Privacy Policy

Instant Spa may collect personal information including name, phone number, email address, location, payment information, and booking details when users register or use the platform.

The information collected may be used to facilitate bookings between customers and service providers, process payments, improve platform services and user experience, and communicate booking confirmations, updates, or customer support messages.

Instant Spa may share necessary user information with service providers solely for the purpose of delivering booked services. We do not sell or rent personal data to third parties.

Instant Spa takes reasonable security measures to protect personal information from unauthorized access, misuse, or disclosure.

During provider verification, Instant Spa uses the device's standard front camera to perform a live identity check. Camera frames are analyzed on the device to confirm that one face is present, assess face position and size, measure head-turn direction, and check image brightness and completion timing.

Instant Spa does not use Apple TrueDepth depth information, access Face ID enrollment data, or create a faceprint, facial template, facial geometry model, or persistent facial identifier. Temporary camera frames used during these checks are not uploaded or retained.

After the check is completed, Instant Spa collects one ordinary RGB live-selfie image and limited liveness evidence consisting of completed check steps, head-turn values, brightness values, and timestamps. This information is used only to verify that a provider applicant is a live person, support manual comparison with the applicant's identity document, protect customers and providers, prevent fraud, and meet compliance obligations. It is not used for advertising, marketing, analytics, tracking, or facial recognition.

The live selfie is stored in private Firebase Cloud Storage. Its private storage reference and liveness evidence are stored in Instant Spa's access-controlled database hosted on DigitalOcean. Google ML Kit performs face detection locally on the device. Google Firebase and DigitalOcean process stored information only as infrastructure providers acting on our behalf.

Access is restricted to authorized Instant Spa verification administrators through time-limited links. We do not sell this information or share it with advertisers or data brokers. It may be disclosed only where required by law.

We retain the live selfie and liveness evidence while the provider account is active and only for as long as reasonably necessary for identity verification, safety, fraud prevention, dispute handling, or legal and compliance requirements. Providers may request deletion through Profile > Delete Account or by contacting support@instantspa.io. We delete or de-identify the information within a reasonable processing period unless retention is required by law or for an unresolved fraud, safety, payment, or dispute matter. Backup copies expire through normal retention cycles.

Users may request access, correction, or deletion of their personal data where permitted by applicable law.

Users can delete their account in the Instant Spa app from Profile > Delete Account, or request deletion through our account deletion page.

Instant Spa retains account information for as long as a user account remains active or as needed to provide bookings, payments, customer support, safety, fraud-prevention, and platform operations.

When a user deletes an account or submits a verified deletion request, Instant Spa deletes or anonymizes personal profile information within a reasonable processing period, unless retention is required for legal, tax, payment, refund, dispute, safety, fraud-prevention, or compliance obligations.

Booking, transaction, dispute, support, and compliance records may be retained for the period required by applicable law or legitimate business-record requirements. Operational logs, backup copies, and security records are removed or anonymized through normal retention cycles when they are no longer required.

Instant Spa reserves the right to update this Privacy Policy at any time. Continued use of the platform after updates constitutes acceptance of the revised policy.