SPRITZ SOCIAL, INC. · LEGAL
This Privacy Policy describes how Spritz Social, Inc., a Delaware corporation ("Spritz Social," "Spritz," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you use our applications on iOS, Android, macOS, and the web (collectively, the "Service"). It applies whether you are signed in to the Service or just browsing it.
Who we are. Spritz Social, Inc. is the controller responsible for the personal data described in this Privacy Policy. You can reach us about any privacy matter — including to exercise your privacy rights — at [email protected] or as otherwise described under "Contact Us" below.
The legal bases on which we process personal data — including the specific situations in which we ask for your consent (such as push notifications) — are described under "European Privacy Rights (GDPR)" below. Where we rely on your consent, you may withdraw it at any time, and any withdrawal will not affect the lawfulness of processing we carried out before you withdrew it.
We are committed to protecting your privacy and handling your data with transparency. This policy is designed to help you understand what information we collect, why we collect it, and how you can manage your information.
We collect the following categories of information when you use Spritz:
If you sign in via Google, we receive a limited set of profile information from Google to identify and create your Spritz account: your name, email address, profile picture URL, and the unique account identifier Google assigns to you. We request only the "email" and "profile" OAuth scopes and do not request access to your Google contacts, files, calendar, or any other Google services. You may revoke Spritz's access to your Google account at any time through your Google account settings.
If you use Spritz on an iPhone, iPad, or Android device, we may also ask the App Store or Google Play for the age range on your Apple or Google account when you sign up and after you sign in on a device. App stores provide it where the law requires them to, such as in Texas, or where you have chosen to share your age range with apps. We use it only to confirm that you meet our minimum age of 18. We keep only the result (whether you met the minimum age, or that no age range was available), the platform, and when we checked, until your account is deleted; the age range itself is discarded as soon as it has been checked, and we never store, log, or share it. If the age range shows that you are under 18, we will not create an account, and we will close an existing one (see "Users Under 18" under "Children's Privacy"). If no age range is available, the date of birth you enter decides.
When you sign up or sign in, when you open the app, and when you return to it, the app also checks the general location of your internet connection: your country and, in the United States, your state, as Cloudflare determines it from your IP address. We use it only to check whether Spritz is available where you are, because some places' laws restrict services like ours, and we don't keep it.
We do not collect precise GPS location data. Location information is limited to general region for service optimization and security purposes. When you upload a photo or video, the location, device, and capture-time metadata embedded in the file is removed before it is stored.
Crash and diagnostic collection runs only on iOS, Android, and macOS. It is not used in our web app or in development builds. See "Third-Party Service Providers" below for the provider that processes this data on our behalf.
We record signals about how you interact with content on Spritz so we can decide which posts to show you and in what order, and so we can measure how content is performing across the Service. These signals include:
Engagement information is associated with your account. How it is used to order your feed is described under "Personalized Content Ranking" below.
We use these to bill advertisers, pay creators, and detect invalid traffic, as described under "Advertising" below.
We store the connections you create on the Service so we can deliver friend requests and show you content and activity from people you are connected to. This includes:
If you create or are invited to an event on the Service, we store information about that event so we can display it to participants. This includes:
Our servers automatically check the messages you send in chats and the events you create or edit for spam, scams, and abuse (how this works is described under "Use of Your Data to Train Models" below). To do so, we record:
We delete these automatically: the fingerprints and the IP address and country after 48 hours, message scores 30 days after the message was sent, and event scores 90 days after the event was created or last edited. We keep a record longer only when it is part of an abuse, safety, or fraud investigation, or when the law or a legal hold requires it, as described under "Information Retained After Account Deletion" below. If you delete your account, these records are otherwise kept only until those periods end.
If you apply for creator monetization, we store your application so a person on our team can review it and so we have a record of the decision. This includes:
Only our team sees your links, and we use them only to review your application; they are not shown on your profile. If you delete your account, we erase your links and that reason. We keep the decision and its dates, no longer linked to your name or contact details, because they record when your creator earnings started and stopped.
