.online.

2. Information we collect

Information you provide directly

• Account registration — when you create an account, we collect your email address and a password (stored securely via Supabase Auth; we never see your plaintext password).
• Spa submissions — if you submit a spa listing, we collect the spa's name, address, city, state, website, phone number, and your contact email.
• Reviews — when you write a review, we collect your rating, written feedback, and the account email associated with your session.
• Claim requests — if you request to claim a spa listing as its owner, we collect your name, email address, and any message you provide.
• Advertising inquiries — if you submit an advertising inquiry, we collect your name, company name, email address, phone number, and the nature of your interest.
• Contact messages — any messages you send us directly via email.

Information collected automatically

• Usage data — pages visited, time on site, referring URLs, and browser type, collected via Vercel Analytics (privacy-friendly, no cross-site tracking).
• IP address — logged by our hosting provider (Vercel) for security and abuse prevention. We do not store or link IP addresses to user profiles.
• Cookies and local storage — we use a session cookie issued by Supabase Auth to keep you logged in. We do not use advertising cookies or third-party tracking pixels.
• Ad impressions — if you view a sponsored listing, we record that an impression occurred (tied to the campaign, not to your personal identity).

3. How we use your information

• To operate the directory and display spa listings.
• To create and manage your account and authenticate your sessions.
• To moderate reviews and spa submissions before they are published.
• To process spa ownership claim requests and notify you of their outcome.
• To respond to advertising inquiries and send transactional emails related to those inquiries.
• To improve the site using aggregated, anonymized usage analytics.
• To detect and prevent spam, fraud, or abuse of our platform.
• To comply with legal obligations when required by applicable law.

We do not sell your personal information. We do not use your data to build advertising profiles or share it with data brokers.

4. How we share your information

We share information only in the following limited circumstances:

• Service providers — we use Supabase (database and authentication), Vercel (hosting and analytics), and MailerLite (transactional email). Each provider only receives the data necessary to perform their service and is bound by data processing agreements.
• Legal requirements — we may disclose information if required by law, court order, or to protect the rights, property, or safety of our users or the public.
• Business transfers — if KSpa Online is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.

5. Data retention

We retain your personal information for as long as your account is active or as needed to provide our services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons.

Submitted spa listings and published reviews may remain on the site after account deletion in anonymized form, since they constitute factual directory information.

6. Your rights and choices

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Opt-out of emails — any marketing emails will include an unsubscribe link. You cannot opt out of transactional emails directly related to your account activity.

To exercise any of these rights, email us at hello@kspa.online. We will respond within 30 days.

7. Cookies

We use only essential cookies necessary for the site to function:

We do not use advertising, tracking, or analytics cookies. You can disable cookies in your browser settings; however, doing so will prevent you from staying logged in.

8. Children's privacy

KSpa Online is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal data, please contact us at hello@kspa.online.

9. Security

We take reasonable technical and organizational measures to protect your personal information, including TLS encryption in transit, row-level security policies in our database, and restricted access to admin functions. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Third-party links

Spa listings may include links to external websites (spa websites, Google Maps, Yelp, etc.). We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policy of any third-party site you visit.

11. California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect, use, disclose, or sell.
• The right to delete personal information we have collected from you.
• The right to opt out of the sale of personal information. We do not sell personal information.
• The right to non-discrimination for exercising your CCPA rights.

To submit a verifiable consumer request, email us at hello@kspa.online.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If we make material changes, we will notify registered users by email. Your continued use of KSpa Online after changes take effect constitutes your acceptance of the revised policy.

13. Contact us

If you have questions, concerns, or requests related to this Privacy Policy, please reach out: