Privacy Policy

This Policy is in effect and is being finalized with legal counsel, so wording may change. It describes how 3rdSpace handles personal data today. This is not legal advice. Privacy questions: support@3rdsp.co.

Version: 2026-07 Document date: 2026-05-19 Anchored to product features as of: 2026-05-19

Where this Policy describes product behavior, it is intended to match how the product actually works as of the document date above. If our implementation temporarily diverges, we will correct the implementation or update this Policy.

Table of Contents

• 1. Introduction and Scope
• 2. Who We Are and How to Contact Us
• 3. Definitions
• 4. Applicability, US-Only Launch, and Future Expansion
• 5. Roles: 3rdSpace, Hosts, and You
• 6. Categories of Personal Information We Collect
• 6A. Bank Account Information (ACH)
• 6B. Business Identity Information for a Location
• 6C. Consumer App Waitlist
• 6D. Identity Information for Host Payment Processing (Stripe Connect)
• 6E. Your Calendar on 3rdSpace
• 6F. Reviews
• 6G. What We Collect About 3rdSpace Account Holders, and Why
• 7. Sources of Personal Information
• 8. How We Use Personal Information and Our Purposes
• 9. Legal Bases for Processing (Where Applicable)
• 10. Auto-CRM-Entry and Dual CRM Architecture
• 11. Marketing Communications and Consent
• 12. AI Booster and Third-Party AI Processing
• 12A. Improving 3rdSpace: Models, Recommendations and Advertising
• 12B. The Learning Engine: Our Own Models, Experiments, Ads and Offers
• 12C. Choices You Turn On Yourself
• 13. How We Share Personal Information
• 14. Service Providers and Sub-Processors
• 15. International Data Transfers
• 16. Data Retention Schedules
• 17. Security Measures and Limitations
• 18. Data Breach Notification
• 19. Your Privacy Rights and How to Exercise Them
• 20. Data Export (Portability)
• 21. Account and Data Deletion; 30-Day Grace Period
• 22. Cookies and Similar Technologies
• 23. Children's Privacy
• 24. Automated Decision-Making and Profiling
• 25. Host Responsibilities Toward Their Customers
• 26. Changes to This Privacy Policy
• 27. Dispute Resolution and Governing Law (Privacy-Specific)
• 28. California Privacy Rights (CCPA / CPRA Addendum)
• 29. Colorado Privacy Act Addendum (Placeholder)
• 30. Virginia Consumer Data Protection Act Addendum (Placeholder)
• 31. Other US State Privacy Laws (Placeholder)
• Appendix A — Personal Information Category Matrix
• Appendix B — Tool-by-Tool Data Flow Summary
• Appendix C — Service Provider / Sub-Processor Register
• Appendix D — Retention Schedule (Detailed)
• Appendix E — Security Control Summary
• Appendix F — Frequently Asked Questions
• Appendix G — California Notice at Collection (Detailed Table)
• Appendix H — Host Controller Obligations Checklist
• Appendix I — 3rdSpace Internal Processing Activities (ROPA-Style Summary)
• Appendix J — Detailed Rights Request Workflow
• Appendix K — CPRA Sensitive Personal Information Limitation
• Appendix L — Email and SMS Regulatory Cross-Reference
• Appendix M — Extended Tool Privacy Notes

1. Introduction and Scope

This Privacy Policy ("Policy") describes how THE3RDSPACE LLC, a Michigan limited liability company ("3rdSpace," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you interact with our products and services. This Policy applies to:

• The 3rdSpace host platform (the business-facing SaaS application and related APIs) accessible at and around 3rdspacehosts.com and associated subdomains;
• The 3rdSpace user site at 3rdsp.co (games, tickets, bookings, the calendar, Me and the consumer app waitlist). Both sites are one service under one Account, and this Policy applies on both;
• The 3rdSpace marketing website pages on either site;
• Transactional and operational communications we send you (email, SMS, in-app notices);
• The 3rdSpace consumer mobile application and related consumer experiences when they become available (currently planned for a later phase; disclosures herein describe intended practices so the Policy remains accurate as those surfaces launch);
• Internal administration and support activities conducted by 3rdSpace personnel on behalf of users and host organizations.

This Policy does not govern websites, applications, or services operated by host organizations (venues, brands, and businesses using 3rdSpace) except where we process personal information on their behalf as described in Section 5. Hosts maintain their own customer relationships and are responsible for their own privacy notices and compliance obligations toward their customers.

By creating a 3rdSpace account, using the platform, or otherwise interacting with us, you acknowledge that you have read this Policy. Where separate consent is required by law (for example, optional marketing communications), we obtain that consent through distinct mechanisms described in Section 11.

2. Who We Are and How to Contact Us

Data controller (for platform account data and 3rdSpace internal CRM):
THE3RDSPACE LLC
[Street address — TBD]
[City, State ZIP — TBD]
United States

Privacy inquiries: support@3rdsp.co

Data protection / legal escalations: support@3rdsp.co

Support (general): support@3rdsp.co

Authorized agent requests (where applicable): We accept requests from authorized agents only where permitted by applicable law and where the agent provides documentation demonstrating authority to act on your behalf. We may require you to verify your identity directly with us.

We will respond to verifiable privacy requests within timeframes required by applicable law. For most US requests, our target is within 45 days, with a permitted extension of up to an additional 45 days where complexity requires it, accompanied by notice of the extension.

3. Definitions

Account means A registered 3rdSpace user identity authenticated through Firebase Auth (email/password or Google single sign-on), associated with a unique user ID (uid), username, and profile fields. AI Booster means An optional, organization-level feature that sends selected host data to third-party large-language-model providers (currently Google Gemini; additional providers such as Anthropic Claude may be added) to generate drafts, summaries, recommendations, and similar assistance inside enabled tools. Aggregated Data means Information derived from personal information that has been de-identified or combined such that it cannot reasonably be used to identify an individual. Audit Log means An append-only record of privileged actions taken within an organization (auditLog) or by 3rdSpace internal administrators (adminAuditLog), retained for security, accountability, and compliance purposes. Brand means A named business identity within a host Organization, which may own one or more Locations. Consumer App means The planned 3rdSpace business-to-consumer mobile application through which end users discover venues, plan visits, attend events, and engage with social features. Contact means A person record stored in a host Organization's customer relationship management (CRM) database, which may or may not be linked to a 3rdSpace Account. Controller means An entity that determines the purposes and means of processing personal information. 3rdSpace is a controller for platform account data and its internal CRM. A Host is typically the controller for CRM data about its customers. Service Charge means the single six percent (6%) charge 3rdSpace applies, charged when Booster Credit is bought rather than when it is used. Credit is then spent at provider cost, or on Email at the published Email Rate with a monthly true up in credit, with no Service Charge added (see Terms of Service Sections 2.34, 11.2 and 22.4). Unified Credit Pool means A single Organization balance (creditsCents plus any included monthly credit the Organization receives) from which metered SMS, Email, and AI usage draw; there are no separate pass-through invoices for these services (Terms of Service Article 11). Customer of a Host means an individual whose personal information appears in a Host's CRM because the Host entered it, imported it, or collected it through 3rdSpace tools (Bookings, ticketing, waivers, lead forms and similar), including through a public page 3rdSpace operates on that Host's behalf. Deactivated Entity means An Organization, Brand, Location, or related record that has been deactivated but not deleted, preserving data while limiting active use. Gemini means Google's generative AI service family used by AI Booster for analytical and drafting workloads, subject to Google's API terms and our contractual restrictions on training use. Host means a business entity that uses the 3rdSpace host platform, including its authorized users (Owners, Admins, Managers, Employees) and its Brands and Locations. Host Channel Marketing means Marketing communications sent by 3rdSpace that reference a Host with whom the recipient has an existing customer relationship, framed to make the consent chain transparent (for example, identifying both 3rdSpace and the Host). Internal CRM means 3rdSpace's own customer database containing a record for every user who creates a 3rdSpace Account, used for product operations, support, analytics, and—where permitted—marketing. Location means A physical or logical place of business within a Brand, often corresponding to a venue, store, or site. Marketing Opt-In means A separate, optional affirmative consent captured at sign-up (not pre-checked) for 3rdSpace to send marketing communications to the user. Material Change means A revision to this Policy that meaningfully alters your rights or our practices regarding collection, use, disclosure, or retention of personal information. Personal Information means Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Processor means An entity that processes personal information on behalf of a controller pursuant to documented instructions. 3rdSpace acts as a processor when handling Host CRM data to provide platform services. Purge means Permanent deletion of personal information from active production systems following any applicable grace period, subject to legal retention exceptions. Sensitive Personal Information means Categories afforded heightened protection under some laws (for example, precise geolocation in certain contexts, government identifiers, financial account numbers). We minimize collection of sensitive categories and apply additional controls where collected. Service Provider means A third party engaged by 3rdSpace to process personal information on our behalf to deliver the platform (for example, Firebase, Stripe, SendGrid, Twilio, Sentry, Gemini). Soft Delete means A reversible deletion state during which data is hidden from normal use but recoverable for a defined grace period before Purge. Sub-Processor means A service provider engaged by our primary service providers; we maintain awareness of sub-processors in our vendor chain. Unified Credit Pool means See Credit Pool. User means Any individual with a 3rdSpace Account, including Host personnel and future Consumer App users. UTM Parameters means Marketing attribution tags appended to URLs (for example, utm_source, utm_campaign) captured when present at sign-up or in tracked links. Webhook means An automated HTTP callback from a third-party service (Stripe, Twilio, SendGrid) to our API endpoints, verified cryptographically before processing.