If you use any paid feature on the Service (such as adding funds to your wallet, paying for ads, receiving creator earnings, or making a withdrawal), we store records of those transactions so we can maintain accurate balances, support customer service requests, and meet legal recordkeeping obligations. These records include:
Funds are added, and ads are paid for, on our website, where Stripe takes the payment. If you turn on auto-recharge, Stripe keeps your card on file so we can charge it the amount you chose whenever your balance falls below the level you chose. If you advertise, we also keep each of your ads' spend, views, and taps, and show them to you.
We do not receive or store your full payment card number. Card details are collected and tokenized directly by Stripe in compliance with PCI-DSS standards.
Photos and Videos: We only access, store, and process photos and videos that you explicitly choose to share through the Service. Videos you upload include their audio track, which we store and process as part of that video content. We do not access your device's photo library or camera roll without your express action to share specific content.
Posts, Comments, and Messages: Content you share through the Service — including posts you create, comments you leave on other users' posts, messages you send in chats, and similar communications — is stored to provide the Service to you and the users you are communicating with.
The Service may use the operating-system permissions and system features described below. Each is optional and is used only for the purpose described; where you grant a permission, you can revoke it at any time in your device settings. Spritz also uses your camera, microphone, and photo library, but only when you actively capture or attach content — for example, recording a video or choosing a photo to post (see "User-Generated Content" above).
Push Notifications: If you grant permission to receive push notifications, we use them to alert you to activity relevant to your account — such as new messages, friend requests, and other in-app events you have not yet seen. Push notifications are entirely optional and the Service functions without them. You may disable push notifications at any time through your device settings — on iOS, in Settings → Notifications → Spritz; on Android, in your device's notification or app settings for Spritz (the exact path varies by Android version and manufacturer); on macOS, in System Settings → Notifications → Spritz. Disabling notifications does not affect any other part of the Service. We do not use push notifications for marketing.
Calendar (Add to Calendar): When you tap "Add to Calendar" on an event, Spritz passes that event's details — its name, description, location, and time — to your device so you can save it to your own calendar. On current versions of iOS and on Android, this opens your operating system's built-in "Add Event" screen, which you use to review and save the event yourself; in that case Spritz does not request calendar permission and does not gain access to your calendar. On older iOS versions, your device may first ask you to grant calendar access so the event can be added. On the web and on macOS, "Add to Calendar" instead opens a pre-filled Google Calendar page in your browser. In all cases we use only the details of the event you chose to add — we do not read, modify, or upload your existing calendar entries, and your calendar is never sent to or stored by Spritz.
Spritz does not set its own tracking cookies or advertising cookies. Our mobile applications do not use first-party cookies.
When you use the Service on the web at spritz.social, the following first-party cookies and equivalent device storage may be set on your device. None of them are used by Spritz for advertising or cross-site tracking:
We do not use cookies for advertising or for cross-site tracking, and we do not sell any data collected via cookies.
Other parties: we do not allow advertising networks or other third parties to collect personally identifiable information about your online activities over time and across different websites or online services when you use Spritz. The providers named above (the provider that serves and protects spritz.social, and Stripe during checkout) may collect device and network information when you use the Service, including to detect fraud and automated abuse across the sites and services they protect, under their own privacy policies. The ads we show are our own and involve no advertising network (see "Advertising" below).
We do not read any device advertising identifier (IDFA on iOS, GAID on Android). We do not engage in cross-site tracking and do not sell tracking data. See the "Advertising" section below for how advertising works on Spritz.
Do Not Track: Some browsers can send a "Do Not Track" (DNT) signal. Because there is no industry-standard agreement on how to interpret DNT, the Service does not respond to DNT signals. We do, however, recognize the Global Privacy Control (GPC) signal: our web app reads the GPC signal your browser sends and treats it as your opt-out preference. Where the sale or sharing of your personal information, or the use of your data for targeted advertising, applies, we give effect to that signal as an opt-out, as described under "California Privacy Rights (CCPA/CPRA)" below.
