Privacy Policy

Slotsy.io ("Slotsy", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our online booking platform and related services.

By using Slotsy, you consent to the data practices described in this policy. If you do not agree, please discontinue use of our services.

We collect information you provide directly: name, email address, phone number and business information when you create an account or make a booking. Card details (card number, expiry date, CVC) are entered directly into Stripe, our payment processor, and never reach Slotsy. Of a payment, Slotsy sees the amount, currency, payment method type, the last four digits of the card, the payer's email and the payment status.

We automatically collect technical data: IP address, browser type, device information, pages visited, and interaction data through cookies and similar technologies.

For business accounts, we collect: company name, address, services offered, staff information, and scheduling data necessary to operate the booking platform.

Our public directory at slotsy.io/discover lists two kinds of business: those that use Slotsy, and those that do not. The second kind comes from OpenStreetMap, a public map database, and is published here under the Open Database License (ODbL). We did not receive this information from the businesses themselves.

For each such listing we hold what OpenStreetMap holds: the name, the type of business, the address and coordinates, and sometimes a phone number, a website and opening hours. Where the business is a sole trader, this is also personal data about that person.

We publish these listings in our legitimate interest (Art. 6(1)(f) GDPR) in offering a directory that is useful before it is complete. Each such listing states plainly that the business is not on Slotsy, shows no rating, and cannot be booked through us.

If this is your business and you do not want it listed, write to [email protected] and we will remove it. We do not ask for proof of ownership and we do not review the request. Once removed, a business is not put back by a later import.

The database we derived from OpenStreetMap is available at slotsy.io/api/public/unclaimed/export under the Open Database License, as that licence requires.

Slotsy Business is our iPhone app for studio owners and staff, not for the studio's customers. You sign in with the same account you use for the web admin panel at admin.slotsy.io.

Sign-in. The app keeps your sign-in token in the device's secure storage (iOS Keychain). The token is valid for 90 days and is renewed while you use the app. We store the device name and platform so that the device appears under My devices in the web admin panel, where you can sign it out remotely.

Push notifications. Only if you allow them in iOS. We store the device's push token, its platform and the app language on our servers. Notifications are delivered through Expo (650 Industries, Inc., USA) and the Apple Push Notification service. A notification carries the service, the date and the time of a booking; it never carries the customer's name, phone number or email address.

Your studio's customers. The app shows staff the same customer details as the web admin panel (names, phone numbers, email addresses, bookings, memberships), loaded from our servers. For this data Slotsy acts as a processor on behalf of the studio, under the Data Processing Agreement (slotsy.io/legal/dpa).

The app contains no analytics or advertising tools, does not track you across other companies' apps or websites, and does not access your location, contacts, camera or photos.

Links to admin.slotsy.io in our emails open the app when it is installed. The link carries only the address of the page.

Deleting your account. In the app: More → Delete my account. A studio owner can delete the whole studio there too (More → Delete the studio). You can also write to [email protected].

We use your data to provide and improve our booking services, process transactions, send appointment reminders, and communicate important updates about your account.

We analyze usage patterns to improve our platform, develop new features, and ensure service reliability. We may use aggregated, anonymized data for research and analytics.

With your consent, we may send promotional communications about new features, special offers, or partner services. You can opt out at any time.

We process your personal data based on the following legal grounds under GDPR:

We do not sell your personal data to third parties. We share data only in the following circumstances:

With service providers who help us operate our platform: Stripe for payment processing (see stripe.com/privacy), Hetzner for hosting, Cloudflare for content delivery and protection, Amazon Web Services for email delivery, and Sentry for error monitoring. These providers are contractually bound to protect your data.

Expo (650 Industries, Inc.) and Apple, only to deliver push notifications from the Slotsy Business app, as described in the section on the app.

With the business you are booking with, to facilitate your appointment. Businesses on our platform have their own privacy obligations.

When required by law, to comply with legal processes, or to protect the rights and safety of Slotsy, our users, or others.

If you connect your Google Calendar in Slotsy (Settings → Integrations → My calendar, or My calendar in the menu), we ask Google for two permissions: to view your calendar events (calendar.readonly) and to create and change events (calendar.events), and for your email address and name to show which account is connected.

What we read: only the start and end time of events in your primary calendar for the next 60 days, and whether an event marks you as busy. We do not read, store or show event titles, descriptions, locations or attendees.

Why: so that the hours you are busy in your own calendar are not offered to your clients on your booking page. These times are refreshed every 10 minutes and are stored only as time intervals; they are deleted when you turn this off or disconnect the calendar.

What we write: when a client books with you, Slotsy adds the booking to your calendar as an event (service name and time), moves it when the booking is moved and removes it when it is cancelled. You can turn this off in the same place ("Add my bookings to the calendar").

We do not sell Google user data, do not use it for advertising, do not transfer it to third parties except as needed to provide this feature, and do not use it to train AI or machine learning models. People at Slotsy do not read it, except with your explicit consent, for security purposes or to comply with law.

Slotsy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time in Slotsy — this deletes the stored busy times and revokes our access — or remove Slotsy's access in your Google Account at myaccount.google.com/permissions.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, typically for the duration of your account plus a reasonable period after.

Booking records are retained for up to 3 years after the last booking for business analytics purposes. Financial records are retained as required by applicable tax laws.

You may request deletion of your data at any time, subject to legal retention requirements.

Under GDPR and applicable data protection laws, you have the right to: access your personal data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, and object to processing.

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

Our primary data processing occurs within the EU.

Slotsy is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a notice on our platform. Your continued use after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at: [email protected]

Data Protection Officer: [email protected]