Privacy Policy

1. Scope and contact

This Privacy Policy applies to Slap at onslap.com and related Slap applications. In this Policy, “Slap,” “we,” “us,” and “our” mean the operator of the Slap service. For privacy questions, requests, or appeals, email team@onslap.com.

2. Data we collect

• Account and profile data, such as Clerk account ID, phone number or email used to sign in, name, handle, avatar, city, selected discovery area, preferences, and account settings.
• Vendor application data, including contact information, business name and type, category, operating area, business status, adult and compliance attestations, profile and social links, responses, optional supporting-document links, application state, and Slap review notes.
• Vendor and community content, including Rooms, Posts, titles, descriptions, media, external links, schedules, price or quantity text, sold-out status, reviews, ratings, photos, captions, reports, and moderation records.
• Location data, including an entered address, area, city, or ZIP; a device location when permission is granted; and exact or approximate Post locations. Private Vendor coordinates may be stored for radius matching even when only a neighborhood, generalized point, or distance band is public.
• Activity and communications, including follows, reminders, notification choices, push subscription endpoint and keys, page views, searches, Post views, CTA clicks, shares, reports, support messages, email delivery status, and changes or cancellations sent to you.
• Device, cookie, and diagnostic data, such as IP-derived general area, browser and device details, identifiers, referring page, performance data, error information, cookies, local storage, and session-replay data described below.

3. Sources of data

We receive data from you; your browser, device, and interactions; Vendors and other users; authentication, hosting, analytics, mapping, media, email, and notification providers; and approved public business sources or Vendor-owned public pages. Slap does not use private-group content to create public listings.

4. How we use data

• Authenticate accounts, maintain profiles and settings, review Vendor applications, and provide Vendor Studio.
• Publish and organize Rooms and Posts; calculate nearby results; show schedules; deliver reminders, changes, cancellations, and requested first-Post alerts.
• Measure real engagement, rank discovery results, count outbound actions, prevent fake activity, moderate content, investigate reports, and enforce policies.
• Host, process, transcode, and display images and video; generate video posters; support external media and social links.
• Provide support, secure the service, diagnose errors, prevent fraud, comply with law, and maintain audit evidence.
• Analyze product use and improve Slap. Phase 1 does not use personal data for third-party targeted advertising and Slap does not sell personal data.

5. Location and sensitive data

Precise location may be sensitive personal data. Slap requests device permission before using device location. You may deny or revoke that permission and use an entered area instead. Providing a saved discovery address or exact Vendor location is optional unless needed for a Post you choose to publish.

For an approximate Post, Slap may use the private exact point to determine whether the Post is within a selected radius, but public pages and APIs are designed to return only the generalized location and a distance band. A Vendor’s exact location is public only when the Vendor chooses exact public location. Slap does not use acceptance of general Terms as consent to optional device location.

6. Public information and unclaimed Vendor profiles

Vendor profile fields, selected social and contact links, public Post content, chosen exact or approximate locations, schedules, sold-out and ended history, ratings, and public engagement may be visible to anyone and may appear in search results or shared links. Do not publish information that should remain private.

Slap may create a clearly labeled unclaimed public Vendor profile using reviewed public business sources. That profile is assembled by Slap, not Vendor-authored. A business may request correction, removal, or ownership review at team@onslap.com. Slap may retain nonpublic provenance and audit records after public display changes.

7. Providers and disclosures

Slap discloses personal data to vendors that process it for authentication, hosting, database and file storage, mapping and geocoding, analytics, media processing, email, browser push, security, support, and legal compliance. Depending on enabled features, these providers include Clerk, Vercel, Neon, Mapbox, PostHog, Mux, Resend, and browser push services. They receive data reasonably needed for their service and are subject to their own terms and Slap’s applicable contracts.

We may also disclose data when you direct us to, to complete an external action, to protect users or rights, to respond to valid legal process, or as part of a merger, financing, reorganization, or sale subject to appropriate safeguards. Phase 1 external transactions are handled by the Vendor or destination service, not Slap.