We show ads in the feed, but we do not use your personal information to choose which ad you see. We do use records of the ads you view and tap, and of how long you spend on each creator's posts, to bill advertisers, pay creators, and detect invalid traffic. See "Advertising" below for full details.
We work with trusted third-party service providers to operate the Service. These providers have access to your information only to perform specific tasks on our behalf and are obligated to protect your information:
Crash Reporting and Diagnostics: Firebase Crashlytics (Google) — Used on iOS, Android, and macOS to receive crash reports and non-fatal error reports so we can identify and fix bugs. Reports include stack traces, the standard device diagnostic context described above, and your Spritz user ID. Crashlytics is not used in our web app or in development builds. Google's privacy and security practices for Firebase are described at https://firebase.google.com/support/privacy.
Cloud Infrastructure and Storage: We use third-party providers for content delivery, edge networking, and object storage of user-uploaded media. These providers process data on our behalf as data processors and do not access the contents of your data for their own purposes.
Database, Authentication, and Server-Side Functions: We use a third-party backend platform to host the application database, manage user authentication (including password hashing and session tokens), and run server-side functions we invoke from the app. This provider processes data on our behalf as a data processor.
Push Notifications: We use a third-party push notification provider to deliver notifications to your device. To deliver them, the provider receives and stores your device push notification token, a provider-assigned subscription identifier, basic device information (model, operating system version, app version, language), your country (derived from your IP address), and event metadata such as when you last opened the app and whether you have notifications enabled.
Text Messages (SMS): A third-party messaging provider receives your phone number and each text's content, only to deliver our texts.
Security and Abuse Prevention (App and Browser Integrity): Cloudflare (Turnstile) and Google/Apple (Firebase App Check) — To protect the Service from automated abuse, fraud, and account-enumeration, we verify that requests to our servers come from a genuine app instance or a real browser. On the web, Cloudflare Turnstile presents a security challenge; to verify it, your IP address together with browser and device characteristics and interaction signals are sent to Cloudflare. On iOS, Android, and macOS, Firebase App Check uses the platform's built-in integrity services — Apple App Attest and Google Play Integrity — to produce a device- and app-integrity attestation token, which is sent to Google to confirm the request comes from an authentic, untampered copy of the app. These providers act as data processors for security purposes only; this data is not used to advertise to you or to build a cross-site profile of you. Cloudflare's privacy practices are described at https://www.cloudflare.com/privacypolicy/, and Google's Firebase privacy practices at https://firebase.google.com/support/privacy.
Payment Processing: Stripe — Used to process payments securely. Card details are entered into and tokenized by Stripe; we do not receive or store your full card number. We do retain transaction records (such as amount, date, type, and Stripe reference IDs) so we can reconcile your wallet balance and meet recordkeeping obligations. See "Wallet and Transaction Information" above for details. Stripe processes payment data in compliance with PCI-DSS standards.
Advertising: We sell and serve our ads ourselves, so no advertising provider receives any data about you. See "Advertising" below.
These service providers are contractually obligated to protect your data and use it only for the purposes we specify.
We Do Not Sell Your Data: Spritz does not sell, rent, or trade your personal information to third parties for their marketing purposes.
Text Messaging: We never sell your mobile number or text-message consent, or share them with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third party, except the messaging provider that delivers our texts.
Limited Sharing: We may share your information only in the following circumstances:
Spritz shows ads in the feed, between posts. Each ad is labeled "Sponsored" and names the advertiser. We sell our ads directly to advertisers, who buy them on our website, and serve them ourselves; ads for Spritz itself may fill places no advertiser has bought.
We do not use your personal information to choose which ad you see. Spritz uses no third-party ads SDK or advertising network, does not read any device advertising identifier (IDFA on iOS, GAID on Android), does not track you across other companies' apps or websites, and does not build a device fingerprint for advertising. That is why the app shows no App Tracking Transparency prompt.
