Legal

Privacy Policy

Effective October 23, 2026

Short version: we collect only what we need to run snapshots, audits, and projects. We don't sell your information, and we don't want patient health information.

"We," "us," and "Spa Operator Systems" mean Kindrastone LLC, a Florida limited liability company doing business as Spa Operator Systems. This policy covers spaoperatorsystems.com, and the email, booking, intake, and payment steps that go with our services.

What we collect

What you send us. When you email us or request a snapshot: your name, email address, spa name, city and state, website, top services, number of locations, and anything else you choose to tell us.
Our snapshot request form. The form on our home page collects your spa name, website, city and state, email address, and the headache you describe. We use them only to reply to your request and send your snapshot. Submissions are delivered to our email inbox.
Audit and setup information. What you share through our intake form, on calls, and in shared folders: your services, voice, goals, who on your team will run the system, and access you grant us to your own accounts, such as Google Business Profile manager access.
Booking details. If you book a call, the name, email, and answers you give on the booking form.
Payment details. Payments are handled by Stripe. We see your name, email, spa name, the amount, and the payment status. We don't see or store your full card number.
Basic website logs. Our host, Vercel, may log technical details such as your IP address, browser type, and the pages requested, to deliver and secure the site.
Public information. For snapshots and audits we review public information about your spa, such as your website, Google Business Profile, and reviews, and the answers AI assistants give about it.

Our site doesn't use analytics, advertising, or tracking cookies or scripts. It loads fonts from Google Fonts, so Google receives your IP address and browser details when the page loads.

No health information, please

We provide marketing and operations services. We don't need, and ask you not to send, patient or client health information (PHI), including client lists with treatment details, medical records, intake or consent forms, or before-and-after photos tied to a named person. We are not a HIPAA business associate and don't offer HIPAA-compliant services. If you send us health information by mistake, tell us right away and we'll delete it.

How we use it

To send your snapshot and reply to you, including one follow-up.
To deliver audits, setups, and monthly work, and to schedule calls.
To take payment, send receipts, and keep business and tax records.
To keep the site and our systems secure, and to meet legal obligations.

We email prospects only about the snapshot you asked for. Reply "no thanks" at any time and we'll stop.

We don't sell your data

We don't sell your information or share it for advertising. We share it only with the service providers below, to run our business, or when the law requires it.

Who processes your data

Google Workspace (email, calendar and booking, Google Meet, Drive and Docs, and forms).
Stripe (payments, receipts, and the customer portal for monthly plans).
Vercel (website hosting, and processing snapshot form submissions).
AI model providers (large language model services we use to research, draft, and analyze for your project). What you share with us for your project, such as your services, voice, goals, and public competitor information, may be entered into these tools. We use business or API plans and settings that don't allow the provider to train its models on your information. We don't enter patient or client health information, passwords, or payment card numbers into them.
Google Fonts (fonts for this site).

These providers have their own privacy policies. If we add a provider that handles your information, we'll update this page.

Call recordings

We may record calls and working sessions, including the recorded walkthrough in setup. We tell everyone at the start and record only with the consent of everyone on the call, as Florida law requires. Recordings are kept in our Google Workspace and shared with you where useful. Tell us if you'd rather not be recorded.

How long we keep it

We keep your information only as long as we need it to deliver the services you asked for, answer questions afterward, and meet our accounting, tax, and legal obligations. If you ask us to delete your information, we will, except for records we're required to keep.

Your choices and rights

You can ask us to tell you what we hold about you, correct it, or delete it, and you can opt out of our emails at any time. Email hello@spaoperatorsystems.com and we'll reply within a reasonable time. Everything we build for you lives in your own accounts, so you can also remove our access whenever you like.

Security

We use reputable providers and limit who can see your information. No system is perfectly secure. Please don't email us passwords. Use the invite or manager-access features of your accounts instead.

Children

Our services are for business owners. We don't knowingly collect information from anyone under 18.

Changes

If we change this policy, we'll post the new version here with a new effective date.

Contact

Kindrastone LLC, doing business as Spa Operator Systems
hello@spaoperatorsystems.com