8. Analytics, cookies, and session replay

In production, Slap may use PostHog and Vercel Analytics to collect page and interaction events, performance data, and persistent identifiers stored in cookies and local storage. When signed in, Slap may associate analytics with an account identifier and account attributes such as email, name, and creation date.

Slap may use session replay to diagnose and improve the service. Form inputs are configured to be masked, and designated page text may also be masked. Session replay can still capture page structure, clicks, navigation, and unmasked displayed content, so do not put confidential information into public or unrequested fields. You can block or clear cookies and local storage in browser settings, although some preferences may be lost.

9. Embedded and external media

A specific YouTube or Vimeo video may load in an embedded player. Instagram, TikTok, Facebook, and other social content may appear as a preview or external link. Loading or opening third-party content can disclose your IP address, browser information, referrer, and interaction to that provider, which applies its own privacy policy. You may avoid that disclosure by not loading or opening the content.

When native video upload is enabled, Mux receives the uploaded file and related technical metadata to process playback and a poster image. Failed or replaced uploads may be retained briefly for processing, audit, and retryable deletion.

10. Reminders, email, and browser push

Slap sends a reminder only after you request it or enable the related alert. Default Post reminders may be sent about 24 hours before, one hour before, and immediately after a meaningful time or location change or cancellation. First-Post alerts may use browser push and email fallback. Browser push permission is requested separately after a reminder request.

You can remove a reminder, disable browser notifications, delete a push subscription, or change notification settings. Operational messages about your account, application, security, or requested reminders are not marketing subscriptions. If Slap later offers promotional email, it will provide the legally required identification and opt-out controls.

11. Retention and account deletion

We retain data for as long as reasonably necessary for the purposes described here, including while an account, application, Room, Post, reminder, or report is active, and for security, fraud prevention, dispute resolution, legal compliance, backup, and audit needs. Retention varies by data type and provider. We limit or delete data when it is no longer reasonably needed.

You may delete your consumer account through the account-deletion page. Account deletion removes the personal account and account-linked consumer activity from the active experience, subject to limited legal, security, backup, and fraud-prevention retention. Public business records are separate. If the account owns a Vendor, its application relationship is removed and its Vendor-authored Posts are no longer eligible for the public collective feed, but business records, Posts, media, and moderation evidence may remain while Slap reviews removal, transfer, legal, or integrity needs. Contact team@onslap.com to request removal or export of specific Vendor data.

12. Your privacy rights

Depending on where you live and applicable exemptions, you may have rights to confirm whether Slap processes your personal data; access or obtain a portable copy; correct inaccuracies; delete personal data; opt out of sale, third-party targeted advertising, or certain legally significant profiling; withdraw consent where processing relies on consent; and appeal a denied request. Slap does not discriminate against you for exercising an applicable right.

Submit a request or appeal to team@onslap.com from the address associated with your account when possible. Describe the right and data involved; use “Privacy appeal” for an appeal. We may verify identity and authority before responding. Where required, we respond within 45 days, subject to a lawful extension, and explain a denial and appeal route. Slap operates exclusively online and uses this email as its privacy-request method.

13. Children

Slap is not directed to children under 13, and children under 13 may not create accounts. We do not knowingly process a child’s personal data without legally required parental consent. If you believe a child under 13 supplied personal data, contact team@onslap.com.

14. Security and incidents

Slap uses administrative, technical, and organizational safeguards designed for the nature of the data. No service is completely secure. Keep your sign-in method protected and report suspected account misuse. Slap will investigate security incidents and provide notices when required by law.

15. Changes to this Policy

We will post an updated Policy with a new effective date. We may provide additional notice when a change materially affects how personal data is processed and will request specific consent when required. Prior versions will be retained as part of Slap’s legal records.

16. Future commerce and live services

Native ordering, payment processing, tax calculation, seller payouts, QR pickup, live broadcasting, chat, tips, rewards, and replay publication are disabled in Phase 1. Before any such feature is activated, Slap will update this Policy and provide the applicable commerce, payment, seller, live, and recording notices or consents. Mentioning those future services here does not activate them.