Privacy Policy

1. Scope and contact

This Privacy Policy applies to Slap at onslap.com and related Slap applications. In this Policy, “Slap,” “we,” “us,” and “our” mean the operator of the Slap service. For privacy questions, requests, or appeals, email team@onslap.com.

2. Data we collect

• Account and profile data, such as Clerk account ID, phone number or email used to sign in, name, handle, avatar, city, selected discovery area, preferences, and account settings.
• Vendor application data, including contact information, business name and type, category, operating area, business status, adult and compliance attestations, profile and social links, responses, optional supporting-document links, application state, and Slap review notes.
• Vendor and community content, including Storefronts, Posts, titles, descriptions, media, external links, schedules, price or quantity text, sold-out status, reviews, ratings, photos, captions, reports, and moderation records.
• Location data, including an entered address, area, city, or ZIP; a device location when permission is granted; and exact or approximate Post locations. A Vendor who turns on Live GPS in the native app sends current device positions while serving, including in the background. Slap stores the latest accepted public point and a private home or preparation exclusion area, not a public route history. Private Vendor coordinates may also be stored for radius matching when only a generalized location is public.
• Activity and communications, including follows, reminders, notification choices, push subscription endpoint and keys, page views, searches, Post views, CTA clicks, shares, reports, support messages, email delivery status, and changes or cancellations sent to you.
• Device, cookie, and diagnostic data, such as IP-derived general area, browser and device details, identifiers, referring page, performance data, error information, cookies, local storage, and session-replay data described below.

3. Sources of data

We receive data from you; your browser, device, and interactions; Vendors and other users; authentication, hosting, analytics, mapping, media, email, and notification providers; and public business information supplied or linked by applicants for application review. Application research does not create an unclaimed public listing.

4. How we use data

• Authenticate accounts, maintain profiles and settings, review Vendor applications, and provide Vendor Studio.
• Publish and organize Storefronts and Posts; calculate nearby results; show schedules; deliver reminders, changes, cancellations, and requested first-Post alerts.
• Measure real engagement, rank discovery results, count outbound actions, prevent fake activity, moderate content, investigate reports, and enforce policies.
• Host, process, transcode, and display images and video; generate video posters; support external media and social links.
• Provide support, secure the service, diagnose errors, prevent fraud, comply with law, and maintain audit evidence.
• Analyze product use and improve Slap. Slap does not use personal data for third-party targeted advertising and Slap does not sell personal data.

5. Location and sensitive data

Precise location may be sensitive personal data. Slap requests device permission before using device location. You may deny or revoke that permission and use an entered area instead. Providing a saved discovery address or exact Vendor location is optional unless needed for a Post you choose to publish.

For an approximate Post, Slap may use the private exact point to determine whether the Post is within a selected radius, but public pages and APIs are designed to return only the generalized location and a distance band. A Vendor’s exact location is public only when the Vendor chooses exact public location. Slap does not use acceptance of general Terms as consent to optional device location.

An eligible adult Vendor may separately turn on Live GPS while serving in a public area. The native app then collects and sends device location even while it runs in the background or the phone is locked. Customers see only a fresh public serving point; Slap suppresses points near the Vendor’s marked private area. An active Drop or Appearance uses its confirmed public location instead. The Vendor can pause or stop sharing, and the session expires with Open now. Device permission can also be revoked in settings.

6. Public Storefronts and content

Vendor profile fields, selected social and contact links, public Post content, chosen exact or approximate locations, schedules, sold-out and ended history, ratings, and public engagement may be visible to anyone and may appear in search results or shared links. Do not publish information that should remain private.

Vendors submit applications and choose to publish their Storefronts after approval and completion of the required information. Staff-assisted drafts remain private until the Vendor completes this process. Slap does not create unclaimed public business listings. Contact team@onslap.com. We may retain private application, safety, legal, and audit records after public content is removed.

7. Providers and disclosures

Slap discloses personal data to vendors that process it for authentication, hosting, database and file storage, mapping and geocoding, analytics, media processing, email, SMS, browser push, security, support, and legal compliance. Depending on enabled features, these providers include Clerk, Vercel, Neon, Mapbox, PostHog, Mux, Resend, Twilio, and browser push services. They receive data reasonably needed for their service and are subject to their own terms and Slap’s applicable contracts. For an optional Vendor handoff SMS, Twilio receives the verified mobile number, a temporary link and code, and delivery or opt-out events.

