Legal

Privacy Policy

How SpinBook collects, uses, shares, and protects personal information for DJ businesses and the couples they serve.

Updated Wed Jul 22 2026 00:00:00 GMT+0000 (Coordinated Universal Time)View as Markdown

DRAFT — pending legal review. This document is a thorough working draft generated from SpinBook's actual data practices. It has not been reviewed by a lawyer and must not be published as-is. Every double-bracketed FILL placeholder below is a fact or decision that must be resolved before this goes live. Scope prepared for United States (CCPA/CPRA) and Canada (PIPEDA/CASL). If SpinBook begins serving users in the EU/UK, this policy needs GDPR additions (legal bases, Standard Contractual Clauses for international transfers, DPO/representative).

Effective date: 2026-07-02 Last updated: 2026-07-21

1. Who we are and what this policy covers

SpinBook ("SpinBook," "we," "us") is a software platform operated by SpinBook LLC, a Delaware limited liability company located at [[FILL: BUSINESS_MAILING_ADDRESS]]. SpinBook provides a business portal that DJ and event-services businesses ("DJ Businesses") use to manage bookings, planning, contracts, and payments with their clients — typically engaged couples planning a wedding or event ("Clients" or "Couples").

This Privacy Policy explains how we handle personal information across:

spinbook.io and the DJ Business portal;
the Client portal each DJ Business shares with its Couples;
our public booking forms, help site (support.spinbook.io), and APIs.

Our two roles (please read — this is important)

SpinBook operates a business-to-business-to-consumer service, so our role depends on whose information is involved:

For a DJ Business's own account information (the business's login, settings, and billing), SpinBook is the business/controller and handles that data under this policy.
For a Couple's information that a DJ Business collects and manages through SpinBook (names, event details, planning notes, contracts), the DJ Business decides how that information is used — SpinBook acts as its service provider and processes the data on the DJ Business's behalf and instructions.

If you are a Couple and want to access, correct, or delete information held by a specific DJ Business, contact that DJ Business directly; we will support them in responding. See Section 9.

2. Information we collect

We collect only what the service needs. We do not run advertising trackers or sell your information.

2a. Information DJ Businesses provide

Account & identity: name, email address, password (stored hashed by our authentication provider).
Business profile: business name, portal slug, logo, brand colors, fonts.
Payout handles: the Venmo, PayPal, or Zelle handles a DJ Business chooses to display to Couples (these may be an email address, phone number, or username).
Billing information for a SpinBook subscription: subscription billing is not yet enabled. If and when we charge subscription fees, payment will be handled by a third-party payment processor, which we will identify in this policy and add to our sub-processor list before any charge.
API keys and webhook settings the DJ Business creates (we store only a one-way hash of each API key, never the key itself).

2b. Information about Couples (collected by DJ Businesses through SpinBook)

Collected via a DJ Business's booking form and planning tools:

Contact details: primary and partner names, email address, phone number.
Event details: event date and time, venue name and address, guest count, package/service selected, any selected add-ons/upgrades, event type, lead source, and any custom questions the DJ Business adds to its booking form.
Planning details: ceremony/reception timeline, must-play and do-not-play song lists, MC and dance notes, vendor notes, and other free-text planning fields.
Uploaded documents: files a Couple (or the DJ Business) attaches to an event for reference — for example a timeline document such as a planner's or caterer's run sheet, or a list of song requests; a PDF, an image, or a Word/text/CSV file. These are stored in our hosting provider's file storage and are not scanned or parsed; they may contain whatever personal information the uploader chooses to include.
Links a Couple provides: web addresses they enter themselves, such as a link to a music playlist they built on another service. We store the link and show it to the DJ Business; we don't follow it or retrieve anything from it.
Playlist selections: if the DJ Business has connected Spotify, the songs a Couple searches for and picks in the playlist builder (track name, artist, and a Spotify track reference).
Contract records: the exact contract text presented, the typed signer name, a drawn signature image, the date and time of signing, and the IP address of the signer. We capture the IP address to verify and evidence electronic signatures, as is standard for e-signature records.
Payment records: the amount, label (e.g. "Deposit"), status (pending/paid), method noted (Venmo/PayPal/Zelle/other), and dates. We do not collect or store payment card numbers or bank account details — Couples pay DJ Businesses through external services, and SpinBook records only that a payment was made.