4. Applicability, US-Only Launch, and Future Expansion

At launch, 3rdSpace offers host onboarding to United States–hosted businesses only, with USD-only billing for the charges it does make (Booster Credit and Added Storage). Our checkout and organization-creation flows gate eligibility by country and billing address. The marketing website states US availability plainly.

We do not presently offer a self-serve onboarding path for foreign-incorporated organizations. Organizations incorporated outside the United States but operating primarily in the United States may be evaluated case-by-case through support; such cases are not guaranteed acceptance.

Implication for international users: If you access our services from outside the United States, you do so with the understanding that the service is designed for US operations and US law is primary. Additional rights may apply depending on your residence; see Sections 28–31.

Future expansion: We may expand to additional countries and currencies after a deliberate compliance review (tax registrations, anti-money-laundering disclosures, data processing agreements, and localized legal text). If we expand, we will update this Policy and may require additional consents before enabling new regions.

5. Roles: 3rdSpace, Hosts, and You

Understanding who controls which data is essential:

5.1 3rdSpace as controller — platform and internal CRM

We act as the controller for:

• Your 3rdSpace Account credentials and profile (username, name, birthday, email, phone, authentication metadata);
• Billing relationship data between you and 3rdSpace (Booster Credit purchases, Added Storage subscriptions, invoices, payment method tokens held by Stripe);
• Bank account information, where you pay by bank debit (ACH). Booster Credit is loaded by debit from a bank account you authorize. See Section 6A for what is collected, who holds it, and why;
• Business identity information for a Location, where a Host chooses to provide it. A Host may record a legal business name, business type, registered address and, optionally, an Employer Identification Number (EIN) for a Location. See Section 6B;
• Records in 3rdSpace's internal CRM, which includes every user who registers on the platform;
• Product analytics and security logs attributable to your use of 3rdSpace-operated surfaces;
• Marketing preferences you express directly to 3rdSpace via the Marketing Opt-In checkbox or subsequent settings.

5.2 Host as controller — host CRM data

When a Host stores information about its customers, leads, affiliates, or staff in the Organization CRM, the Host is the controller for that data. The Host determines what fields to collect, what marketing to send, and what consents to obtain from its customers.

3rdSpace acts as a processor (or service provider, under California law) when we store, organize, transmit, or otherwise process Host CRM data solely to provide the contracted platform features the Host selects.

5.3 You as a Host customer

If you are a Customer of a Host (for example, you made a booking or got a ticket), your primary privacy relationship is with that Host.

This includes pages hosted at a 3rdSpace address. A Host may take bookings or issue tickets on a public page 3rdSpace runs for it, at a 3rdSpace web address (today on 3rdsp.co), showing the Host's business name. The Host decides what is collected on that page and what it is used for; 3rdSpace provides the software and processes the information on the Host's instructions. The page says so where you enter your details. That the page sits at a 3rdSpace address does not make 3rdSpace the party you contracted with, and it does not change who to ask about your information: ask the Host. You may also have a relationship with 3rdSpace if you create your own Account or interact with the Consumer App. Requests to access or delete data held in a Host's CRM should generally be directed to the Host; we provide mechanisms described in Section 19 to route requests appropriately.

5.4 Joint scenarios

Some processing involves both parties: for example, when you join a Host's Organization as an employee, your Account data is in our internal CRM while your role membership is also visible to the Host. We describe these flows in Section 10.

6. Categories of Personal Information We Collect

We collect personal information in the categories below. Not every category applies to every user; applicability depends on whether you are a Host user, a Customer of a Host, a Consumer App user, or a website visitor.

6.1 Identifiers

• 3rdSpace username (unique handle)
• Legal and display name (first, last)
• Email address(es)
• Phone number(s)
• Firebase Auth user ID (uid)
• Organization, Brand, and Location identifiers and slugs
• Stripe customer ID and Connect account IDs where applicable
• CRM contact IDs and affiliate codes
• Device identifiers used for fraud prevention (not advertising ID at launch)
• Session tokens and authentication cookies (see Cookies Policy)

6.2 Customer records and commercial information

• Host CRM contact fields (names, emails, phones, addresses, notes, tags)
• Purchase and visit history aggregated in CRM stats
• Reservation, ticketing, and waiver records
• Invoice and payment records processed through platform tools
• Gift-card and loyalty balances where enabled
• Affiliate conversion attribution metadata
• Custom fields defined by each Host organization

6.3 Internet and network activity

• IP address at sign-up and during authenticated sessions
• User agent and browser/device type
• Pages viewed and features used within the dashboard (where analytics cookies are enabled)
• QR code scan and short-link click events (aggregated campaign metrics)
• API request logs for security and debugging
• Webhook delivery logs (Stripe, Twilio, SendGrid)

6.4 Geolocation data

• Approximate location derived from IP (security and fraud)
• Precise latitude/longitude when a Host selects a Google Places address for a Location
• Time zone associated with a Location
• Future Consumer App location features (when launched) subject to device permissions

6.5 Professional and employment-related information

• Organization role (Owner, Admin, Manager, Employee)
• Scope grants (organization, brand, location group, location)
• Staff scheduling assignments where the Staff Scheduling tool is used
• Internal notes a Host stores about staff or vendors in CRM

6.6 Inferences and profiles

• CRM segments and tags applied manually or by rules
• AI Booster-generated summaries and marketing profile drafts (not automated legal decisions)
• Engagement scores used for reengagement queue suggestions
• Completeness scores for app presence and business profile tooling

6.7 Audio, electronic, and visual information

• Images and videos uploaded to the Media Library
• Smart TV CMS playlists and scheduled content metadata
• Karaoke queue metadata (we do not host copyrighted song audio)
• Waiver signatures and uploaded identification where hosts configure collection

6.8 Communications content

• Email and SMS message bodies composed in the Email and SMS tools
• Two-way SMS conversation threads
• Support ticket messages
• AI Booster prompts and responses stored in usage logs

6.9 Financial information

• Added Storage units held by the organization, and Booster Credit purchase and balance history
• Credit pool balance and usage ledger entries
• Stripe payment method metadata (brand, last four digits, expiration) — full card numbers are held by Stripe, not us
• Tax exemption certificates uploaded for qualifying nonprofits
• Payout records for affiliate programs via Stripe Connect

6.10 Education and demographic information

• Birthday collected at sign-up for age-gating (see Section 23)
• Optional demographic custom fields a Host may define
• AI-generated demographic summaries when Booster is enabled

6.11 Sensitive personal information (limited)

• We do not intentionally collect government ID numbers or full payment card numbers in our database.
• Hosts may configure waivers or forms that collect additional categories; Hosts are responsible for lawful collection and notice.
• If Sensitive Personal Information is processed, Hosts should limit fields to what is necessary and honor applicable opt-out rights.

6A. Bank Account Information (ACH)

Booster Credit is loaded by debit from a bank account you authorize. This Section says what that involves, because it is the only place 3rdSpace touches bank details.

What is collected. The bank account and routing details needed to take the debit, the authorization you give (its text, and when and from where you gave it), and the status of each debit, including whether it settled, failed, was returned or was disputed. Where you verify the account instantly, that verification runs through Stripe Financial Connections, which may involve you signing in to your bank on Stripe's surface, never on 3rdSpace's. Where instant verification is unavailable, Stripe's microdeposit method is used instead.

