Privacy Policy

Slotkite (“Slotkite”, “we”, “us”) gives service businesses a website, online booking and tools to manage appointments. Slotkite is a sole proprietorship based in Ontario, Canada. This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

It covers our website (slotkite.com), the Slotkite dashboard and mobile app, and the business websites and booking pages we host for our customers.

Who this policy is about

• Business users: owners and team members of businesses that use Slotkite (“Businesses”).
• Clients: people who book appointments with a Business through a website or booking page we host, or whose bookings a Business enters in Slotkite.
• Visitors to slotkite.com.

When a Business uses Slotkite to manage its clients and bookings, the Business decides what information it collects and how it’s used, and we process that information on the Business’s behalf. If you’re a client with a question about your information, you can contact the Business directly, or contact us and we’ll help.

Information we collect

From Business users

• Account details: name, email address and sign-in information. If you sign in with Google, Google shares your name, email address and profile picture with us.
• Business details: business name, address, phone number, email, opening hours, services, prices, photos, team members and website content.
• Billing: your subscription status and billing history. Payments are handled by Stripe; we don’t receive or store full card numbers.
• Online payments: if you connect a Stripe account to take payments from clients, its account ID and whether it can take payments. Stripe collects the business and identity details it needs directly from you.
• Mobile app: if you turn on notifications, a push notification token for your device, so we can tell you about new and changed bookings.
• Connected calendars: if a team member connects Google Calendar, the access Google grants and the busy times read from that calendar (see “Google Calendar” below).

From clients (on behalf of Businesses)

• Contact details: name, email address and, if given, phone number.
• Booking details: the service, date and time, team member, add-ons, price, notes, and answers to any questions the Business asks.
• Payments: if a Business takes payments online, the amount paid, the payment’s status and any refund. You enter your card details with Stripe, which processes the payment for the Business; we never receive or store full card numbers.
• Choices: whether you agreed to receive text messages about your bookings, and whether you’re subscribed to marketing emails from the Business.
• Text messages: whether each text was delivered, and if you reply STOP or START, your number and that choice. We don’t keep the content of other replies.

Automatically

• Technical information needed to run the service securely, such as IP address, browser type and request logs.
• Spam protection: when you book online, Cloudflare Turnstile checks that the booking is made by a person, using technical signals from your browser such as your IP address.
• Cookies needed to keep Business users signed in. We don’t use advertising cookies and don’t sell information to advertisers.
• Embedded content: a Business’s website can show a Google map of its address or a YouTube or Vimeo video. These load from Google, YouTube or Vimeo, which receive your IP address and may set their own cookies under their privacy policies. We use YouTube’s privacy-enhanced mode and Vimeo’s “do not track” setting.
• Fonts: Business websites and booking pages load their fonts from Google Fonts, which receives your IP address.

How we use information

• To provide the service: websites, booking, calendars and reports.
• To send messages about bookings: confirmations and reminders by email, and by text message to clients who agreed to receive them, and push notifications to Business users who turned them on.
• To draft website content with AI when a Business asks for it, using the business details it has entered (such as its name, type, description, address, services and website text). Client and booking information is not used.
• To take payments for bookings on a Business’s behalf, and to refund them when a booking is cancelled under the Business’s settings.
• To send marketing emails on a Business’s behalf, such as offers and reminders to book again. Booking online with a Business subscribes you to them; every one includes an unsubscribe link, and once you unsubscribe, booking again doesn’t sign you back up. Booking confirmations and appointment reminders aren’t marketing: they’re sent whether or not you’re subscribed, and carry the link to change or cancel your booking.
• To bill Businesses for their subscription.
• To provide support, keep the service secure, prevent abuse and meet legal obligations.

Text messages (SMS)

When a client gives their mobile number while booking with a Business that has texts on, or a Business records that a client agreed, we use that number to send booking confirmations, appointment reminders and cancellation notices for their bookings, until they reply STOP. Message frequency depends on the client’s bookings, usually one to three messages per booking. Message and data rates may apply.

We do not sell, rent or share mobile phone numbers or text message consent with third parties or affiliates for their marketing or promotional purposes. Phone numbers are shared only with our text message provider (Twilio), and only to deliver the messages described here.

Clients in the US and Canada can reply STOP to any message to stop receiving texts, or HELP for help. You can also contact us at support@slotkite.com.

Google Calendar

If a team member connects their Google Calendar, Slotkite writes their bookings to that calendar as events and reads the times they’re busy, so clients can’t book them when they’re unavailable. We store only the busy times, not the details of their other events, and use this access for nothing else. Team members can disconnect at any time from the dashboard or their Google account.

Slotkite’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share information with

We don’t sell personal information. We share it only with service providers that help us run Slotkite, under agreements that limit their use of it to providing their service to us:

• Convex: database and application hosting
• Vercel: website hosting
• WorkOS: sign-in and account security
• Stripe: subscription payments and, for Businesses that use them, client payments
• Resend: email delivery
• Twilio: text message delivery
• Google: sign-in with Google, calendar sync (when connected), address lookup, maps and website fonts
• Anthropic: AI website drafts, when a Business uses them (business details only; Anthropic doesn’t train its models on this data)
• Cloudflare: spam protection on booking forms
• Expo: push notification delivery to the mobile app

A Business can see the information about its own clients and bookings. We may also disclose information when required by law, or to protect the rights and safety of our users and the public.

Where information is stored

We’re based in Canada, and our service providers may store and process information in the United States and other countries. When information is transferred, it’s protected as described in this policy, but it may be accessible to authorities in those countries under their laws.

How long we keep information

We keep information while a Business’s account is active. When a Business deletes its account, its website goes offline right away and its data, including client and booking information, is permanently deleted 30 days later. Some records, such as billing history, may be kept longer where the law requires it. A STOP reply is kept so we keep honouring it, even after the Business that texted you is deleted.

Security

We use encryption in transit, access controls and reputable infrastructure providers to protect information. No service is perfectly secure; if we learn of a breach that affects you, we’ll notify you as the law requires.

Your rights

Depending on where you live, including under Canada’s PIPEDA and the EU and UK GDPR, you may have the right to access, correct or delete your personal information, to object to or restrict how it’s used, to withdraw consent, and to receive a copy of it. To make a request, email support@slotkite.com. If your request is about information a Business holds about you as its client, we may refer it to that Business or help it respond.

You can also complain to a data protection authority, such as the Office of the Privacy Commissioner of Canada or your local authority in the EU or UK.

Children

Slotkite is not directed to children under 16, and Business accounts are for adults only.

Changes to this policy

We may update this policy. We’ll change the “Last updated” date above and, for significant changes, notify Business users by email or in the dashboard.

Contact

Slotkite, Ontario, Canada
support@slotkite.com