Privacy Policy

1. Who operates SiteSlot and our roles

SiteSlot is operated by Codedrops Solutions DOO, registered in Belgrade, Serbia. Registration number: 21572080. Tax identification number (PIB): 111925187. Contact: support@siteslot.app. The SiteSlot platform and its public marketing website are separate from the customer-facing business websites at slug.siteslot.page.

We determine the purposes and means of processing for platform account administration, subscriptions, service security, abuse prevention, support and infrastructure operations. For customer and booking data a business enters or collects through its website, that business generally determines the booking purposes and SiteSlot processes the information as its service provider or processor, as applicable. The precise role depends on the flow, applicable law and the relevant agreements; the same role does not necessarily apply to every use of the service.

2. Information we process

To create a preview we process the business or brand name, any logo and the preview configuration. Owner accounts involve email addresses, account identifiers, authentication and session information. Business configuration may include identity and contact details, services, prices, locations and maps, opening hours, staff profiles, photographs, uploaded media and website content, including its published version.

When customers book, we process their names and contact details together with the chosen service, staff member, date and time, booking status and changes or cancellations. Secure booking-management links allow customers to manage an appointment. Notification records include destinations and delivery status. Assistance requests and support correspondence contain the information you send us.

We also process plan and entitlement status, subscription or payment-provider references where used, and access, security and application logs. Requests to third-party services may disclose technical metadata such as an IP address, browser information and the requested resource. Business content selected for publication is public; customer contact details, private booking records and secure management links are not intended for open publication.

3. Purposes and legal bases

We process information to prepare and operate websites, administer accounts and plans, manage bookings, send service messages and provide requested assistance. Where applicable, this is necessary to perform a contract or take steps you request before entering one. We may rely on legitimate interests for security, abuse prevention, troubleshooting and reliability, where those interests are not overridden by your rights, and on legal obligations for accounting, tax or lawful requests.

Consent is used only where it is an appropriate basis for the particular processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. A booking does not automatically require blanket consent to all data processing. Businesses must establish a lawful basis for customer and staff information they provide, give the required information to those people and limit collection to what their service reasonably needs.

4. Service providers

Our hosted service uses Supabase for PostgreSQL, authentication and private media storage, and Vercel for hosting. These providers process the application data and request information needed to deliver their services. Cloudflare Turnstile processes security and request information to help prevent automated abuse. Google Maps Embed displays business locations and may receive browser and request metadata when an embedded map loads. See Supabase, Vercel, Cloudflare and Google for their privacy notices.

The production email configuration uses Zoho CPaaS for transactional booking notifications and Supabase Auth email delivery. Delivery involves recipient addresses, message content and delivery metadata; see Zoho. Paddle processes purchase information in its Merchant of Record role when paid billing through Paddle is enabled; see Paddle Privacy Notice. SiteSlot does not use Google Analytics or Meta Pixel in this version.

We share information with providers as needed to operate the service, and may disclose it when required by law or necessary to protect users, the service or our legal rights. A provider's own notice applies to processing it carries out for its own purposes.

5. Google Sign-In and Google Calendar synchronization

Google Sign-In may be used to authenticate a SiteSlot business owner. Connecting Google Calendar is a separate, optional authorization; signing in alone does not grant Calendar access. For a connected Google account, we use its stable account identifier and verified email address to identify the connection and show the account label.

We retrieve the connected account's available calendar identifiers, names and access roles so the owner can select staff work calendars and optional busy-only sources. On selected work calendars, we read limited event fields such as identifiers, start and end times, status, free/busy state and change or deletion indicators. On selected busy-only calendars, we use occupied time intervals to prevent double bookings. We do not request existing Google event titles, descriptions, attendee lists, attachments or locations.

For selected writable work calendars, SiteSlot may create, update or delete Google Calendar events when SiteSlot bookings are created, changed or cancelled. The event title we write includes the service name and customer's name; the event also contains the appointment time and status. Changes or deletions of corresponding events made in Google Calendar may update SiteSlot bookings, subject to validation and conflict safeguards.

We use Google Calendar information only for the scheduling, availability and synchronization functions enabled by the business. We do not sell Google user data, use it for advertising or profiling, or share it with advertising platforms or data brokers. Connection information, selected calendar mappings, limited event references, availability intervals and synchronization records are stored in the hosted SiteSlot database to operate these features. Google OAuth refresh tokens are encrypted at rest, and access is restricted to authorized application operations.

