This policy explains how Spotime collects, uses, and protects your personal data. / 本政策說明 Spotime 如何蒐集、使用及保護您的個人資料。
Last Updated / 最後更新日期：June 29, 2026 / 2026 年 6 月 29 日
This Privacy Policy applies to all services provided by Spotime (the "Platform"), including our mobile application (App) and website. The Platform is operated and maintained by the Spotime team ("we", "us", or "our"). By using the Platform, you consent to the data collection and usage practices described in this Policy.
To provide and improve our services, we may collect the following types of data:
• Account Data: Display name, email address, phone number, and other information you provide during registration or profile editing.
• Booking Data: Booking history and preferences that help merchants manage their own schedules and communication with you.
• Location Data: With your permission, we may collect approximate geolocation data (only while using the App) to suggest suitable time slots or nearby options offered by the merchant you are booking with.
• Device Data: Device model, operating system version, App version, and push notification identifiers.
• Usage Data: Browsing, searching, and click behavior on the Platform.
• Transaction Data: Billing information, purchase history, subscription status, and payment-related records for payments you make to Spotime for merchant subscription plans. Spotime does not collect or store your full payment card numbers; card details are entered on the secure hosted checkout page of our payment provider, FunPoint.
• Communication Data: Messages you exchange with merchants or with our support team through the Platform's chat, including any images or files you share. To maintain safety and service quality, authorized Spotime personnel may access and review these messages (for example, to handle reports, resolve disputes, or moderate content); such access is recorded in an audit log.
We use the collected data for the following purposes:
• Providing, maintaining, and improving the Platform's services.
• Processing and managing your bookings, your merchant subscriptions, and your account.
• Helping merchants you book with provide suitable time slots and service options based on your preferences.
• Sending necessary communications such as booking confirmations, reminders, and system notifications.
• Processing subscription payments and applicable refunds through our payment provider, FunPoint.
• Providing AI-assisted features (such as the in-app booking assistant and automated chat replies during a merchant's offline hours). For these features, the content of your messages — and, when a merchant uses price-list image recognition, the uploaded image — is sent to our AI provider, Anthropic (Claude), for processing on servers located in the United States.
• Conducting data analysis to improve user experience and service quality.
• Preventing fraud and ensuring platform security.
For users in the European Economic Area (EEA), we process your personal data based on the following legal grounds:
• Contract Performance: Processing necessary to fulfill our contract with you (e.g., managing your account, processing bookings and payments).
• Consent: Processing based on your explicit consent (e.g., location data collection, marketing communications). You may withdraw consent at any time.
• Legitimate Interest: Processing necessary for our legitimate interests (e.g., fraud prevention, service improvement, platform security), provided these interests are not overridden by your rights.
We do not sell your personal data to third parties. We may share your data in the following circumstances:
• Merchants: When you book a service, we share necessary booking information (such as your name and appointment time) with the merchant to facilitate service delivery.
• FunPoint (Payment Provider): Processes payment transactions for merchant subscriptions. Card details are entered on FunPoint's hosted checkout page. FunPoint's handling of your data is governed by its own privacy policy.
• Service Providers: We may engage third-party providers to assist with operations (such as cloud hosting and push notification services). These providers may only use your data within the scope of services they provide to us.
• Legal Requirements: We may disclose data when required by law or to protect the rights of the Platform, users, or the public.
The Platform uses the following third-party services that may collect and process some of your data. Each has its own privacy policy:
• FunPoint: Online credit-card payment processing for merchant subscriptions (Taiwan payment gateway).
• Google Firebase / Google Cloud: Core backend infrastructure — website hosting, database, authentication, file storage, and push notifications.
• Google Analytics: Website usage and conversion analytics.
• PostHog: Product analytics and session replay, used to diagnose usability issues. Recording data is hosted in the EU (see Section 13 for what is and is not captured).
• Algolia: Powers search across merchants, services, and bookings (when enabled).
• Resend: Delivery of transactional emails (such as booking and account notifications).
• Twilio: Delivery of SMS verification codes and notifications.
• Pusher: Real-time delivery of chat messages between you and merchants or support.
• Sentry: Error and crash monitoring to detect and fix technical problems.
• Anthropic (Claude): AI-assisted features (booking assistant, offline chat auto-reply, and merchant shop-setup assistant). Message content — and, for price-list recognition, uploaded images — is processed on servers located in the United States.
• Cloudflare Turnstile: Anti-bot verification for guest bookings.
• Google Maps: Map display and address selection.
