PRIVACY POLICY

1. Introduction

thespotnashua.com (the "Site"), is owned and oeprated by The Spot Kava Bar & Music ("The Spot"), located at 217 Main Street, Nashua, NH 03060. The Spot is the data controller for personal information collected through the Site. This Privacy Policy explains what information is collected, how it is used, who it is shared with, and the choices you have.

By using the Site, you agree to the terms of this policy. If you do not agree, navigate away from the Site.

2. Information We Collect

We only collect personal information that you voluntarily provide, or that is automatically generated by your use of the Site.

2.1 Information you give us

• Contact form (on the Contact page): your first name, last name, email address, subject line, and message.
• Booking request form (on the Book Your Band page): your first name, last name, email address, and the date and time slot you select for a possible performance.

2.2 Information collected automatically

• Privacy-friendly analytics via Plausible Analytics. Plausible does not use cookies and does not track visitors across sites. It records aggregate page views, referrer, browser, device type, country, and entry/exit pages. No personal identifiers are collected and no data is sold or shared with third parties.
• Server logs (held briefly by our hosting providers): IP address, user agent, and request timing, used to detect abuse, debug errors, and protect the Site.

3. How We Use Your Information

• To respond to inquiries you submit through the Contact form.
• To review, accept, or decline booking requests you submit through the Book Your Band form, and to follow up with you about scheduling.
• To improve the Site (page performance, content quality) based on aggregate, non-identifying analytics.
• To protect the Site and users against spam, abuse, and security incidents.

We do not sell or rent your personal information. We do not share it with advertisers or data brokers. We do not use your personal information for cross-context behavioral advertising.

4. Legal Bases (where applicable)

For visitors in jurisdictions that require a legal basis (e.g., GDPR), we rely on: (a) the steps necessary to respond to your request (contact and booking forms), and (b) our legitimate interest in operating and securing the Site (server logs, privacy-friendly analytics).

5. Third-Party Services

The Site uses the following third-party providers, each of which processes limited data on our behalf:

• Tally at tally.so/privacy-policy. Collects and stores messages and booking requests submitted through the Contact and Book Your Band forms.
• Google Calendar at policies.google.com/privacy. Publishes the public events calendar shown on the Live Music page. The Site only reads event dates/times from the published calendar via the Google Calendar API; no visitor data is sent to Google through this integration.
• GitHub Pages at GitHub Privacy Statement. Static hosting for the Site.
• Plausible Analytics at plausible.io/privacy. Cookieless, privacy-friendly traffic analytics.
• Google Maps at policies.google.com/privacy. Provides the embedded location map on the Home and Contact pages. The map loads only when scrolled into view.

We do not use Stripe, Meta Pixel, Google Analytics, Google Tag Manager, or any advertising network on the Site.

6. Cookies and Tracking Technologies

The Site itself does not set tracking cookies. Plausible Analytics is cookieless by design. The embedded Google Maps iframe (loaded only after you scroll to the map) may set cookies under Google's policy linked above.

7. Your Privacy Rights

Depending on where you live, you may have the right to: (a) know what personal information we hold about you, (b) request a copy or deletion of that information, (c) correct inaccurate information, (d) opt out of any sale or sharing of your personal information (we do not sell or share for cross-context behavioral advertising), and (e) not be discriminated against for exercising these rights.

California residents have these rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA. New Hampshire residents have similar rights under the New Hampshire Data Privacy Act (NH SB 255), which takes effect January 1, 2025. EU/UK residents have rights under the GDPR/UK GDPR.

To exercise any of these rights, email thespotnashua@gmail.com with the subject line "Privacy Request" and the request you'd like us to act on. We will verify your identity (by replying to the email on file) and respond within 45 days.

8. Data Retention

• Contact submissions: retained up to 24 months from last activity, then deleted, unless we need to keep them longer to resolve a dispute or comply with law.
• Booking requests: retained up to 24 months after the requested performance date, for scheduling, payment, and tax records, then deleted.
• Server logs: retained up to 30 days for abuse detection, then rotated.

9. Children's Privacy

The Spot is an all-ages, alcohol-free venue, but the Site is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided personal information through our forms, email thespotnashua@gmail.com and we will delete it. This complies with the federal Children's Online Privacy Protection Act (COPPA).

10. Security

We use industry-standard safeguards to protect your information: HTTPS/TLS in transit, encrypted storage at rest, access controls, honeypot anti-spam on every form, and per-tenant API key rotation. No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your own email account secure.

11. Breach Notification

If a security breach affecting your personal information occurs, we will notify affected individuals without unreasonable delay, consistent with New Hampshire RSA 359-C:20 and any other applicable state breach-notification laws. We will also notify the New Hampshire Attorney General when required by law.

12. International Users

The Site is operated from the United States. If you access it from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your jurisdiction. By using the Site, you consent to that transfer.

13. Do Not Track

The Site does not track users across other sites and does not respond to "Do Not Track" browser signals because there is no industry consensus on how to interpret them. Plausible Analytics, our only analytics provider, is cookieless and does not perform cross-site tracking.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top will always reflect the latest revision. For material changes, we will give reasonable prior notice on the Site or by email.

15. Contact Us

For privacy questions, requests, or complaints, contact:

Mike McDowell (owner of thespotnashua.com)
Attn: Privacy
217 Main Street, Nashua, NH 03060
Email: mike [at] thespotnashua [dot] com

For in-person venue questions (hours, events, lost-and-found):

Mike McDowell (owner of The Spot Kava Bar & Music)
217 Main Street, Nashua, NH 03060
Phone: (603) 718-4732