Privacy Policy

Slotted Labs, LLC Privacy Policy

Slotted Labs, LLC ("Slotted," "we," "our," or "us") respects your privacy and is committed to protecting the information you and your clients entrust to the Services. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, applications, and related services (collectively, the "Services").

Your use of the Services is also governed by our Terms of Service, available at slotted.so/terms.

1. Company Information

Slotted Labs, LLC
1207 Delaware Ave
Wilmington, DE 19806
Email: hello@slotted.so

2. Data Controller and Processor Relationship

Slotted operates a multi-tenant platform. Understanding who is responsible for what data is important.

If you are a tenant business using the Services to manage your clients and bookings, you are the data controller for your clients' personal information. You determine why and how that information is collected and processed. Slotted acts as a data processor, or service provider, on your behalf. We process your clients' data only to provide the Services you have contracted for.

If you are an end client booking an appointment or interacting with a business through the Services, your primary relationship regarding that data is with the business you are booking with, not with Slotted. If you have questions about how a particular business handles your information, please contact that business directly.

This distinction matters practically: data access and deletion requests from end clients should generally be directed to the tenant business that collected the information. Where required by applicable law, Slotted will cooperate with such requests.

3. Information We Collect

3.1 Information You Provide

When you create an account and use the Services, we may collect:

• Name and contact information (email address, phone number)
• Business information
• Billing and payment information
• Appointment and booking records
• Client records and notes
• Communications you send through the Services
• Uploaded documents, files, images, consent forms, and intake forms
• Staff account information
• Calendar data you choose to synchronize

3.2 Information Collected Automatically

When you access the Services, we may automatically collect:

• IP address and approximate location
• Browser type and version
• Device and operating system information
• Pages visited, features used, and session duration
• Referring URLs
• Log data and error reports
• Cookie identifiers and similar tracking data

4. Authentication

Users may sign in using:

• Google Sign-In
• Sign in with Apple
• Email address and password

When you authenticate using a third-party provider, we may receive basic profile information such as name and email address as permitted by that provider and by your account settings with them.

5. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Services
• Process bookings, payments, and refunds
• Manage client records on your behalf
• Send transactional SMS and email notifications to you and your clients
• Synchronize calendar data you have authorized
• Authenticate users and maintain account security
• Detect and prevent fraud and abuse
• Analyze usage patterns and improve the Services
• Generate aggregated and de-identified analytics
• Comply with legal obligations
• Respond to your support requests and communications

6. Aggregated and De-Identified Data

Slotted may collect, aggregate, anonymize, and de-identify information derived from Customer Data and usage of the Services. De-identified information cannot reasonably be used to identify any individual person or business. We may use such information for analytics, product improvement, platform security, benchmarking, and internal operations. This information is not subject to the restrictions on Customer Data described in our Terms of Service.

7. Payment Processing

Subscription payments for the Services are processed by Stripe. Payments collected from your clients through your Slotted-powered booking page are processed through your connected Stripe account, through which you operate as the merchant of record.

We do not store full payment card numbers on our servers. Your payment information and your clients' payment information are subject to Stripe's privacy policy and security practices.

8. Calendar Integrations

If you connect Google Calendar, Microsoft Outlook, Apple Calendar, or a similar calendar service, we access and process calendar information solely to provide the synchronization and scheduling features you have enabled. We do not use calendar data for advertising or share it with third parties beyond what is required to operate the integration.

9. SMS and Email Communications

The Services include transactional SMS and email notifications sent to you and your clients. SMS messages are delivered through Telnyx. Email notifications are delivered through Resend. As a tenant using these features, you are responsible for obtaining all required consents from your clients to receive such communications under applicable law.

When a client opts in to transactional SMS during booking, we retain the consent disclosure, phone number, booking context, timestamp, IP address, and user agent to operate booking communications and demonstrate consent. Message frequency varies. Recipients may reply STOP to opt out or HELP for help.

We do not sell, rent, or share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. We may disclose this information to service providers, including Telnyx, solely as needed to deliver transactional messages through the Services.

10. Sensitive and Regulated Information

Slotted provides general-purpose tools for storing client notes, intake forms, consent forms, and uploaded files. Slotted does not specifically target industries subject to specialized privacy regulations such as HIPAA, and the Services are not designed or marketed as compliant with such regulations.

Tenants are responsible for determining whether information they upload or store through the Services is subject to industry-specific regulations or legal requirements, and for using the Services in accordance with those requirements. Slotted's Terms of Service and this Privacy Policy govern our obligations with respect to the data you store with us; they do not extend to regulatory obligations specific to your industry or business.

11. Cookies and Analytics

We use cookies and similar tracking technologies to operate the Services, remember your preferences, and understand how users interact with the platform. We use the following analytics providers:

• Microsoft Clarity: session recording and heatmap analytics
• Hosting and infrastructure monitoring services

You may configure your browser to reject cookies, but some features of the Services may not function properly if you do.

12. Sharing of Information

We do not sell personal information.

We may share information with the following categories of third parties as necessary to operate the Services:

• Payment processors (Stripe)
• SMS delivery providers (Telnyx)
• Email delivery providers (Resend)
• Database, authentication, and storage providers (Supabase)
• Application hosting providers (Vercel)
• Authentication providers (Google, Apple)
• Calendar integration providers (Google, Microsoft)
• Analytics and monitoring providers (Microsoft Clarity)
• Professional advisors such as attorneys and accountants, under confidentiality obligations
• Government authorities or law enforcement when required by applicable law or legal process

A current list of our subprocessors is maintained at slotted.so/subprocessors.

13. Data Retention

We retain your account information and Customer Data for as long as your account is active and as necessary to provide the Services.

Following account cancellation or termination, Customer Data may be retained for up to 90 days to permit data export requests, after which it may be deleted or anonymized, except where retention is required by applicable law, active disputes, audit obligations, or backup integrity processes.

Aggregated and de-identified data derived from Customer Data may be retained indefinitely.

We may retain backup copies of data for reasonable periods consistent with our security and disaster recovery practices.

14. Security

We implement reasonable administrative, technical, and organizational safeguards to protect information against unauthorized access, loss, alteration, and disclosure. Our infrastructure is hosted on Supabase and Vercel, both of which maintain industry-standard security practices.

No method of data transmission or storage is completely secure. We cannot guarantee absolute security, and use of the Services is at your own risk.

15. International Users

The Services are operated from the United States. Your information may be processed and stored in the United States and in other jurisdictions where our service providers maintain infrastructure. We process personal information in accordance with applicable privacy laws.

16. Children's Privacy

The Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at hello@slotted.so.

17. Your Rights

Depending on your location, you may have rights regarding your personal information under applicable law, including rights to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Restrict or object to certain processing
• Request a portable copy of your data

California residents may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information is collected, sold, or disclosed, and the right to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us at hello@slotted.so. We will respond to verified requests within the timeframes required by applicable law. Note that if you are an end client of a tenant business, your request may need to be directed to or coordinated with that business as the data controller for your information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address associated with your account or by posting a notice within the Services prior to the change taking effect. The "Last Updated" date at the top of this page reflects when the most recent version was published.

Continued use of the Services after an updated Privacy Policy becomes effective constitutes your acceptance of the revised terms.

19. Contact

Questions or requests regarding this Privacy Policy may be directed to:

Slotted Labs, LLC
hello@slotted.so
slotted.so