Who holds it. Stripe holds the bank account number; 3rdSpace does not store it. 3rdSpace holds a token that identifies the account at Stripe, together with non-sensitive descriptors such as the bank name and the last digits of the account, the authorization record, and the debit status history. 3rdSpace never receives your online banking credentials in any flow.

Why it is collected. To take the debits you have authorized for Booster Credit purchases and, if you turn it on, auto-reload; to verify that the account is yours and usable; to tell you when a debit fails, is returned or is disputed; to reverse credit granted against a debit that then failed; and to meet the record-keeping obligations that apply to bank debits, including retaining evidence of your authorization.

How long. The authorization record and debit history are retained for the periods in Section 21 that apply to billing records, because they are the evidence that a debit was authorized. Removing a bank account from the Billing UI stops future debits and revokes the authorization going forward; it does not erase the record that past debits were authorized and taken.

If you use a personal account. Many sole proprietors pay business costs from a personal account. 3rdSpace does not require a business account, and the choice is yours. Consumer protections applying to debits on a personal account are a matter between you and your bank.

6B. Business Identity Information for a Location

A Host may record business identity details for a Location: the legal business name, the business type, the registered address, and optionally an Employer Identification Number (EIN). This is business information rather than personal information in most cases, but an EIN and a registered address can identify a sole proprietor personally, which is why it is described here.

Providing it is optional. A Host can operate without it. The EIN in particular is optional, because many sole proprietors do not have one.

Why it is collected. To register the Host's business with mobile carriers so that text messages can be sent under the Host's own business name, which carriers require before they will deliver such messages, and, in future, to support payment processing set up in the Host's name. It is retained after a registration so the Host does not have to supply it again.

Who can see it. Within the Host's own Organization, the full EIN is visible only to Owners and Admins; other members who can see the Location see it masked, showing only the last four digits. 3rdSpace personnel may access it where necessary to support the Host or to complete a carrier or payment registration on the Host's instruction.

What 3rdSpace does not collect for this purpose. 3rdSpace does not collect a Social Security Number, a date of birth, a personal home address of an owner or representative, or bank account details as part of this record. Where a payment processor requires those for its own verification, it collects them itself and 3rdSpace does not hold them.

6C. Consumer App Waitlist

Joining the waitlist for the 3rdSpace consumer app is covered by the Consumer Early Access Terms, and this Section says what the waitlist itself collects and why. It applies to you as an individual, not as a Host.

What is collected. A flag on your account recording that you asked for the consumer app. Your confirmed US mobile number, taken from the verified number already on your account rather than typed again. Your position in the queue and whether it falls inside the early access group, with the times you joined and the position was assigned. A one-way hash of your phone number, held separately as the record that the number holds a spot. A short lived count of joins from one network, to stop automated sign ups. Joining asks you to tick nothing and records no acceptance and no marketing consent. When early access begins, you will be asked to accept the early access sections of the Consumer Early Access Terms, and we will keep a record of that acceptance (the version, the date and time, and the IP address it came from).

Why each one. The confirmed number is what makes one spot per person real rather than an honour system, and the hash is what enforces it without a second copy of the number sitting in a list that can be read. The position and its timestamps are what make "the first 10,000" an ordering you could check rather than a claim. The per-network count exists only to stop automated sign ups and is discarded shortly after.

Launch updates. The waitlist page has no boxes of its own. Updates about the app follow the marketing choices you made when you created your account (Section 11): the email box, which starts selected, and the text box, which starts empty and is only set by your own tick. Joining the waitlist does not change either.

Withdrawing. Reply STOP to any marketing text, use the unsubscribe link in any marketing email, or email support@3rdsp.co. On 3rdsp.co your Me page lets you turn marketing emails on or off and turn marketing texts off; the three routes above always work, and email always works. Each of them is recorded on 3rdSpace's own records, not only at the company that delivers the message. When you withdraw, we record the withdrawal with its own date and time. We keep the record that you once consented, because that record is the evidence the messages were authorized while they were sent, and deleting it would leave us unable to show that.

Asking for texts again. If you reply START to a number you previously stopped, we record that you asked, with its date and time. Where we still hold your earlier agreement to receive marketing texts, we reinstate it and record the reinstatement as its own event rather than by altering the earlier record. Where we do not hold one, we send nothing until you agree in the ordinary way. A START reply never affects email.

The public count. The waitlist page shows how many early access spots remain. That figure is a total. It is not derived from, and does not reveal, any individual's position or identity.

What we do not do with it. We do not sell it, we do not share your position with a Host, and joining the waitlist does not add you to marketing messages. Whether we may send you marketing by email or text is the separate choice recorded at Section 11, and joining does not change it.

Leaving the waitlist. You can leave from the waitlist page at any time. Leaving removes your entry and the hash of your number, releases your position to the next person, and clears the consumer app flag. It deliberately does nothing else: your account, your consent history, and any record a Host holds about you are untouched. Leaving the waitlist is not a deletion request, and we do not treat it as one, because treating an opt-out as an erasure would quietly destroy records you did not ask us to destroy.

Deletion, stated as it actually stands today. Ask through our deletion request page, which needs no account. From the moment you confirm your address or number, three things take effect: nothing we operate will send messages to it again, it cannot be added back to any customer list, and any record it matches is withdrawn from use and protected from being aged out while your request is open.

What still takes longer. Our deletion process reaches your waitlist entry and the hash of your number, and releases the number so it can be used again. It does not yet automatically reach the account record itself, which holds your email address, name, phone number and your consent history including IP addresses, nor the underlying sign-in account. Completing a deletion beyond the waitlist entry currently requires manual work by 3rdSpace, and part of the automated process is switched off pending legal review. Section 21 states the right you have and it is not reduced by the state of our tooling: ask, and we will do it by hand. We record the gap here rather than describe a capability we do not yet have.

How long. A waitlist entry is kept while you hold a spot. If you leave, the entry and the hash are removed at that point. The consent record is retained with the other consent records under Section 16, because it is the evidence that an acceptance happened, and the record that an acceptance happened is not erased by later leaving the list.

6D. Identity Information for Host Payment Processing (Stripe Connect)

This Section describes information collected when a Host sets up payment processing so that it can take booking deposits or sell tickets. It applies to the people behind a Host business, not to that Host's customers.

This is planned, not live. No Host has set up payment processing today. This Section is written in advance so that a Host reads it before it starts, rather than after.

What Stripe collects, and where it goes. Payment processing for Hosts runs on Stripe. To open an account in the Host's name, Stripe requires identity and business verification information, which can include the legal business name and address, the business tax identification number, and, for the individuals who own or control the business, their name, date of birth, home address, government identification number or the last digits of it, and in some cases a photograph of an identity document. Stripe may also verify that information against credit agencies and other identity sources.

3rdSpace does not hold it. That information is collected by Stripe, on Stripe's own form, shown inside the 3rdSpace dashboard rather than on a separate site. It goes to Stripe. 3rdSpace does not receive, store, or have access to a Social Security Number, a date of birth, a personal home address, or an identity document image. What 3rdSpace holds is the identifier of the Stripe account, the status of its verification, and the descriptors Stripe returns for display, such as the business name and the last digits of the payout account.

What we prefill, and what that means. Where a Host has already recorded business identity details for a Location under Section 6B (legal business name, business type, registered address, and optionally an EIN), 3rdSpace may send those values to Stripe to prefill the form, so the Host does not type them twice. Prefilling moves information the Host already gave us; it does not collect anything new, and the Host sees and confirms every prefilled value before it is submitted.

Stripe is a controller of this information, not only our processor. Stripe has its own direct relationship with the Host for these services. When you provide personal data in connection with 3rdSpace, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy. Stripe's use of it is governed by that policy and by the Stripe Connected Account Agreement, not by this one.

What we receive back. Transaction-level information for the payments a Host takes through 3rdSpace: amounts, dates, the status of each payment, refunds and disputes, and the amount of the 3rdSpace Service Charge on each. We use it to show the Host its own activity, to account for the Service Charge, and to support the Host. We do not receive the customer's full card number in any flow.

How long. The Stripe account identifier and the verification status are kept while the Host has payment processing enabled and afterwards for the periods in Section 16 that apply to billing records. Information held by Stripe is retained under Stripe's own policy and schedule, which 3rdSpace does not control.

6E. Your Calendar on 3rdSpace

Your own plans. When you can add your own events to your 3rdSpace calendar (coming soon), they are private to you: no venue, host or other person can see them, and you can edit or delete them at any time.