Advertisers receive only totals for their own ads, such as how many times they were viewed and tapped in a month, never information about you. Creators see their own earnings, never who viewed their posts. We do not share your name, contact details, messages, photos, videos, contacts, payment information, or any record of your ad views or viewing time with any advertiser or creator.
Ad-view, ad-tap, and viewing-time records stay linked to your account for 13 months. After that we remove the link and keep only totals, for as long as tax and accounting law requires. If you delete your account, we remove the link right away.
Settings → Privacy has a control for personalized advertising. Residents of the EEA, the United Kingdom, and Switzerland see a "Personalized ads" toggle that stays off unless they turn it on (we also ask at signup); California residents see "Do Not Sell or Share My Personal Information" (per CCPA §1798.135); everyone else sees an opt-out of personalized ads and of the sale or sharing of their information. Because our ads are not personalized and we neither sell nor share your personal information, these controls do not change the ads you see. We record your choice and will honor it if we ever change how ads work, which we would announce by updating this Privacy Policy first. Opting out never reduces the number of ads you see.
Spritz uses an automated system to decide which posts to show you in your feed and the order in which they appear. This is a form of personalization, and we are providing the disclosures below so you can understand how it works. We provide these disclosures in support of the transparency expectations that apply to automated processing under the General Data Protection Regulation in the European Economic Area, the United Kingdom, and Switzerland, and comparable expectations in other jurisdictions.
The ranking system selects which posts to show you and the order in which they appear. Its goal is to surface posts you are more likely to enjoy or find relevant, to introduce you to creators and topics you have not seen before, and to keep your feed fresh.
The system relies primarily on the engagement information described under "Information We Collect" above — for example, your ratings and reactions, how long you spend viewing a post, which posts you have already viewed, and the posts you create, comment on, or share — together with general attributes of each candidate post, such as who created it and how other users on Spritz are responding to it.
The ranking system does not use your name, email address, phone number, date of birth, the contents of your private messages, your contacts, or your payment information to decide what to show you.
This is a content recommendation system. It does not make any decision that produces legal effects concerning you or that similarly significantly affects you. It does not determine your eligibility for any product, service, price, or account standing; it does not affect your ability to use the Service, to post, or to be paid; and it is not used for credit, employment, housing, insurance, or similar decisions.
If personalized ranking is not available — for example, when your account is new and has not yet generated enough engagement signals — your feed shows a starter selection that is the same for every new user, apart from accounts you have blocked or muted. It is ordered by how other Spritz users have rated each post, with posts that have not yet been rated following, newest first. If that selection is also unavailable, such as briefly on first launch or during a service interruption, your feed shows eligible posts newest first.
The system combines the engagement signals listed above to estimate, for each candidate post, how likely you are to enjoy it, and ranks posts accordingly. It also intentionally introduces a portion of posts that fall outside your typical interests so that you continue to discover new creators and topics. The relative weight given to each signal may change over time as we improve the system; we do not publish exact weights or model parameters because they evolve as we tune the system, but the categories of signals listed above are stable.
Spritz operates machine-learning systems that run within the Service for one narrowly tailored, in-service purpose: personalization, ranking, and recommendation (the automated system described under "Personalized Content Ranking"). These systems learn from your engagement information (the signals listed under "Information We Collect") and from non-private metadata about posts on the Service (such as the post's creator, format, hashtags, and similar attributes). The data we use to train and tune these systems, the parameters and weights they produce, and the outputs they generate all stay within the Service and are used only to operate the Service for you and for other Spritz users.