2c. Information we collect automatically

Authentication cookies: to keep you signed in (see Section 4).
Log and technical data: IP address, browser/device type, pages requested, and timestamps, processed by our hosting and (planned) error/performance monitoring providers to operate, secure, and troubleshoot the service.
We do not use analytics or advertising cookies, cross-site trackers, or behavioral profiling.

3. How we use information

We use personal information to:

provide, operate, and maintain the SpinBook platform and the DJ Business and Client portals;
create and manage accounts and authenticate sign-ins;
enable booking, planning, contracts, and payment tracking between DJ Businesses and their Couples;
send transactional messages (sign-in links, booking and event notifications, payment reminders, contract status);
send marketing or promotional messages where permitted and with the consent required by law (see Section 8);
provide customer support and troubleshoot issues, including via our support team and support tooling;
secure the service, prevent fraud and abuse, and maintain audit and e-signature records;
comply with legal obligations and enforce our Terms of Service.

Under CCPA/CPRA we collect and use the categories of personal information listed in Section 9 for these business purposes. Under PIPEDA we rely on your consent (express or implied) and other lawful bases, and use information only for the purposes identified here or as otherwise permitted by law.

4. Cookies

SpinBook uses a small number of strictly necessary cookies, set by our authentication provider, to keep you signed in and to secure your session. These are essential to the service and cannot be turned off while using it. We do not set advertising, analytics, or cross-site tracking cookies, so SpinBook does not display a tracking-consent banner. If this ever changes, we will update this policy and add the required consent controls.

We share personal information only as described here.

5a. Service providers (sub-processors)

We use vetted providers to run SpinBook. They may process personal information only to provide services to us, under contract. Our current and planned providers:

Provider	Purpose	Data involved
Supabase	Database, authentication, file storage, sign-in emails	All stored personal information; account emails
Cloudflare	Application hosting, content delivery, security, logs	Technical/log data; all traffic in transit
Resend	Transactional email delivery (booking confirmations, sign-in links)	Recipient name and email, message content
Spotify	Playlist creation in a DJ Business's connected Spotify account (song search and playlist sync)	Song titles/searches entered by Couples; the DJ Business's Spotify account identifier
Axiom (planned)	Log management & troubleshooting	Technical/log data (personal fields redacted)
Sentry (planned)	Error monitoring	Error/diagnostic data (personal fields redacted)
Chatwoot (planned)	Customer support / help desk	Contact details and support conversation content
Payment processor (planned)	Subscription billing (not yet enabled)	DJ Business billing details

A current list of sub-processors is maintained by SpinBook and available on request. We update this table when providers change.

5b. International support and processing

SpinBook is operated from and hosts data primarily in the United States. We (and our providers) may process and support personal information from other countries, including support staff located in the Philippines. Where information crosses borders, we require contractual protections comparable to those in this policy, as required by PIPEDA and applicable law.

A DJ Business may connect SpinBook to its own automation tools (for example Make, Zapier, or n8n) using webhooks. When enabled, SpinBook sends event data — which can include Couple names, email addresses, and event details — to the URL the DJ Business configures. That transfer is directed and controlled by the DJ Business, which is responsible for the destination and its handling of the data.

5d. Within a DJ Business

A Couple's information is accessible to the staff of the DJ Business they are working with, so that business can serve them.

5e. Legal, safety, and business transfers

We may disclose information to comply with law, respond to lawful requests, protect rights and safety, or in connection with a merger, acquisition, financing, or sale of assets (with notice as required by law).