Your sync link. If you turn on "Sync with your calendar", we give you a private link that sends your 3rdSpace plans (your tickets, bookings and saved events, and your own plans if you choose to include them) to the calendar service you add it to, such as Google, Outlook or Apple. Once your plans are in that service, that service keeps them under its own terms, and anyone you give the link to can see them. You can turn the link off, and it stops working at once.

Calendars you connect. You can connect a calendar from Google, Outlook or Apple by pasting its private calendar link. This is not available yet; we describe it before it ships. Connecting asks for two separate choices, and only the first is needed to connect.

Choice 1: sync the calendar into yours. This is what connecting means.

• What we keep. We read the calendar from its link about every hour and keep, for each event in a window of about 30 days back and 90 days ahead, its title, start and end time, place, description and repeat pattern, so you can see it in your 3rdSpace calendar.
• What we never keep about other people. A calendar can list people invited to an event. We keep only how many people were invited, never their names or email addresses. Other people's names can still appear inside a title or description you or someone else wrote, such as "Lunch with Sam"; we keep that text only to show it to you.
• It may be sensitive. A calendar can show health appointments, religious services or other private matters. By choosing to sync it, you choose to let us store it to show it to you. Under Choice 1 it is shown only to you and used for nothing else.
• The link. We store it encrypted, never show it back to you in full, and never write it to our logs. Treat it like a password: anyone who has it can see that calendar.

Choice 2, separate and optional: use the calendar to personalize 3rdSpace, improve our AI and reach you with ads. It starts off, you choose it for each calendar, it is never required to connect a calendar or to use anything else on 3rdSpace, and it is not offered to anyone under 18. If you turn it on for a calendar:

• We sort that calendar's events into broad interest groups, such as live music, trivia, sports or dining out, from a fixed list of groups that are about going out. We use only those groups, never the text of your events, and we never make a group from anything sensitive: health, religion, sex life or sexual orientation, race or ethnicity, politics, union membership, finances, immigration or criminal matters, or precise location.
• We use the groups to recommend things to you, to improve 3rdSpace's models (Section 12A), and to place you in audiences that advertisers can choose on 3rdSpace. An advertiser never receives your data or your calendar, only how many people an audience holds, and an audience is never smaller than one hundred (100) people.
• Turning it off stops all of this for that calendar from then on, and we delete the interest groups we made from it within fifteen (15) business days. Models and pooled patterns already built are not rebuilt, because they do not identify you. A Global Privacy Control signal from your browser turns off its advertising use (Section 12A).

Who else sees it. Nobody. Your connected calendars are not shared with venues, hosts or other users. If we ever let you share when you are free with friends, you will choose that yourself, and we will ask first.

Disconnecting. When you disconnect a calendar, we delete its link, every event we kept from it and every interest group we made from it, at once. Deleting your Account does the same.

6F. Reviews

Reviews are coming soon. When you post a review, it is public, with your first name and last initial, the type of experience, the month and year of a verified visit, your rating, your words and any photos. We never show your username, email address or phone number with it. To label a review "Verified visit", we use our own records of your visit (a scanned ticket, a completed booking, a season pass check in or a game you joined at the venue), and we keep a record of each visit for 14 days so you can review it. We may send you one request to review a visit, by email or text, only if you agreed to receive messages from us that way. Receipts you upload to show a visit, when that is available, are seen only by our moderators, have card numbers blurred when you upload them, and are deleted once the review is settled or after 90 days, whichever comes first. You can ask us to remove your review at any time, and deleting your Account removes your reviews. See the Review Policy.

6G. What We Collect About 3rdSpace Account Holders, and Why

This Section covers people who have their own 3rdSpace account (including the consumer app when it launches). It does not cover a person who is only in a venue's customer list and never signed up: that information belongs to the venue, and we handle it only as the venue's service provider (Section 5 and Section 12B). Several items below are planned and not yet built; we list them now so you know, and we will not collect them until the feature exists.

We collect each category only for the purposes listed beside it. "How you agree" says whether accepting our Terms and this Policy covers it, whether your phone asks your permission first, or whether you must turn it on yourself in 3rdSpace.

What we never collect. We do not listen through your microphone or record you, ever. We do not read your clipboard, measure your keystroke rhythm, or collect faceprints or voiceprints. We do not upload your whole address book. We do not use the content of your messages with other people for ads or training.

7. Sources of Personal Information

Directly from you: Account registration, profile updates, tool input, support correspondence, marketing opt-in/out, privacy settings, and voluntary uploads. Automatically from your device and browser: Log files, cookies (per our Cookies Policy), session management, and security telemetry. From Host organizations: CRM imports, manual entry, tool-generated records when you transact with a Host, and organizational membership when you are invited to a team. From third-party authentication: Google SSO profile elements permitted by your Google account settings. From third-party business APIs: Google Business Profile, Meta Graph (where enabled), web scraping outputs initiated by Hosts, POS imports (planned), and payment processors. From service providers: Delivery and engagement events from SendGrid and Twilio, payment confirmations from Stripe, error reports from Sentry. From publicly available sources: Only where a Host initiates a Web Scraper or similar tool and accepts responsibility for lawful collection.

8. How We Use Personal Information and Our Purposes

• Provide, operate, maintain, and improve the platform and tools you enable
• Authenticate users and enforce role-based access controls
• Process Added Storage subscriptions, credit purchases, bank debits you have authorized, and unified credit pool debits
• Deliver transactional messages (receipts, verification codes, security alerts)
• Send marketing communications where permitted (Section 11)
• Populate 3rdSpace internal CRM and Host CRMs per auto-entry (Section 10)
• Provide AI-assisted features when AI Booster is enabled (Section 12)
• Detect, prevent, and respond to fraud, abuse, and security incidents
• Comply with law, regulation, legal process, and enforce our Terms
• Generate aggregated analytics and product insights with de-identified data
• Develop, train, evaluate, and improve our own models, features, and services; run experiments; recommend things to you; and choose in-app ads and offers, as described and limited in Section 12B. For a 3rdSpace account holder this uses information linked to the account; for a venue's customers who never joined 3rdSpace, and for anything shared across venues, only de-identified and aggregated data. We never expose one Host's underlying data to another, and we never sell or license personal information. These uses are planned and not yet active.
• Provide customer support and internal administration (including read-only impersonation with audit logging)
• Honor your privacy rights requests and maintain audit trails of privileged actions We do not use personal information for automated decisions that produce legal or similarly significant effects without human review. AI outputs are assistance for Hosts who remain responsible for decisions.

9. Legal Bases for Processing (Where Applicable)

For users in jurisdictions that require a legal basis (for example, the European Economic Area or United Kingdom if we expand), we rely on:

• Contract: Processing necessary to perform our Terms of Service with Hosts and to provide Account features you request.
• Legitimate interests: Securing the platform, preventing fraud, improving products, and communicating about service changes—balanced against your rights.
• Consent: Marketing Opt-In, optional analytics/marketing cookies, and certain Host-initiated communications where consent is required.
• Legal obligation: Tax, accounting, telecommunications compliance records, and responses to lawful requests.

10. Auto-CRM-Entry and Dual CRM Architecture

Material disclosure: Every individual who creates a 3rdSpace Account is automatically entered into:

1. 3rdSpace's internal CRM — maintained by us as controller for product operations, support, analytics, growth, and (if you opted in) marketing; and
2. The CRM of each Organization you join — maintained by that Host as controller for its business relationship with you.

This occurs at account creation and when you accept an invitation to an Organization. We disclose this practice at sign-up and in this Policy. You may request deletion of your personal information subject to Section 21 and applicable law; deletion from our internal CRM does not automatically delete records a Host holds where you were their customer, and vice versa—see routing in Section 19.

Wide schema design: Host CRMs support extensive fields and custom fields so tools can attach reservation history, ticket purchases, waiver records, marketing engagement, and future Consumer App activity. Fields may be sparse early in adoption; the schema is designed to grow without frequent migrations.

Linking: When a CRM Contact corresponds to a 3rdSpace Account, we store the thirdSpaceUserId linkage so records remain consistent across tools. Hosts see only CRM data their role scope permits.

11. Marketing Communications and Consent

11.1 Separate Marketing Opt-In

At sign-up, acceptance of the Terms of Service and Privacy Policy is required, and the marketing choices are separate from it and never a condition of creating an Account. There are two of them and they behave differently, which we state plainly rather than describe as one control:

• Marketing email is offered as a pre-selected box that you can clear before you submit the form. If you leave it selected you are asking for 3rdSpace product emails, and every one of them carries an unsubscribe link.
• Marketing text messages are never pre-selected. That box starts empty and only your own affirmative tick turns it on.

