Police said the spa recorded patrons disrobing without consent and kept the footage on its server.