5f. Calendar subscription feeds

A DJ Business (and a Couple, for their own event) can generate a private calendar subscription link and add it to an outside calendar app such as Google Calendar, Apple Calendar, or Microsoft Outlook. When a link is subscribed, SpinBook publishes the relevant event dates and milestone due dates — which can include event titles, Couple names, and venue names — to the calendar app the subscriber chooses. That transfer is directed by the person who subscribes the link, and the outside calendar provider handles the data under its own terms. The link is a secret credential: anyone who has it can read those dates until it is rotated, so it should only be shared with people who should see them. SpinBook does not choose or control which calendar provider a subscriber uses.

5g. Spotify playlist integration

A DJ Business may connect its own Spotify account so Couples can build their event playlist inside SpinBook. When this is enabled: song searches a Couple types are sent to Spotify to return matching tracks; the Couple's picked songs are used to create or update a playlist in the DJ Business's Spotify account; and SpinBook stores the DJ Business's Spotify authorization tokens encrypted along with the Couple's picked songs (track name, artist, and Spotify track reference). Spotify processes this data under its own privacy policy. When a DJ Business disconnects Spotify, SpinBook deletes the stored tokens and all cached song selections for that business; playlists already created remain in the DJ Business's own Spotify account under its control.

SpinBook does not sell personal information, and does not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months.

6. Data retention

We keep personal information for as long as an account is active and as needed to provide the service, then as required to meet legal, tax, accounting, audit, and dispute-resolution obligations. Signed contract records (including signature and IP) are retained as durable legal records even after an event is archived. Data may be archived rather than immediately deleted. When information is no longer needed, we delete or de-identify it. To request deletion, see the next section.

Our current retention targets (proposed; subject to final confirmation):

Signed contracts and payment-status records: retained for 7 years for tax, accounting, audit, and dispute-resolution purposes.
Active account and event data: retained while the DJ Business account is active.
Inactive DJ Business accounts: eligible for deletion 24 months after last activity, following notice.
Couple data: a Couple may request deletion through the relevant DJ Business at any time, subject to the retention obligations above.

Implementation note (internal): self-service data export and deletion are not yet built; requests are currently handled manually via the contact below. Building export/deletion is a launch requirement under both CCPA and PIPEDA — tracked by the legal-check process.

7. Security

We protect information with encryption in transit (HTTPS/TLS), tenant isolation between DJ Businesses (row-level security), hashed storage of credentials and API keys, and access controls that limit staff and support access to what their role requires, with support access logged. No system is perfectly secure, but we work to protect your information and to notify affected users and regulators of a breach as required by law (including PIPEDA's breach-notification rules).

Transactional messages (sign-in links, booking/event/payment/contract notifications) are part of the service and are sent to operate your account.
Marketing messages are sent only where permitted. In the United States we comply with CAN-SPAM — every marketing email identifies us, includes a valid postal address, and offers a working unsubscribe link we honor promptly. In Canada we comply with CASL, which generally requires your express consent before we send commercial electronic messages, clear sender identification, and an unsubscribe mechanism. You can opt out of marketing at any time using the unsubscribe link or by contacting us; you will still receive transactional messages.

9. Your privacy rights

9a. California (CCPA/CPRA)

If you are a California resident, you have the right to: know/access the personal information we collect and how we use and disclose it; delete your personal information; correct inaccurate information; and be free from discrimination for exercising your rights. Because we do not sell or share personal information for cross-context behavioral advertising, no opt-out of sale/sharing is needed.

Categories of personal information we collect (CCPA categories): identifiers (name, email, phone, IP address); customer records (contact and payment-status details); commercial information (bookings, packages, payment history); internet/network activity (log data); geolocation (venue address, IP-derived location); and other information you provide (planning notes, signatures). We disclose these categories to the service providers and recipients in Section 5 for business purposes.

9b. Canada (PIPEDA)

If you are in Canada, you may access the personal information we hold about you, request correction, and withdraw consent (subject to legal or contractual limits). You may also challenge our compliance with PIPEDA by contacting our privacy contact below, and escalate to the Office of the Privacy Commissioner of Canada.

Email: privacy@spinbook.io
Mail: SpinBook LLC, [[FILL: BUSINESS_MAILING_ADDRESS]]
Canada — privacy contact / accountable individual: SpinBook Privacy Officer (privacy@spinbook.io)