If you do not opt in to a channel, we do not send you 3rdSpace marketing on it. Transactional and service messages, such as a verification code or a security notice, are sent regardless and are not marketing.

The consumer app waitlist has no marketing boxes of its own; updates about the app follow the choices above (Section 6C).

11.2 Host channel marketing

Where permitted by our Terms and applicable law, we may send Host Channel Marketing to individuals who are customers of a Host and who have opted in to marketing communications with that Host (or as otherwise permitted). Messages clearly identify 3rdSpace and the relevant Host (for example, inviting you to use the Consumer App in connection with venues you already patronize). We do not claim the Host's consent extends beyond what the customer relationship supports.

11.3 Host marketing tools

Hosts use Email and SMS tools to message their own CRM segments. Hosts are controllers responsible for consent, content, suppression (STOP/UNSUBSCRIBE), and regulatory compliance (CAN-SPAM, TCPA, A2P 10DLC registration). We provide technical suppression lists and delivery infrastructure.

A venue's own marketing boxes. A venue's ticket, RSVP and booking pages, and its game, contest and karaoke join screens, can offer two boxes for that venue's marketing, one for email and one for texts. The text box always starts empty. On ticket, RSVP and booking pages the email box starts selected, and you can clear it before you submit; on join screens it starts empty. Each box records the exact words you were shown. Neither is a condition of getting a ticket, booking or playing. We do not send a venue's marketing to anyone we know or believe to be under 18, or whose age we do not know.

11.4 Opt-out

You may opt out of 3rdSpace marketing using the unsubscribe link in any marketing email, by replying STOP to an SMS, or by emailing support@3rdsp.co.

On 3rdsp.co, your Me page lets you turn marketing emails on or off and turn marketing texts off, whether or not you belong to an organization. A member of an organization also has the notification settings in the dashboard. The three routes above always work, each of them is honored on 3rdSpace's own records rather than only at the company that delivers the message, and emailing us always works.

Replying START to a marketing text you previously stopped tells us you want those messages again. We record the request. Where we still hold your earlier agreement to receive them, we reinstate it and record the reinstatement as its own event; where we do not, we send nothing until you agree in the ordinary way. A START reply never affects email.

Host marketing opt-outs are managed by the Host's suppression records; we propagate unsubscribe signals across our Email and SMS tools when events are received from providers.

12. AI Booster and Third-Party AI Processing

When a Host enables AI Booster at the Organization level and for specific tools, we transmit the minimum data reasonably necessary for each AI request—such as email draft context, CRM excerpts for summarization, SEO audit findings, or web-scraper synthesis inputs—to Google Gemini (and potentially Anthropic Claude in the future).

Provider terms: AI providers process data under their API terms and our vendor agreements. We contractually require that data submitted through our Booster integration not be used to train their public foundation models, consistent with enterprise API offerings.

Our own models. How 3rdSpace uses information to train its own models, run experiments, and choose in-app ads and offers, what is and is not de-identified, and how to turn each use off, is in Section 12B. Nothing there changes the provider commitment above.

14-day asymmetric disable delay: If a Host requests to disable Booster after it was enabled, the disable takes effect after 14 days, during which the Host may cancel the pending disable. Re-enabling is immediate. This delay is disclosed in our Terms and exists to prevent accidental disruption and billing surprises.

Logging: Booster usage is logged in the organization's usage ledger for billing transparency and fraud review.

No AI-only critical path: Tools function without AI; Booster features degrade gracefully when disabled or credits are exhausted.

Human review: Hosts must approve outbound AI-drafted SMS and similar communications where law or policy requires human approval (for example, TCPA-sensitive reengagement queues).

12A. Improving 3rdSpace: Models, Recommendations and Advertising

Today, none of the uses in this Section is active. We describe them now so you know what is planned, and we will put the switches described below in your Account and in your Organization's Settings before any of them begins. We will tell you when each one starts.

What we may use, and for what.

• To improve 3rdSpace for every venue, de-identified and aggregated information about how the platform is used: which kinds of offers, wording and send times work, and how demand changes by day, time and kind of venue. "De-identified" means it cannot reasonably be linked to you, to your device or to a particular venue's customers, and we commit not to try to re-identify it. A pattern drawn from more than one venue is computed only from at least ten (10) venues.
• To suggest prices to venues, the venue's own information and pooled patterns. A suggested price is the same for everyone for the same product, time and place. We do not set or suggest a price for you based on your personal information.
• To recommend things to you (events, venues, games), your own activity on 3rdSpace: what you saved, booked, played or entered, and what you told us you like.
• To choose which advertisement you see, when advertising starts: your activity on 3rdSpace and broad interests we infer from it. We show the advertisement ourselves. The advertiser never receives your personal information, only counts and pooled results.
• To tell venues and advertisers about groups of people, such as "people who book weekend events tend to spend about this much on a night out": always pooled from at least one hundred (100) people, and never naming or singling out anyone.

What we never do. We never sell your personal information. We never use sensitive personal information (such as health, race or ethnicity, religion, sexual orientation, precise location, or a government identifier) for any of these uses. We never give one venue another venue's customer data. We never target advertising, or build an advertising or interest profile, for a person under 18 or a person whose age we do not know, and their information is left out of the models that choose advertisements. We do not use the information venues hold about their own customers on 3rdSpace to build your profile for our recommendations or advertising; we use your activity on your own 3rdSpace account. A calendar you connect is used here only if you separately turn on its interests choice (Section 6E), and then only as broad, non-sensitive interest groups, never the text of your events.

Your choices. In your Account you will be able to turn off, separately:

1. "Use my activity to improve 3rdSpace": your activity is no longer added to what we use to train or improve our models.
2. "Personalized recommendations": you see the same recommendations as anyone in your area.
3. "Personalized ads": you may still see advertisements, but not chosen using your activity.
4. "Use this calendar for my interests", for each calendar you connect: off unless you turn it on (Section 6E). Turning it off removes that calendar from every use in this Section. We also treat a Global Privacy Control signal from your browser as a request to turn off personalized ads, wherever you live, including any advertising use of a connected calendar. We act on a request to turn off personalized ads no later than fifteen (15) business days after we receive it. Turning any of these off costs you nothing: no feature, price or offer depends on it.

A venue's Owner or Admin can also turn off "Use our data to improve 3rdSpace" for the whole Organization (Terms, Section 19.4).

What happens to information already used. When you turn a switch off, we stop using your information for that purpose from then on, and we delete any advertising or recommendation profile we built about you. Models and pooled patterns already built are not rebuilt to remove you, because they do not identify you. Deleting your Account (Section 21) deletes your profile and removes your activity from future training.

How long we keep it. Recommendation and advertising profiles are kept while your Account is open and the switch is on. De-identified and aggregated information and the models built from it may be kept indefinitely.

12B. The Learning Engine: Our Own Models, Experiments, Ads and Offers

This Section controls where any other part of this Policy (including Section 8, Section 12 and Section 12A, if present) says that we train our own models only on de-identified data. None of these uses is active yet. We will put the switches below in your Account and in your Organization's Settings before any of them begins, and we will tell you when each one starts.

1. Whose information feeds it. Only people who signed up for 3rdSpace, and only what they did or gave us through their own 3rdSpace account. A venue's customers who never joined 3rdSpace are the venue's: we use their information only to provide the venue's service, and only in de-identified and aggregated form to improve that service for every venue. We never build a profile of them, never show them ads, and never use them in the person level models below. A venue never sees what we know about you from your 3rdSpace account and cannot filter its customer list by it.

2. Our own models, using your own activity. We use the information in Section 6G, linked to your account, to train and run our own models that recommend events and venues to you, predict what you are likely to do and spend, choose the ads and offers you see, and decide when and how a message is most likely to be useful to you. This information is not de-identified while it is in those models, and it is never given to anyone outside 3rdSpace.

3. What is de-identified, and what is not.

• Not de-identified: your profile, activity, purchases and inferences inside 3rdSpace's own models, as described in point 2.
• De-identified and aggregated: everything we learn across venues and give back to venues as recommendations (for example "texts sent on Thursday afternoons get more clicks"), which is pooled from at least ten (10) venues; everything we tell advertisers about an audience, pooled from at least one hundred (100) people; and anything we use from a venue's customers who never joined 3rdSpace. "De-identified" means the information cannot reasonably be linked to you or your device, we take reasonable measures to keep it that way, we publicly commit here not to try to re-identify it, and anyone we let use it must agree to the same.
• A venue never receives another venue's data, only recommendations.