We also operate trust-and-safety processes to moderate content and respond to abuse. Content reported by users is reviewed by people. In addition, our servers automatically score the messages you send in chats and the events you create or edit for spam, scams, and abuse, using the signals listed under "Spam and Abuse Signals" in "Information We Collect" above. This scoring follows rules we write and maintain ourselves, such as known scam phrases, suspicious links, and the same text being sent to many people; it is not a machine-learning model and is not trained on your data. The scores are used only to keep the Service safe: to detect spam and abuse, and to limit, hold, or block the delivery of messages and events that appear to be spam. They are not used to rank your feed or to target advertising. Fraud prevention and app-, browser-, and platform-integrity protections are provided by the third-party processors described elsewhere in this Policy (such as our payments provider and our app- and browser-integrity providers), not by an in-Service machine-learning system trained on your data.
No Use of Your Content to Train General-Purpose or Third-Party AI Models.
We do not use the content you upload to the Service — including your posts, comments, messages, photos, and videos — to train, fine-tune, evaluate, benchmark, distill, or otherwise develop any general-purpose, foundational, large-language, generative, or third-party artificial-intelligence model, whether our own or a third party's, and we will not authorize any service provider to do so on our behalf. This is the same commitment we make to you in Section 3.4 of our Terms of Service, restated here for clarity.
We do not sell, license, share, or otherwise make your User Content, your engagement information, or any model, weights, embeddings, or other artifacts derived from them available to any third party for the purpose of training, fine-tuning, evaluating, benchmarking, or otherwise developing any machine-learning or generative-AI model.
If we ever wish to use your content for a purpose outside the in-service uses described above — for example, training a general-purpose AI model on your content — we will update this Privacy Policy before doing so and, where applicable law requires your consent (or where Section 3.4 of our Terms of Service requires opt-in consent), obtain that consent first.
We retain your personal information for as long as your account is active or as needed to provide you the Service.
Account Deactivation: You may deactivate your account at any time through the Account settings within the Service. Deactivation hides your profile and content from other users but retains your data so you can reactivate your account at any time by logging back in.
Account Deletion: You can permanently delete your account and all associated personal data yourself at any time from the Account page in the Service, using the "Delete Account" button. If you are unable to access your account, you may instead request deletion by contacting us at [email protected]; in that case we will verify your identity using the process described under "Verifying Your Identity" before proceeding. Upon deletion:
Information Retained After Account Deletion: We retain a narrow set of information after deletion, only where required by law or necessary to operate the Service safely. Each category is retained only for the period stated:
We implement security measures appropriate to the size and nature of our Service to protect your personal information:
While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents we become aware of.
Despite the security measures described above, no system can guarantee perfect security. If we determine that a security incident has resulted in the unauthorized access to, acquisition of, disclosure of, or loss of your personal information, we will notify you, and any applicable supervisory authority or regulator, where and in the manner and timeframe required by applicable law (as described below). Even where individual notice is not legally required, we may, at our discretion, notify affected users — by email to the address associated with the Spritz account, or by another method permitted by law — where we determine that doing so is appropriate.
Where applicable law specifies a notification timeline or recipient, we will meet it. In particular:
If we are unable to reach you individually by email — for example, because the address on file is no longer valid — we will use substitute notice methods permitted by applicable law, such as a conspicuous notice within the Service. We may delay individual notification only to the extent necessary to determine the scope of the incident, restore the integrity of our systems, or comply with a law-enforcement request for delay, and only for as long as that necessity continues.
The Service is not directed to and is not intended for anyone under 18 years of age. As described in our Terms of Service, we currently require every user to be at least 18, regardless of where they live — a single global minimum age that meets or exceeds the statutory minimum in each of the jurisdictions discussed below. We rely on the date of birth you give us when you sign up, and we do not otherwise check users' ages except as described in this Privacy Policy. This section explains what we do if we learn that a minor has used the Service, and the rights of parents and legal guardians. The Children's Online Privacy Protection Act ("COPPA") imposes specific obligations regarding children under 13, described below.