• Google Sign-In and LINE Login: Third-party account login.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, use, or disclosure. Payment card data is never stored on our servers — card details are entered on the secure hosted checkout page of our payment provider, FunPoint. However, no method of internet transmission or electronic storage is completely secure, and we continuously work to enhance data protection.
We retain your personal data for as long as reasonably necessary to provide our services. After you request account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
Your data may be transferred to and stored on servers located outside your country of residence — for example, Google Cloud Platform data centers in the United States; PostHog session-replay data in the European Union; and AI processing by Anthropic in the United States. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards to protect your data.
If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:
• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data ("right to be forgotten").
• Right to Data Portability: You may request a machine-readable copy of your data to transfer to another service.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances.
• Right to Object: You may object to the processing of your data based on legitimate interests or for direct marketing purposes.
• Right to Lodge a Complaint: You may file a complaint with your local data protection authority.
To exercise any of these rights, please contact us at service@spotime.ai.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purpose, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: You may opt out of the sale of your personal information. Note: We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
To exercise any of these rights, please contact us at service@spotime.ai.
Pursuant to Article 8 of the Personal Data Protection Act (PDPA) of Taiwan, when you make a booking or create an account on the Platform, we notify you of the following regarding our collection of your personal data:
• Data Collector: The Spotime team (operator of the Platform).
• Purpose of Collection: Booking facilitation and management, contact and identity verification, customer service, transaction and billing processing, platform security, and service improvement.
• Categories of Personal Data: Name, phone number, email address, booking records, and related data generated through your use of the services.
• Period of Use: Until you delete your account, the Platform ceases operation, or any retention period required by law expires.
• Territory of Use: The regions where the Platform and its cloud services operate (which may include locations outside Taiwan; see Section 9, Cross-Border Data Transfers).
• Recipients of Use: The Platform, the merchants you book with, and service providers that support the Platform's operation (see Sections 5 and 6). The services you book are provided by the merchant; we share the personal data necessary to fulfill the service — such as your name, phone number, appointment time, and, for on-site services, your address — with that merchant.
• Method of Use: Processed and used by automated or non-automated means within the scope necessary for the purposes above.
Under Article 3 of the PDPA, you may exercise the following rights regarding your personal data, which may not be waived in advance or restricted by contract: (1) inquire about or review it; (2) request a copy; (3) request supplementation or correction; (4) request that we cease collecting, processing, or using it; (5) request its deletion.
Consequence of Non-Provision: If you do not provide the personal data necessary for a booking (such as your name and phone number), you will not be able to complete the booking or receive the service.
How to Exercise Your Rights: You may view and correct your personal data anytime under "Settings" in the App, or request account deletion under "Settings" > "Account Management" (we process within 30 days; after deletion your personal data is deleted or anonymized). You may also withdraw location or notification consent in your device settings. To exercise any of these rights or for any questions, email service@spotime.ai.
Our website may use cookies and similar technologies to improve browsing experience and analyze usage patterns. You may manage or disable cookies through your browser settings.
To diagnose usability problems we may record session replays of how pages are used. Text you type into form fields is masked and is not captured; however, information already displayed on a page may appear in a recording. Merchant back-office sessions may be recorded in full, consumer sessions are only sampled, and administrator sessions are never recorded. Recording data is hosted in the EU.
Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us and we will promptly delete the information.
We reserve the right to modify this Privacy Policy at any time. Updated policies will be published on this page with a revised "Last Updated" date. For significant changes, we will notify you through the App or by email.