4. Experiments. We may show different versions of features, messages, wording, send times or layouts to different people or venues, and measure which works better. We never show different people a different price for the same thing at the same time and place.

5. Advertising inside 3rdSpace. Venues and other businesses rent advertising space in 3rdSpace and choose an audience group built from broad persona categories, such as "goes to live music on weekends". We place you in groups and show the ads ourselves. The advertiser never receives your name, contact details or any other personal information, only how many people saw or used the ad. Every audience group has at least one hundred (100) people. We never sell or license your personal information, including your location, to anyone.

6. Offers chosen for you. We may choose which offers or coupons you receive using what we predict you are likely to enjoy or spend. An offer is a discount, chosen by us; the venue's price is the same for everyone. If you live in New York, an offer chosen this way will carry the notice "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA". If you use an offer, the venue sees that you used it, as with any coupon.

7. Sensitive information and precise location. We never use sensitive personal information for any of these uses, except precise location, and only if you turn on that use yourself (Section 12C). Turning on a feature that needs your location, such as a friend map, is not agreement to use your location for ads or training; each is its own choice. If you are in Maryland, we do not use precise location for ads, offers or training at all.

8. People under 18. We never show targeted ads or offers to anyone under 18 or whose age we do not know, and we never use their information to build an advertising profile.

9. Your choices. In your Account you will be able to turn off, separately: "Use my activity to improve 3rdSpace" (training our models); "Personalized recommendations"; and "Personalized ads and offers". Turning off personalized recommendations means you see what is popular in your area instead, because there is nothing to personalize with. Turning off training or personalized ads costs you nothing else. We treat a Global Privacy Control signal as a request to turn off personalized ads and offers, wherever you live. A venue's Owner or Admin can turn off "Use our data to improve 3rdSpace" for its Organization (Terms, Section 19.9).

10. What happens when you switch something off. We stop using your information for that purpose from then on and delete the advertising or recommendation profile we built from it within fifteen (15) business days. Models already trained are not rebuilt to remove you.

12C. Choices You Turn On Yourself

Some uses need your own, separate yes. Accepting our Terms and this Policy is not that yes. Each choice below is off until you turn it on, is asked for when you use the feature it belongs to, explains in one line what it does, and can be turned off at any time in Settings. We never pre-tick these choices.

1. Precise location for a feature (for example a friend map or "near me"): your phone asks first, then 3rdSpace explains the feature.
2. "Use my location for recommendations, ads and offers": lets us use your precise location, including whether you are likely at home, at work or out, to choose recommendations, ads and offers. Not offered in Maryland.
3. "Use my location to improve 3rdSpace's AI": lets us use your precise location to train our own models. Not offered in Maryland.
4. "Use this calendar for my interests", for each calendar you connect (Section 6E).
5. Anything we may later add that the law treats as sensitive (for example health or financial account information): it will have its own choice, described when we add it.

13. How We Share Personal Information

We do not sell your personal information. We do not exchange your personal information for money or other valuable consideration with data brokers for their independent use.

We do share personal information broadly with service providers who assist us in operating the platform, as detailed in Section 14. This sharing is business-favorable in the sense that it is necessary to deliver a modern SaaS product, but we disclose it plainly: your data may be processed by multiple specialized vendors in the United States and, where applicable, abroad under appropriate safeguards.

We may also share information:

• With Hosts you belong to or transact with (CRM visibility per RBAC);
• With a venue that issues you a Season Pass. A venue's staff with permission to issue passes can find your 3rdSpace account by your verified phone number, your verified email address or your user name. They see only the name on your account (or "A 3rdSpace member" if it has none) and what they typed; they do not see your email address, phone number or anything else on your account unless they typed it themselves. If they issue the pass, you are added to that venue's customer list with your name and whatever they typed, and the pass appears in your account. This gives the venue no permission to send you marketing; that needs your own opt in. Lookups are limited in number to stop anyone using them to search for people. You cannot yet remove a pass a venue issued you yourself; ask the venue, or email support@3rdsp.co;
• For legal reasons — subpoenas, court orders, or to protect rights, safety, and integrity;
• In corporate transactions: merger, acquisition, asset sale, or a conversion or reorganization of THE3RDSPACE LLC into a successor company, with notice where required;
• With your direction — when you integrate third-party services or export data;
• Aggregated or de-identified — insights that cannot reasonably identify you.

Advertisers and venues that buy advertising on 3rdSpace never receive your personal information. They choose an audience group and receive counts and pooled results (Section 12B). We never sell or license personal information, including location, to anyone.

14. Service Providers and Sub-Processors

15. International Data Transfers

Our primary hosting region at launch is us-east1 (United States). Service providers in Section 14 may process data in the United States or other countries where they operate data centers.

Where required for lawful international transfers (for example, if we onboard European users in the future), we will implement appropriate safeguards such as Standard Contractual Clauses and supplementary measures. At US-only launch, most users' data remains in US-controlled environments; see state addenda for US resident rights.

16. Data Retention Schedules

We retain personal information only as long as necessary for the purposes described, unless a longer period is required by law.

17. Security Measures and Limitations

• HTTPS for data in transit; TLS for API traffic
• Firebase Authentication with email verification and mandatory phone verification before org actions
• Password hashing — we never store plaintext passwords
• Have I Been Pwned k-anonymity checks on passwords at sign-up and change
• Role-based access control with organization, brand, and location scopes
• Webhook signature verification for Stripe, Twilio, and SendGrid
• Rate limiting on SMS verification and invite-code attempts
• Internal-admin read-only impersonation with mandatory audit logging
• Firestore security rules and server-side assertCan() enforcement
• Weekly encrypted backups and point-in-time recovery on production
• Separation of development and production Firebase projects Disclaimer: No method of transmission or storage is completely secure. We cannot guarantee absolute security against all attacks, including sophisticated or novel threats. You are responsible for safeguarding your credentials and promptly reporting suspected unauthorized access.

We design against common web vulnerabilities (XSS, CSRF, injection) but do not warrant uninterrupted or error-free operation. See our Terms of Service for limitation-of-liability provisions.

18. Data Breach Notification

If we become aware of a breach of security leading to unauthorized acquisition of personal information that we maintain as controller, we will investigate promptly, take reasonable steps to mitigate harm, and notify affected individuals and regulators as required by applicable law. Notification may include email, in-app notice, or other permitted channels. We will describe, to the extent known, the categories of information involved, steps we are taking, and recommended protective measures you may take.

Hosts are responsible for notifying their customers regarding breaches affecting Host CRM data where the Host is controller, though we will assist with available technical information when appropriate and contracted.

19. Your Privacy Rights and How to Exercise Them

• Access / know — confirm whether we process your personal information and obtain a copy.
• Correction — update inaccurate Account information via settings or support.
• Deletion — request deletion of personal information we control, subject to exceptions (Section 21).
• Portability — receive a machine-readable export (Section 20).
• Opt-out of marketing — withdraw Marketing Opt-In at any time.
• Restrict or object — where applicable law provides these rights.
• Non-discrimination — we will not deny services solely for exercising privacy rights, except where the right limits a feature (for example, deletion closes your Account). How to submit: for deletion, use our deletion request page at /privacy/delete on either 3rdSpace site, which needs no account (Section 21). For anything else, email support@3rdsp.co. We verify identity before fulfilling requests, and no request is acted on until the address or number it concerns has been confirmed. Authorized agents must provide proof of authority.

20. Data Export (Portability)

To request an export of your data, email support@3rdsp.co. We provide a machine-readable copy of the personal data associated with your Account and the Organization memberships you are entitled to access, after verifying your identity.

We respond within the timeframes in Section 2, and may apply a short delay for fraud review before delivery. When ready, the export is provided through a time-limited secure download link.

Exports may exclude information we cannot disclose without affecting other individuals' rights (for example, other users' personal data in shared Organization audit entries) or information subject to legal hold.

21. Account and Data Deletion; 30-Day Grace Period

Unconditional right: You may request deletion of your Account and associated personal information we control. The right is unconditional subject to narrow exceptions where retention is required by law (for example, completed billing records) or to resolve disputes.

How to ask, and you do not need an account. Use our deletion request page at /privacy/delete, on either 3rdSpace site. It works whether or not you have ever had a 3rdSpace account, and whether your details are held by a venue on 3rdSpace or by 3rdSpace itself. You confirm the email address or phone number is yours, and the request is recorded from that moment. You can still email support@3rdsp.co if you would rather.

