Privacy Policy

This Privacy Policy describes how GrindSpot (“we,” “us,” or “our”), operated by Leonel Flores Ruiz (based in Guadalajara, Jalisco, Mexico), collects, uses, and discloses your personal information when you use our web application located at grind-spot.com (the “Service”).

We are committed to complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) for European Union users, the California Consumer Privacy Act (CCPA) for California residents, and Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

1. Information We Collect

1.1 Personal Information You Provide Directly

When you sign in to GrindSpot using Google OAuth, we collect:

• Full Name
• Email Address
• Google Profile Picture URL

1.2 Automatically Collected Information

When you access the Service, our infrastructure (e.g., Railway, CDN/Edge services) and analytics tools may collect non-direct identifiers:

• Technical Log Data: IP address (processed temporarily for server security, routing, and traffic management), browser type, operating system, and device information.
• Usage Data: Pages visited, interaction data (such as spots liked or requested), and referral sources.

1.3 Payment Information

Payments are handled entirely by Stripe. We do not collect, store, or process your credit card numbers or banking details. Stripe provides us only with confirmation of payment completion and basic transactional metadata.

2. How We Use Your Information

We process your data for the following lawful purposes:

• Account Creation and Authentication: To verify your identity via Google OAuth and grant access to lifetime features.
• Service Operation: To allow you to interact with the app (e.g., saving preferences, liking spots, requesting new spots).
• Customer Support & Communication: To process refund requests, send transaction receipts, or respond to legal and support inquiries.
• Analytics & Improvements: To understand platform usage and optimize performance using privacy-focused analytics tools (Datafast).
• Security & Fraud Prevention: To protect our platform from abuse or unauthorized activity.

3. Third-Party Service Providers

We share data with trusted third-party service providers necessary to operate the Service:

Note: All service providers are bound by strict confidentiality and data protection obligations.

4. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence (including the United States and Mexico), where data protection laws may differ. We take necessary steps to ensure that adequate safeguards are in place to protect your data.

5. Your Rights & Data Choices

Depending on your jurisdiction (e.g., GDPR, CCPA, ARCO rights under Mexican law), you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Deletion (Right to be Forgotten): Request the deletion of your personal account and associated data.
• Objection & Restriction: Request that we restrict or stop processing your data.
• Data Portability: Request your personal data in a structured, machine-readable format.
• Non-Discrimination: (CCPA) We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please email us at leonelfr212@gmail.com. We will respond within 30 days.

6. Data Retention

We retain your personal data (Name, Email, Profile Picture, and purchase history) for as long as your account remains active or as needed to maintain your lifetime access privileges, fulfill legal requirements, or resolve disputes. You may request account deletion at any time.

7. Security

We take reasonable technical and organizational measures to protect your personal data against loss, theft, misuse, and unauthorized access. However, no internet transmission or electronic storage method is 100% secure.

8. Children’s Privacy

GrindSpot is not intended for children under the age of 16 (or 13 in the United States). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately for deletion.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or ARCO/GDPR/CCPA compliance, please contact:

• Data Controller: Leonel Flores Ruiz
• Address: Guadalajara, Jalisco, Mexico
• Email: leonelfr212@gmail.com