Children Under 13 (COPPA): In accordance with the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. § 6501 et seq., and the Federal Trade Commission's implementing regulations at 16 C.F.R. Part 312:
Parents and legal guardians of a child under 13 whose information was collected in error may, at any time:
To exercise any of these rights, contact [email protected]. We will verify the identity of the requesting parent or legal guardian before releasing or acting on the information, consistent with COPPA's verification requirements.
EU, EEA, and UK Users Below the Digital Age of Consent: Article 8 of the General Data Protection Regulation ("GDPR") and analogous UK law require parental consent for the processing of personal data of children below the digital age of consent set by the user's member state — which ranges from 13 to 16 depending on the country. Because we currently require every user to be at least 18, our minimum age exceeds the digital age of consent in each of these countries. If you are under 18, you must not use the Service. If we become aware that we have processed the personal information of a user below the digital age of consent that applies to them without verified parental consent, we will take reasonable steps to delete that information and close the account.
Australia: Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024 requires covered social media platforms to take reasonable steps to prevent Australians under 16 from holding accounts. Our minimum age of 18 exceeds that requirement: if you reside in Australia, as everywhere, you must be at least 18 years of age to use the Service.
Other Jurisdictions: Countries such as South Korea and Brazil set their own minimum ages or impose additional requirements for users below the age of majority. Our global minimum age of 18 applies unless the minimum age in your jurisdiction is even higher, in which case that higher age controls. If we become aware that a user is below a minimum age set by the law of their jurisdiction, we will take reasonable steps to delete the user's personal information and close the account.
Users Under 18: Our Terms of Service do not allow anyone under 18 to use the Service. If the App Store or Google Play tells us a user is under 18 (see "Account Information" under "Information We Collect"), we will not create an account, or we will close an existing one. Where any other applicable law requires us to act on information that a user is below a minimum age, we will take the steps that law requires; beyond that, whether and how we act on other information about a user's age is at our discretion, as described in our Terms of Service. We keep a closed account's information until the account is reopened or deleted, except that we delete a child under 13's information as described above. If we closed your account because you were under 18, contact us when you turn 18 and we will reopen it. Parents and legal guardians may contact us at [email protected] regarding a minor's account or to request that it be closed.
California "Eraser" Right for Minors: Pursuant to California Business and Professions Code § 22581, registered users of the Service who are California residents and under 18 years of age have the right to request removal of content or information that they have publicly posted on the Service. To submit such a request, contact [email protected]. Removal may not extend to content reposted, shared, or republished by other users, to content that has been anonymized or aggregated, or to content subject to a legal hold or retention requirement.
Reporting an Underage Account: If you believe an account on the Service is held by a user under the applicable minimum age described in our Terms of Service, please report it by contacting [email protected] (or by using the in-app reporting tools available throughout the Service).
Parent and Guardian Contact: Parents and legal guardians may contact us at [email protected] regarding any matter under this section, including reviewing or deleting a child's information, terminating a minor's account, or asking questions about our privacy practices for minors.
The following rights and choices apply to your personal information. Where applicable data-protection law grants you these or similar rights, they are available to you as a matter of law; as a matter of policy, we also extend them to our users in other locations:
To exercise any of these rights, please contact us at [email protected].
Before acting on a request to access, correct, delete, or port your personal information, we take reasonable steps to confirm that you are the person whose data the request concerns. The steps depend on whether you are signed in to the Service when you submit the request.
You may designate another person or organization to submit a request on your behalf. We require a written authorization signed by you that names the agent and identifies the request being made. We may also contact you directly to confirm the request before acting on it. Where an authorized agent is acting under a valid power of attorney, contacting you directly may not be required.
We acknowledge and respond to verifiable requests within the timeframes the privacy law that applies to you requires — for example, the acknowledgement and response periods set by the CCPA for California residents and by Article 12 of the GDPR for users in the EEA, the United Kingdom, and Switzerland. Where a request is complex or we have received a number of requests, we may extend these periods only to the extent the applicable law permits, and where we do, we will tell you within the original period that law requires, together with the reasons.
