Privacy Policy

SpiritPay is a point-of-sale application operated by Skybound Solutions, LLC ("we", "us", "our"). This policy describes how we collect, use, and protect information when you use the SpiritPay iOS app or the TownSpirit website (townspirit.org).

• Account information — email address and display name when you sign in with Apple or Google
• Organization data — org name, branding, and menu/product catalog managed by administrators
• Transaction data — purchase amounts, items, timestamps, and payment method type (card vs. cash)
• Device information — device model, OS version, and crash logs (via Firebase Crashlytics)
• Device identifier (IDFV) — on devices enrolled as dedicated kiosk terminals, we collect the device's Identifier for Vendor (IDFV) to authorize the device without requiring a user sign-in. This identifier is stored in Firebase and can be removed by an organization administrator at any time.

• Process payments through Stripe's secure payment infrastructure
• Display transaction history to organization administrators
• Improve app stability through crash reporting
• Communicate service updates to organization contacts
• Compliance notifications: As a Stripe Connect platform, we are required to notify organization administrators if Stripe flags their account for risk review, restricts payouts, or requires additional verification. We use the email address associated with your organization account for this purpose.

All card payments are processed by Stripe, Inc. We never store full card numbers, CVVs, or sensitive cardholder data on our servers or within the app. Card data is read directly by the Stripe Terminal SDK and transmitted to Stripe's PCI-compliant infrastructure.

SpiritPay operates as a Stripe Connect platform. As part of our obligations under the Stripe Connected Account Agreement, we may receive notifications from Stripe about your connected account (e.g., risk flags, payout holds, or verification requirements). We use your administrator email address to relay these notices to you promptly. Stripe's own privacy practices are described at stripe.com/privacy.

Account and transaction data is stored in Google Firebase (Firestore) with security rules that restrict access to authorized users within their organization. Data is hosted in the United States.

Data breach notification. In the event of a security breach affecting your personal information, we will notify affected organization administrators within a reasonable time as required by applicable law, including the Michigan Identity Theft Protection Act (MCL 445.72).

We do not sell your personal information. We share data only with:

• Stripe — payment processing
• Google Firebase — data storage, authentication, crash reporting
• Organization administrators — transaction summaries for their org

You may request access to, correction of, or deletion of your personal data at any time. Organization administrators can delete their org and all associated data from within the app. To request account deletion or data removal, email support@townspirit.org with the subject line "Data Deletion Request". We will respond within 30 days. Enrolled dedicated devices can be removed by an org admin from the Devices section of the admin dashboard, which permanently revokes the device's access and removes its IDFV from our records.

SpiritPay is designed for use by organization volunteers and administrators aged 13 and older. We do not knowingly collect information from children under 13.

Skybound Solutions, LLC
Email: support@townspirit.org
Website: townspirit.org