Timeframes. We confirm we have your request within 10 business days and tell you what we have done within 45 calendar days. If we need longer we will tell you before the 45 days are up, and take no more than a further 45 days. These are the timeframes California's privacy law sets, and we apply them to every request through this route, wherever you live.

What happens immediately, and what takes longer. From the moment you confirm the address or phone number, three things take effect on anything we hold that matches it: no system we operate will send messages to it again, including booking and ticket messages; a Host cannot add it back to a customer list in any Organization; and any Host record it matches is withdrawn from use and protected, so it is not aged out while your request is open.

Removing the stored copies is partly manual today, and we would rather say so. Part of our deletion process runs automatically and part of it is switched off while the treatment of de-identified information is reviewed. While it is off, removing the stored copies is done by hand. This does not reduce the right stated above. Your request is recorded, it is already having the effect described, and we complete it.

What we keep after a deletion. The record that you asked and that we acted, which is what lets us show your request was honored and stop your details being added back. Anything the law requires us to keep. And general information with identifying details stripped out, kept in a form that cannot be traced back to you.

If you work at a venue. Records a venue keeps about you as its staff on 3rdSpace, such as your schedule, your time clock punches and your pay rate, are that venue's employment records. We pass your request to the venue, which decides, and which may be required by law to keep some of them for a period of years. We remove the link between those records and your 3rdSpace account.

The 30-day grace period is a different thing. Where an Account or an Organization is closed or soft-deleted for ordinary reasons, a 30-day grace period applies during which data may be recoverable if the deletion was accidental, and after which we purge it per our retention schedule. A right-to-delete request under this Section does not enter that grace period, and is deliberately excluded from the purge clock so that a pending request cannot be quietly resolved by the passage of time instead of by us.

Host CRM: A Host is also the controller of the records it keeps about you. A request through this page reaches those records where the Host keeps them on 3rdSpace. It cannot reach anything a Host keeps elsewhere, on paper or in another system; for those, contact the Host directly.

Organization deletion: Owners may delete Organizations through a controlled flow with confirmation safeguards; sole Owners cannot orphan paid Organizations without succession steps documented in our Terms.

22. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookies Policy (/cookies), incorporated by reference. Today we use only essential and functional cookies. The Analytics and Marketing categories described in the Cookies Policy, and the in-account cookie preference controls, are planned and not yet active; until they are, you can manage non-essential cookies through your browser settings.

Third-party cookies may be set by Stripe (checkout), Firebase (auth), and Sentry (diagnostics / optional replay) as described in the Cookies Policy.

23. Children's Privacy

The platform is not directed to children under 13. We ask for a birthday when an account is created, after the account details and, if a phone number was given, after we text a code to confirm it. We use the birthday in three ways: to refuse an account to anyone under 13, to keep features that are for adults, such as payments and joining a business, to people 18 and over, and to block marketing messages to anyone under 18 or to anyone whose age we do not know.

If the birthday shows a person is under 13, we delete what they entered straight away: the sign in, the user name, the email address, the phone number and the password. We do not create the account and we do not store the birthday they entered. That means a person who turns out to be under 13 will already have typed those details, and may have received one text with a code, before we knew their age. If a delete does not finish, we keep a note that it is owed, holding no personal information, and try again every day until it is done; a person at 3rdSpace is told if it is not done within a day. We also place a cookie on that browser for 24 hours that records only that a sign up was refused, so the same browser cannot try again straight away; it holds no name, email, phone number or other identifier.

Marketing choices are not kept until we know the person's age. The boxes for marketing emails and texts appear with the account details, but nothing is saved until the birthday is given. For a person aged 18 or over we then save what they chose. For a person aged 13 to 17 we save no to both, whatever was ticked. For a person under 13 we save nothing.

If an existing account is given a birthday under 13, we ask the person to confirm it. If they do, we sign the account out, never store that birthday, and delete the account: its profile, user name, contest and giveaway entries, calendar link and sign in. Where deleting the account would also delete or disconnect a business's data, because the account created or belongs to an Organization, a person at 3rdSpace reviews it first and the account stays signed out meanwhile.

What may still exist briefly. Our hosting, security and error monitoring providers keep technical records of requests, such as an IP address, for a limited time on their own schedules. We do not use those records to identify or contact the person, and our own error reports from sign up keep error codes only.

We do not knowingly collect personal information from a child under 13. If we learn in any other way that we have, we delete it promptly. If you believe a child has given us personal information, contact support@3rdsp.co and we will remove it. A person under 13 can take part in a venue's activities through a parent's or guardian's account.

An account held by a person aged 13 to 17, or whose age we do not know, never receives targeted ads or offers and is never used to build an advertising profile (Section 12B). An account held by a person aged 13 to 17 does not receive marketing messages, and cannot enter a contest or promotion that requires a photo or marketing release. Hosts must not use the platform to knowingly collect personal information from children without appropriate consent and compliance frameworks.

How long we keep children's information. We do not set out to collect any. Where we learn we have collected a child's information, we delete it as soon as we learn it, and retry every day until the delete is done. A sign up that is never finished, whatever the age, is deleted after 7 days.

24. Automated Decision-Making and Profiling

We do not make solely automated decisions with legal or similarly significant effects about consumers. AI Booster outputs are advisory; Hosts approve sends. CRM segmentation rules and reengagement heuristics may automate suggestions, not binding outcomes.

25. Host Responsibilities Toward Their Customers

• Publish a privacy notice to customers describing the Host's practices
• Obtain valid consent for marketing and honor opt-outs promptly
• Configure waivers and lead forms lawfully
• Respond to customer rights requests for Host-controlled CRM data
• Ensure scraping and affiliate outreach comply with site terms and advertising disclosure laws
• Maintain A2P 10DLC registration for US SMS campaigns

26. Changes to This Privacy Policy

We may update this Policy from time to time. Material changes will be communicated at least 30 days before they take effect via in-app banner and email, referencing the version number.

Constructive continuation: Unless you object in writing to Support within the notice window, continued use of the platform after the effective date constitutes acceptance of the revised Policy. If you object, we may suspend access until you accept the revised Policy or complete an offboarding / account-closure flow consistent with deletion obligations. We maintain acceptedPrivacyVersion (and related records) in our systems.

Non-material clarifications (formatting, contact updates, typographical corrections) may take effect immediately with updated version metadata.

27. Dispute Resolution and Governing Law (Privacy-Specific)

Privacy disputes are governed by the laws and dispute resolution provisions in our Terms of Service (State of Michigan), except where overridden by mandatory privacy laws in your state of residence. Nothing in this Policy limits rights that cannot be waived under applicable law.

28. California Privacy Rights (CCPA / CPRA Addendum)

This section applies to California residents and supplements the Policy above.

28.1 Categories collected (last 12 months)

See Section 6 and Appendix A. We collect identifiers, commercial information, internet activity, geolocation, professional information, inferences, audio/visual (user-uploaded), and communications content.

28.2 Sources

See Section 7.

28.3 Business and commercial purposes

See Sections 8 and 9.

28.4 Disclosure for business purposes

We disclose to service providers in Section 14. We do not sell personal information.

28.5 Sensitive personal information

We limit sensitive categories; Hosts may collect additional categories as controllers. The only sensitive personal information 3rdSpace may use beyond what a feature needs is precise location, and only with your separate choice (Section 12C), which you can turn off at any time.

28.6 Retention

See Section 16 and Appendix D.

28.7 Your California rights

Right to know/access, delete, correct, opt-out of sale/share (we do not sell, and in-app ads chosen from your own 3rdSpace activity are not shared with advertisers; we still honor Global Privacy Control and offer the switches in Section 12B), limit use of sensitive personal information where applicable, and non-discrimination.

28.8 Shine the Light

California Civil Code § 1798.83 — we do not share personal information with third parties for their direct marketing without disclosure; contact privacy@ for questions.

28.9 Authorized agents

Agents must submit signed permission and we may verify the consumer directly.

28.10 Verification

We match requests to Account credentials or additional information.

29. Colorado Privacy Act Addendum (Placeholder)

[PLACEHOLDER — counsel to complete before CO residents are onboarded.] Colorado residents may have rights to access, correct, delete, obtain portability, and opt out of targeted advertising, sale, or profiling in furtherance of decisions producing legal or similarly significant effects. Contact privacy@ to exercise rights. Appeal process: [TBD].

30. Virginia Consumer Data Protection Act Addendum (Placeholder)

[PLACEHOLDER — counsel to complete before VA residents are onboarded.] Virginia residents may have rights to access, correct, delete, obtain portability, and opt out of targeted advertising, sale, or certain profiling. Contact privacy@. Appeal process: [TBD].