For information on disabling push notifications, see "App Permissions" above.
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected that information, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share it.
Right to Delete: You have the right to request that we delete any personal information we have collected from you, subject to certain exceptions permitted by law (such as completing a transaction, detecting security incidents, or complying with legal obligations).
Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.
Right to Opt-Out of Sale or Sharing: Spritz does not sell or share your personal information. Our ads are not personalized, and advertisers receive only totals (see "Advertising" above). You may still record or change your choice at any time by going to Settings → Privacy and toggling "Do Not Sell or Share My Personal Information" on. That toggle is our clear and conspicuous opt-out mechanism for California residents under CCPA §1798.135. We also treat the Global Privacy Control (GPC) signal sent by your browser or browser extension as a valid request to opt out of the sale or sharing of your personal information and of the use of your data for targeted advertising. No account deletion is required to exercise this right.
Sensitive Personal Information: The CPRA defines a category of "sensitive personal information" (SPI) that includes specific data types such as government identifiers, precise geolocation, contents of private communications, genetic and biometric data, and information about racial origin, religion, health, or sexual orientation.
Categories of SPI we do not collect: Spritz does not collect Social Security numbers, driver's license numbers, passport numbers or other government identifiers, precise geolocation, genetic data, biometric data used for unique identification, racial or ethnic origin, religious or philosophical beliefs, union membership, health information, or information about your sex life or sexual orientation.
How we use SPI: We use SPI only for the purposes set forth in California Code of Regulations, Title 11, §7027(m) — that is, to perform the services you have requested, to ensure the security and integrity of the Service, to prevent and respond to malicious or fraudulent activity, to perform short-term transient processing, and to comply with our legal obligations. We do not use SPI to infer characteristics about you, and we do not disclose, share, or sell SPI for any purpose other than those listed.
Right to Limit Use of SPI: California residents have the right under §1798.121 to direct a business that uses or discloses sensitive personal information beyond the limited purposes the law permits to limit such use. Because we currently use sensitive personal information only for those limited purposes, the law does not require us to provide a separate "Limit the Use of My Sensitive Personal Information" link, and there is nothing further you need to do. If our practices ever change, we will provide that mechanism. You may also contact us at [email protected] with any request regarding your sensitive personal information, and you retain your other CCPA/CPRA rights (access, deletion, correction, portability) over it.
California "Shine the Light" (Civil Code §1798.83): California residents may request, once per calendar year, information about the categories of personal information we disclosed to third parties for those third parties' own direct-marketing purposes, and the identities of those third parties. We do not disclose your personal information to third parties for their own direct-marketing purposes, so there is nothing to report; if this ever changes, we will update this Privacy Policy. To make a Shine the Light request, contact us at [email protected].
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
Exercising Your Rights: To submit a request to know, delete, or correct your personal information, contact us at [email protected]. We respond to verifiable consumer requests within 45 days, a period we may extend by an additional 45 days where reasonably necessary and permitted by the CCPA, in which case we will notify you within the first 45 days. Identity verification and authorized-agent requirements are described under "Your Rights and Choices" above.
A growing number of US states have enacted comprehensive consumer privacy laws (for example, Virginia, Colorado, Connecticut, Texas, and Oregon, among others). Most of these laws apply only to businesses that meet specific resident-count or revenue thresholds in the relevant state; Texas and Nebraska instead apply to any business that does not qualify as a small business under the criteria of the U.S. Small Business Administration. Where any of these laws apply to us, this section describes how we honor them.
Your Rights: If you are a resident of a state with a comprehensive privacy law, you have substantively the same rights described under "Your Rights and Choices" above, including the rights to access, correct, delete, and port your personal information, and to opt out of the sale of your personal information and of targeted advertising. The categories of data we collect, the purposes for which we use it, and the categories of third parties with whom we share it are described under "Information We Collect," "How We Use Your Information," and "Third-Party Service Providers" above.
