Privacy Notice

FrightSpot LLC ("FrightSpot", "we", "us") operates the FrightSpot website and directory. FrightSpot LLC is the data controller for the personal data described in this notice — we decide why and how it is processed.

Personal data we collect

• Account data — email address, login credentials managed by our authentication provider, and your age attestation (an 18+ confirmation and its timestamp) if you join FrightPack.
• Profile data — display name, username, avatar, social handles, and the optional horror survey answers you choose to add to your Fright Card.
• Listing and submission data — the listing details you submit plus your contact name and contact email.
• Community activity — RSVPs, saved events, ratings, comments, reports, and blocks.
• Location data — the city or approximate location you enter, or your device location if you tap "Use my location" and grant permission.
• Technical and usage data — IP address, device and browser identifiers, pages viewed, and error logs.
• Support messages — anything you send us by email.

Payment card details are collected and processed by Stripe, not by us. We never see or store your full card number.

Why we use it, and our legal basis

• Creating and running your account, and providing FrightPack features — performance of our contract with you.
• Publishing, reviewing, and moderating listings and community content — performance of our contract and our legitimate interest in a safe, accurate directory.
• Showing nearby haunts and events — your consent (device location) or legitimate interest (city you type in).
• Security, fraud prevention, and abuse handling — legitimate interest and legal obligation.
• Improving the product, diagnosing errors, and measuring usage — legitimate interest.
• Customer support and service emails — performance of our contract.
• Marketing emails, if you opt in — your consent, withdrawable at any time.

Who we share it with

• Service providers / subprocessors — hosting, database, authentication, file storage, mapping and geocoding, and error-monitoring providers acting on our instructions.
• Stripe, our Merchant of Record, for the sale of Featured Listings, payment processing, tax compliance, invoicing, and refunds.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law or to protect our rights or the safety of others.

Some information is public by design: approved listings and the profile details you choose to make public on your Fright Card. RSVPs are private unless you set them to public. We do not sell your personal data.

International transfers

We are based in the United States and our providers may process data in the US and other countries. Where data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Retention

We keep account and profile data for as long as your account is active, and delete or anonymise it within a reasonable period after you close it. Published listings may remain (with contact details removed) as part of the directory's historical record. Transaction and tax records are kept as long as the law requires. Technical logs are kept for a short period for security and debugging.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interests, to withdraw consent, and to opt out of marketing. UK/EEA residents may also complain to their local supervisory authority; California residents may exercise rights under the CCPA/CPRA without discrimination. Email hello@frightspot.com and we'll respond within one month.

Security

We use appropriate technical and organisational measures — encryption in transit, row-level access controls on our database, and restricted administrative access — to protect your data. No system is perfectly secure, but we take these obligations seriously.

Cookies and local storage

We use essential cookies and browser storage to keep you signed in and remember your search preferences. We may use limited analytics to understand aggregate usage. You can clear or block cookies in your browser settings, though the site may not work correctly without the essential ones. Stripe sets its own cookies during checkout.

Children

FrightSpot is not directed at children under 13, and FrightPack membership requires you to be 18 or older. If you believe a child has provided us personal data, contact us and we will delete it.

Contact

FrightSpot LLC — hello@frightspot.com. If this notice changes, we'll update the date at the top of this page.