31. Other US State Privacy Laws (Placeholder)

[PLACEHOLDER — counsel to maintain a rolling addendum for CT, UT, TX, OR, FL, MT, and other comprehensive state laws as we expand marketing and customer footprint.]

Appendix A — Personal Information Category Matrix

Appendix B — Tool-by-Tool Data Flow Summary

Appendix C — Service Provider / Sub-Processor Register

See Section 14. Updated versions will be published before launch.

Appendix D — Retention Schedule (Detailed)

Appendix E — Security Control Summary

See Section 17. SOC 2 or similar attestation: [TBD — not claimed at launch].

Appendix F — Frequently Asked Questions

Q: Does 3rdSpace sell my data? A: No. We do not sell personal information to data brokers.

Q: Why am I in two CRMs? A: Auto-CRM-entry places every Account in our internal CRM and each joined Host's CRM.

Q: How long until export arrives? A: Within the timeframes in Section 2 after we verify your request, through a time-limited download link. An Owner or Admin can also export the Organization's CRM contacts at any time from the CRM.

Q: What happens when I delete my account? A: 30-day grace, then purge except legal retention.

Q: Is AI training on my data? A: We contractually restrict training on Booster API data; see Section 12.

Q: Can I opt out of marketing? A: Yes — separate from Terms; use Privacy settings or unsubscribe.

Q: Who handles my reservation data? A: The Host is controller; we process on their instructions.

Q: Are audit logs deleted? A: After 2 years automatically.

Q: US only? A: Self-serve onboarding is US-hosted businesses at launch.

Q: How do policy changes work? A: 30-day notice; continued use accepts unless you object in writing.

Appendix G — California Notice at Collection (Detailed Table)

The following table satisfies CPRA-style notice at collection for California residents. It is illustrative, not exhaustive; see Section 6 for the authoritative category list.

Appendix H — Host Controller Obligations Checklist

1. Publish a privacy policy to end customers describing the Host's practices, retention, and rights contact.
2. Maintain a lawful basis or consent for marketing email and SMS to CRM contacts.
3. Honor opt-out, STOP, and unsubscribe signals within regulatory timelines.
4. Register A2P 10DLC brands and campaigns before large-scale US SMS sends.
5. Include physical mailing address in commercial email footers where CAN-SPAM requires.
6. Document affiliate and sponsored-content disclosures where state law requires.
7. Avoid collecting excessive sensitive data in waivers and lead forms.
8. Respond to customer access, correction, and deletion requests for Host-controlled CRM records.
9. Notify customers of material privacy practice changes the Host initiates.
10. Ensure scraping targets are permitted and robots.txt overrides are justified.
11. Configure amusement-tax and dynamic-pricing disclosures for customer-facing flows when applicable.
12. Retain financial records for affiliate payouts and gift cards per applicable law.
13. Train staff with CRM access on confidentiality and role scopes.
14. Report suspected platform security issues to 3rdSpace promptly.
15. Execute a Data Processing Addendum with 3rdSpace when required by scale or jurisdiction.

Appendix I — 3rdSpace Internal Processing Activities (ROPA-Style Summary)

Appendix J — Detailed Rights Request Workflow

Step 1: User submits request via Privacy settings or privacy@ email. Step 2: We acknowledge receipt within 10 business days (target). Step 3: We verify identity using Account login or supplemental factors for email-only requests. Step 4: We classify request type: access, correction, deletion, portability, opt-out, limitation, appeal. Step 5: For Host-controlled CRM data, we notify the Host or provide Host contact where direct access is inappropriate. Step 6: We locate data across Firebase collections, Stripe (billing), and archived exports. Step 7: We apply exceptions: legal retention, ongoing disputes, anti-fraud holds, backup tapes within retention. Step 8: For deletion, soft-delete clock starts (30 days) before purge jobs run. Step 9: For export, 14-day delay clock starts; Cloud Function builds zip; signed URL emailed. Step 10: We close the request and retain minimal metadata of the request for compliance (3 years).

Appendix K — CPRA Sensitive Personal Information Limitation

We do not use or disclose Sensitive Personal Information for purposes other than those permitted by CPRA regulations without offering a right to limit. Hosts may configure tools that collect additional sensitive fields (for example, health-related waiver questions); in those cases, the Host is the controller and must provide any required notices and limitation rights directly to the consumer.

Where Stripe or government processes require collection of tax identifiers for Connect payouts, we rely on Stripe's controlled collection environments and limit our own storage to references and status flags necessary for operations.

Appendix L — Email and SMS Regulatory Cross-Reference

CAN-SPAM (email): Commercial emails include identification, valid physical postal address of the sender, and unsubscribe mechanism. Hosts sending through our Email tool remain responsible for content truthfulness and consent.

TCPA (SMS): Marketing SMS requires appropriate consent. Hosts must honor STOP. We implement inbound webhooks verified by Twilio signature.

A2P 10DLC: US application-to-person long codes require brand and campaign registration. Hosts complete registration before large sends; we surface status in the SMS tool.

State mini-laws: California, Florida, Oklahoma, and others impose additional SMS/email rules; Hosts with customers in those states bear compliance responsibility as controllers.

Appendix M — Extended Tool Privacy Notes

CRM (Customer Relationship Management)

Org-wide customer graph with brand/location scoping. Auto-entry links Accounts to contacts. Hosts may import CSV, POS data (planned), and tool-generated events. AI Booster may read wide schemas to produce demographic summaries—host approves use. Deletion of a contact soft-deletes for 30 days unless Host purges immediately.

Email Management

SendGrid transports messages; webhook events update delivery and suppression. Per-recipient records retained two years. Usage is debited from the unified credit pool at the Email Rate, with a monthly true up in credit worked out from counts of emails per Organization, not from anyone's personal information (Terms of Service Section 22.4); the Service Charge was charged when the credit was bought.

SMS Management

Twilio transports messages; STOP inbound webhook verified cryptographically. Records retained two to four years. A2P registration metadata stored per org.

AI Booster

Gemini (and future Claude) processes prompts without training per vendor terms. 14-day disable delay. Per-tool toggles limit spend. Usage ledger ties to credit pool.

QR Code Generator & Short Links

Click and scan analytics may include device type and timestamp; we avoid placing PII in URLs.

Website Services

Hosted sites and forms write leads into CRM. Host owns site content and notices.

SEO & GEO Audit

Crawls host's own sites; may send findings to Gemini when Booster enabled.

Business Profile Manager

Listing audits may use Google Business Profile APIs; stores profile change audit log.

Web Scraper

Host accepts responsibility when overriding robots.txt; audit trail retained two years.

Bookings

Collects guest contact and party details into CRM; payment may flow through host Stripe.

Ticketing Tool

Collects buyer information; amusement tax settings are host-configured.

Digital Waiver

May store signatures and custom fields; hosts must provide appropriate notices.

Lead Capture Forms

Embed on host sites; submissions create CRM contacts with source tags.

Campaign Manager

Orchestrates multi-step email/SMS journeys; step records retained two years.

Review Management

Stores public review metadata and host replies; may use third-party APIs.

Social Media Manager

Drafts and schedules posts; tokens stored encrypted per platform policy.

Staff Scheduling

Employee names, shifts, and contact info visible per RBAC scopes.

Affiliate Marketing

Affiliates are CRM contacts; Stripe Connect collects tax identity; 1099-K may issue.

Smart TV CMS

Pairs devices via short codes; does not stream user PII to TVs beyond schedule metadata.

Media Library

Stores host-uploaded assets; EXIF may be stripped at upload (implementation TBD).

Invoicing & Expenses

Vendor and customer billing records; financial retention per tax schedules.

Products & Menu Manager

Menu and pricing data; dynamic pricing disclosures are host responsibility.

Inventory Manager

Stock counts and vendor SKUs; no consumer PII unless linked orders exist.

Gift Card & Loyalty

Balances and redemption history; money trail audited.

Karaoke Manager

Queue names only; no audio hosting by 3rdSpace; PRO licensing is host duty.

State Tracker

Sales pipeline cards may contain notes about individuals; Admin+ for destructive actions.

3rdSpace App Presence

Public-facing app profile fields; future Consumer App publishing.

Internal Admin

Cross-org search on internal CRM; impersonation read-only with adminAuditLog.

Demo Sales Mode

Seeded fake data; real emails gated into org-3rdspace CRM for sales follow-up.

Version: 2026-07 Document date: 2026-05-19 Effective date (planned): [TBD at launch]