Right to Appeal: If we decline a privacy-rights request you submit, you may appeal that decision by replying to the email in which we conveyed our decision, or by writing to [email protected] and referencing your original request. We will respond to appeals within the period required by the applicable state privacy law (and, where that law sets no specific period, within 60 days), and sooner where the law or the circumstances allow. If your appeal is denied, you may contact your state attorney general or the privacy regulator in your state.
Universal Opt-Out Signals: Where required by law — including in Colorado, Connecticut, Texas, Oregon, Montana, Nebraska, Delaware, New Jersey, New Hampshire, Maryland, and Minnesota — we treat opt-out preference signals such as the Global Privacy Control (GPC) sent by your browser or browser extension as a valid request to opt out of the sale or sharing of your personal information and of the use of your data for targeted advertising, and we give effect to changes in that signal promptly, as described under "California Privacy Rights (CCPA/CPRA)" above.
Sensitive Data: Most non-California state privacy laws define "sensitive data" more narrowly than California does, covering racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation or sex life, citizenship or immigration status, the processing of genetic or biometric data for the purpose of uniquely identifying a person, personal data collected from a known child, and precise geolocation data. We do not collect any data within those categories, and we do not request opt-in consent for sensitive data under these laws because none of our processing falls within their scope. (As disclosed under "California Privacy Rights" above, California's broader definition of "sensitive personal information" does include the contents of private user-to-user communications and account login credentials; those categories are addressed in that section and not here.) If we ever begin processing data within the narrower categories listed above, we will request your opt-in consent in advance.
Profiling: Some state laws give residents the right to opt out of profiling that produces legal or similarly significant effects. As explained under "Personalized Content Ranking" above, our content ranking system does not make any decision that produces such effects — it determines only the order in which posts appear in your feed.
Exercising Your Rights: To exercise any of the rights described in this section, contact us at [email protected]. We respond within 45 days — which we may extend by an additional 45 days where reasonably necessary and permitted by the applicable state law, with notice to you within the first 45 days — or sooner where that law requires. Identity verification and authorized-agent requirements are described under "Your Rights and Choices" above.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):
Legal Bases for Processing (GDPR/UK GDPR Article 6): We rely on the following legal bases, by purpose:
Where we rely on legitimate interests, we do so only where those interests are not overridden by your interests, rights, and freedoms, and you can object to that processing at any time by contacting us at [email protected] (see "Right to Object" below).
To exercise any of these rights, contact us at [email protected]. We respond within one month, a period we may extend by up to two further months where necessary, taking into account the complexity and number of requests, as permitted by GDPR Article 12(3); we will inform you of any such extension, and the reasons for it, within one month of receiving your request. Identity verification is described under "Your Rights and Choices" above.
If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority. A directory of EEA supervisory authorities is maintained by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK residents may contact the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch/.
Your information may be transferred to and processed in countries other than your country of residence — primarily the United States, where Spritz and several of our service providers operate. These countries may have data protection laws that differ from the laws of your country.
For users in the European Economic Area, the United Kingdom, or Switzerland: Spritz is based in the United States, and your personal data is processed there. When you provide information to us directly through the Service, we collect it as a U.S.-based controller and apply the GDPR and UK GDPR directly to that processing, relying on the legal bases described above and honoring your rights. When we make your data available to our service providers and other recipients outside the EEA, the United Kingdom, or Switzerland, we rely on the following safeguards:
We may update this Privacy Policy from time to time. When we make material changes, we will take reasonable steps to notify you — through the Service or by other means such as email — and, where required by applicable law or otherwise appropriate, before the change takes effect.
We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: [email protected]
Postal mail: available on request — email [email protected] and we will provide our current mailing address.
We are committed to resolving any concerns you may have about our collection and use of your personal information.
Effective Date: October 13, 2026
Last Updated: October 12, 2026
Version: 1.0
This Privacy Policy applies to Spritz Social on all platforms: iOS, Android, macOS, and Web.