If you have any questions or suggestions regarding this Privacy Policy, please contact us at:
• Email: service@spotime.ai
本隱私權政策適用於 Spotime（以下簡稱「本平台」）所提供的所有服務，包含行動應用程式（App）及網站。本平台由 Spotime 團隊（以下簡稱「我們」）營運與維護。當你使用本平台的服務時，即表示你同意本政策所述之資料蒐集與使用方式。
為了提供及改善服務，本平台可能蒐集以下類型的資料：
• 帳號資料：包括顯示名稱、電子郵件地址、電話號碼等你在註冊或編輯個人資料時提供的資訊。
• 預約資料：包括你的預約紀錄與偏好，用於協助商家管理自己的時段安排與與你之間的溝通紀錄。
• 位置資料：經你授權後，我們可能蒐集你的概略地理位置資訊（僅在使用 App 期間），用於協助顯示合適的時段或你預約之商家提供的位置資訊。
• 裝置資料：包括裝置型號、作業系統版本、App 版本、推播通知相關技術識別碼等技術資訊。
• 使用紀錄：包括你在平台上的瀏覽、搜尋、點擊等操作行為。
• 交易資料：你向 Spotime 支付「商家訂閱方案」時所產生的帳單資訊、購買紀錄、訂閱狀態及付款相關紀錄。注意：Spotime 不會蒐集或儲存你的完整付款卡號；付款卡片資料於我們的金流服務商 FunPoint 的安全代管結帳頁面輸入。
• 通訊內容：你透過本平台聊天功能與商家或客服往來的訊息，包括你分享的圖片或檔案。為維護安全與服務品質，Spotime 之授權人員可能存取並檢視這些訊息（例如處理檢舉、解決爭議或內容審核）；上述存取會記錄於稽核日誌。
我們蒐集的資料將用於以下目的：
• 提供、維護及改善本平台的各項服務。
• 處理及管理你的預約、商家訂閱與帳號。
• 協助你所預約的商家，根據你的偏好與位置提供合適的時段與服務選項。
• 發送預約確認、提醒、系統通知等必要訊息。
• 透過付款服務商 FunPoint 處理你向 Spotime 支付的訂閱費用與相關退款。
• 提供 AI 輔助功能（例如站內 AI 預約助理、商家離線時段的聊天自動回覆）。使用這些功能時，你的訊息內容——以及當商家使用價目表圖片辨識時所上傳的圖片——會傳送至我們的 AI 服務商 Anthropic（Claude），於位於美國的伺服器處理。
• 進行數據分析以改善使用者體驗與服務品質。
• 預防詐欺及確保平台安全。
對於歐洲經濟區（EEA）的使用者，我們基於以下法律依據處理你的個人資料：
• 合約履行：為履行我們與你之間的合約所必要的處理（例如：管理你的帳號、處理預約與付款）。
• 同意：基於你明確同意的處理（例如：位置資料蒐集、行銷通訊）。你可隨時撤回同意。
• 正當利益：為我們的正當利益所必要的處理（例如：詐欺防範、服務改善、平台安全），前提是這些利益不凌駕於你的權利之上。
本平台不會將你的個人資料出售予第三方。在以下情況下，我們可能分享你的資料：
• 商家：當你向商家預約服務時，我們會將必要的預約資訊（如姓名、預約時段）分享給該商家，以便其提供服務。
• FunPoint（金流服務商）：處理商家訂閱的付款交易。你的付款卡片資料於 FunPoint 的代管結帳頁面輸入。FunPoint 對你資料的處理受其自身隱私政策規範。
• 服務提供商：我們可能委託第三方服務提供商協助營運（如雲端主機、推播通知服務），這些提供商僅能在為我們提供服務的範圍內使用你的資料。
• 法律要求：當法律要求或為保護本平台、使用者或公眾的權益時，我們可能揭露相關資料。
本平台使用以下第三方服務來提供及改善我們的服務，這些服務可能蒐集與處理你的部分資料，且各有其隱私權政策：
• FunPoint：商家訂閱的線上信用卡付款處理（台灣金流閘道）。
• Google Firebase / Google Cloud：核心後端基礎設施——網站託管、資料庫、登入驗證、檔案儲存與推播通知。
• Google Analytics：網站使用情形與轉換分析。
• PostHog：產品分析與「畫面操作重播（session replay）」，用於診斷使用體驗問題；重播資料儲存於歐盟（EU）（擷取與遮蔽範圍詳見第十三節）。
• Algolia：商家、服務與預約的搜尋功能（啟用時）。
• Resend：交易信寄送（如預約與帳號通知）。
• Twilio：簡訊（SMS）驗證碼與通知發送。
• Pusher：你與商家或客服之間聊天訊息的即時推送。
• Sentry：錯誤與崩潰監控，用於偵測與修復技術問題。
• Anthropic（Claude）：AI 輔助功能（預約助理、離線聊天自動回覆、商家上線設定助手）。你的訊息內容——以及價目表辨識時所上傳的圖片——會於位於美國的伺服器處理。
• Cloudflare Turnstile：訪客預約的防機器人驗證。