A Vendor may separately agree to receive one Slap text containing a private Storefront review link and code for each staff-assisted handoff request. Texting is optional; email and QR remain available. Message and data rates may apply. Reply STOP to opt out or HELP for assistance, or contact team@onslap.com. Slap asks again before a replacement handoff text.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

We may also disclose data when you direct us to, to complete an external action, to protect users or rights, to respond to valid legal process, or as part of a merger, financing, reorganization, or sale subject to appropriate safeguards. External transactions are handled by the Vendor or destination service, not Slap.

8. Analytics, cookies, and session replay

Slap uses PostHog to understand visits and selected interactions. The current integration uses temporary in-memory identifiers and removes private account details, raw search text, and sensitive URL information from analytics events. Slap does not send your name or email to PostHog to build an analytics profile. Cookies and local storage used for sign-in or preferences are separate from these analytics settings.

Slap uses privacy-filtered session recordings on public pages to understand navigation and troubleshoot problems. Recordings may show explicitly approved public interface text and public Vendor images, page structure, clicks, scrolling, and device or browser details. Other text, typed inputs, searches, personal locations and account details stay hidden. Unapproved images, video, map canvases and embedded frames are blocked. Private account, vendor, checkout, order, and Admin screens are excluded. Console logs and network request or response content are not recorded. You can manage cookies and local storage in browser settings, although clearing them may sign you out or remove preferences.

9. Embedded and external media

A specific YouTube or Vimeo video may load in an embedded player. Instagram, TikTok, Facebook, and other social content may appear as a preview or external link. Loading or opening third-party content can disclose your IP address, browser information, referrer, and interaction to that provider, which applies its own privacy policy. You may avoid that disclosure by not loading or opening the content.

When native video upload is enabled, Mux receives the uploaded file and related technical metadata to process playback and a poster image. Failed or replaced uploads may be retained briefly for processing, audit, and retryable deletion.

10. Reminders, email, and browser push

Slap sends a reminder only after you request it or enable the related alert. Default Post reminders may be sent about 24 hours before, one hour before, and immediately after a meaningful time or location change or cancellation. First-Post alerts may use browser push and email fallback. Browser push permission is requested separately after a reminder request.

You can remove a reminder, disable browser notifications, delete a push subscription, or change notification settings. Operational messages about your account, application, security, or requested reminders are not marketing subscriptions. If Slap later offers promotional email, it will provide the legally required identification and opt-out controls.

11. Retention and account deletion

We retain data for as long as reasonably necessary for the purposes described here, including while an account, application, Storefront, Post, reminder, or report is active, and for security, fraud prevention, dispute resolution, legal compliance, backup, and audit needs. Retention varies by data type and provider. We limit or delete data when it is no longer reasonably needed.

You may delete your consumer account through the account-deletion page. Account deletion removes the personal account and account-linked consumer activity from the active experience, subject to limited legal, security, backup, and fraud-prevention retention. Public business records are separate. If the account owns a Vendor, its application relationship is removed and its Vendor-authored Posts are no longer eligible for the public collective feed, but business records, Posts, media, and moderation evidence may remain while Slap reviews removal, transfer, legal, or integrity needs. Contact team@onslap.com to request removal or export of specific Vendor data.

12. Your privacy rights

Depending on where you live and applicable exemptions, you may have rights to confirm whether Slap processes your personal data; access or obtain a portable copy; correct inaccuracies; delete personal data; opt out of sale, third-party targeted advertising, or certain legally significant profiling; withdraw consent where processing relies on consent; and appeal a denied request. Slap does not discriminate against you for exercising an applicable right.

Submit a request or appeal to team@onslap.com from the address associated with your account when possible. Describe the right and data involved; use “Privacy appeal” for an appeal. We may verify identity and authority before responding. Where required, we respond within 45 days, subject to a lawful extension, and explain a denial and appeal route. Slap operates exclusively online and uses this email as its privacy-request method.

13. Children

Slap is not directed to children under 13, and children under 13 may not create accounts. We do not knowingly process a child’s personal data without legally required parental consent. If you believe a child under 13 supplied personal data, contact team@onslap.com.

14. Security and incidents

Slap uses administrative, technical, and organizational safeguards designed for the nature of the data. No service is completely secure. Keep your sign-in method protected and report suspected account misuse. Slap will investigate security incidents and provide notices when required by law.

15. Changes to this Policy

We will post an updated Policy with a new effective date. We may provide additional notice when a change materially affects how personal data is processed and will request specific consent when required. Previously published policies will be retained as part of Slap’s legal records.

16. Changes to available services

If Slap introduces ordering, payments, payouts, or other services that change how personal data is handled, we will update this Policy and provide the relevant notices and consent choices before those changes take effect.