• Google Maps：地圖顯示與地址選擇。
• Google 登入與 LINE 登入：第三方帳號登入。
我們採取適當的技術與管理措施來保護你的個人資料，防止未經授權的存取、使用或揭露。付款卡片資料絕不會儲存在我們的伺服器上——付款卡片資料於我們的金流服務商 FunPoint 的安全代管結帳頁面輸入。然而，任何網路傳輸與電子儲存都無法保證絕對安全，我們將持續努力提升資料保護水準。
我們將在提供服務所需的合理期間內保存你的個人資料。當你申請刪除帳號後，我們將於 30 日內刪除或去識別化你的個人資料，惟法律要求保留者不在此限。
你的資料可能傳輸至並儲存於你居住國境外的伺服器——例如位於美國的 Google Cloud Platform 資料中心、儲存於歐盟（EU）的 PostHog 重播資料，以及由 Anthropic 於美國進行的 AI 處理。我們將確保該等傳輸符合適用的資料保護法規，並採取適當的安全措施保護你的資料。
如果你位於歐洲經濟區（EEA），你對你的個人資料享有以下權利：
• 存取權：你可以要求取得我們所持有的你的個人資料副本。
• 更正權：你可以要求更正不正確或不完整的個人資料。
• 刪除權：你可以要求刪除你的個人資料（「被遺忘權」）。
• 資料可攜權：你可以要求取得機器可讀格式的資料副本，以便轉移至其他服務。
• 限制處理權：你可以在特定情況下要求我們限制對你資料的處理。
• 反對權：你可以反對基於正當利益或直接行銷目的的資料處理。
• 投訴權：你可以向你所在地的資料保護機關提出投訴。
如需行使上述權利，請透過 service@spotime.ai 與我們聯繫。
如果你是加州居民，根據加州消費者隱私法（CCPA），你享有以下權利：
• 知情權：你可以要求揭露我們蒐集的個人資料類別與具體內容、蒐集來源、商業目的，以及我們共享資料的第三方類別。
• 刪除權：你可以要求刪除我們從你處蒐集的個人資料，但須受特定例外條件限制。
• 退出權：你可以選擇退出個人資料的出售。注意：我們不會出售你的個人資料。
• 不歧視原則：我們不會因你行使 CCPA 權利而對你進行歧視。
如需行使上述權利，請透過 service@spotime.ai 與我們聯繫。
依《個人資料保護法》第 8 條，當你於本平台預約服務或建立帳號時，我們向你告知下列蒐集個人資料之事項：
• 蒐集者：Spotime 團隊（本平台營運者）。
• 蒐集目的：預約媒合與管理、聯繫與身分確認、客戶服務、交易與帳務處理、平台安全維護及服務改善。
• 個人資料類別：姓名、電話號碼、電子郵件、預約紀錄，以及你使用服務所生之相關資料。
• 利用期間：至你刪除帳號、本平台停止營運，或相關法令所定之保存期間屆滿為止。
• 利用地區：本平台營運及其雲端服務所在之地區（可能包含我國境外，詳見第九節跨境資料傳輸）。
• 利用對象：本平台、你所預約之合作商家，以及協助本平台營運之服務提供商（詳見第五、六節）。你所預約之服務由合作商家提供，我們會將完成服務所必要之個人資料——例如姓名、電話、預約時段，及到府服務之地址——提供予該商家。
• 利用方式：以自動化或非自動化方式，於前述蒐集目的之必要範圍內處理及利用。
依個資法第 3 條，你就你的個人資料得行使下列權利，且不得預先拋棄或以特約限制：(一) 查詢或請求閱覽；(二) 請求製給複製本；(三) 請求補充或更正；(四) 請求停止蒐集、處理或利用；(五) 請求刪除。
不提供個人資料之影響：若你不提供預約所必要之個人資料（如姓名、電話），將無法完成預約或接受服務。
行使權利方式：你可隨時於 App「設定」查閱與更正個人資料，或於「設定」>「帳號管理」申請刪除帳號（我們將於 30 日內完成處理，刪除後個人資料將被刪除或去識別化）；你亦可於裝置設定關閉位置或通知權限以撤回該等同意。如需行使上述任一權利或有任何疑問，請來信 service@spotime.ai。
本平台的網站可能使用 Cookie 及類似技術來改善瀏覽體驗與分析使用狀況。你可以透過瀏覽器設定管理或停用 Cookie。
為診斷使用體驗問題，我們可能會記錄「畫面操作重播（session replay）」。你於表單欄位輸入的文字會被遮蔽、不會被擷取；但頁面上已顯示的資訊仍可能出現在重播中。商家後台的操作可能全程錄製，消費者僅取樣錄製，管理者的操作則一律不錄製。重播資料儲存於歐盟（EU）。
本平台的服務不針對未滿 16 歲的兒童。我們不會在知情的情況下蒐集未滿 16 歲兒童的個人資料。如果你發現有未滿 16 歲的兒童提供了個人資料，請聯絡我們，我們將立即刪除相關資料。
本平台保留隨時修訂本隱私權政策的權利。修訂後的政策將公布於本頁面，並更新「最後更新日期」。重大變更時，我們會透過 App 通知或 Email 通知你。
如果你對本隱私權政策有任何疑問或建議，歡迎透過以下方式聯繫我們：
• 電子郵件：service@spotime.ai