The owner may disconnect Google Calendar in SiteSlot and may revoke access from their Google Account. Disconnecting removes the stored Calendar authorization credential and stops further synchronization; it does not automatically delete existing SiteSlot bookings or Google Calendar events already created. Limited integration history and booking records may remain under the retention and deletion provisions below; deleting the business removes its associated SiteSlot Calendar Sync records.

6. Push notifications

Push notifications are optional and off by default. In an installed SiteSlot Owner app, a business owner can enroll an individual device for selected booking alerts, including new bookings, booking requests, cancellations and rescheduling. A customer can separately enroll a device for reminders about a specific booking, after booking or through an authorized Manage Booking flow in the salon's installed Booking app. Choosing not to enable push notifications does not prevent booking, managing an appointment or receiving regular transactional booking emails.

Enrollment requires an affirmative action and, where applicable, notification permission from the browser or operating system. For optional Owner push processing where SiteSlot determines the purposes and means, we rely on consent under Article 6(1)(a) of the GDPR. For customer booking reminders, the business generally determines the purposes and applicable legal basis for its customers' data, while SiteSlot processes that data as its service provider or processor, as applicable. You can withdraw consent to optional push notifications at any time without affecting processing lawfully carried out before withdrawal; disabling push does not cancel an appointment.

To provide this feature, we process a browser-generated push subscription, including its destination endpoint and cryptographic keys, plus the device's association with the relevant owner sign-in or booking, notification choices and limited technical records of delivery attempts and outcomes. Subscription material is encrypted when stored in our database. Push notifications are operational booking messages, not advertising.

Delivery uses the push service associated with your browser or operating system, which may be operated by Apple, Google, Mozilla or Microsoft. That service receives the technical routing information and encrypted notification payload necessary to forward a message to your device, and may process technical metadata under its own privacy notice. Depending on the provider, processing may involve international transfers; see the Service providers and International transfers sections of this policy. Depending on your device settings, notification content, such as the business, service and appointment time, may be visible on a locked screen.

Owners can disable enrollment for a device in Settings → Push notifications → This device and can choose which alert types to receive. Customers can revoke reminders for an individual booking or turn them off for the device in the salon's installed Booking app. Browser or operating-system settings can also block notifications, but use the in-app controls to remove a stored enrollment. Owner devices stop being eligible after the relevant sign-in ends or is revoked; booking-specific consent ends when the booking is cancelled, completed or reassigned, or when the relevant customer contact is corrected, while rescheduling preserves eligible consent. Push delivery is best effort, not guaranteed; a notification already accepted by a push service may still appear after enrollment is disabled.

The encrypted push endpoint and keys are erased from our stored record when a device subscription is disabled, revoked, invalidated or retired. Registrations tied to ended owner sign-ins are retired during the next daily retention process. Customer devices with no active booking are retired after 30 days without a new enrollment or relevant booking change. Revoked booking consents are deleted after 30 days; deactivated device records are deleted after 30 days when retained delivery history no longer refers to them. Per-device delivery history is normally kept for 90 days after the related delivery reaches a final state; unresolved outcomes may be retained longer as evidence of a possible send. Deletion of a Business removes its associated push data under the ordinary Business deletion procedure. For privacy requests, see Rights and requests or contact support@siteslot.app.

7. Payment information

For purchases made through Paddle, Paddle is the Merchant of Record and authorized reseller. It processes payment methods, billing information, invoices, taxes, refunds and subscription transactions under its own terms and privacy notice. SiteSlot retains the plan, entitlement, status and provider references needed to administer access and reconcile the subscription; it does not store your full card details. See Paddle Buyer Terms, Paddle Privacy Notice and our Refund Policy.

8. Public websites and private records

The business owner selects the content published on the business website, including business contacts, staff profiles and media. Customers can book without a SiteSlot account where booking is enabled. Their contact details and booking records are private service records, not a public customer directory. Secure management links should be kept private because they allow access to the relevant booking.

For requests concerning a business's customer or booking data, contact that business, which generally controls the booking purposes. You may also contact SiteSlot at support@siteslot.app; we will address requests within our role and, where appropriate, help direct them to the responsible business.

9. Retention and deletion

Cancellation does not start the retention period: paid access continues until the paid-through date. After a subscription has ended and paid access has expired, the public website and public booking deactivate. Eligible business, website and operational data are retained for 90 days from the end of paid access. We send a warning before deletion. Reactivating the subscription within this window allows restoration before deletion; after the window, eligible product data are permanently deleted.

Mandatory tax and payment records may need to be retained under applicable law. Security logs and backup copies may remain for justified legal, security or technical purposes under the applicable retention arrangements, and deletion from backups follows their documented cycles. These exceptions do not make deleted product data available for ordinary use. Account deletion or an owner's lawful deletion request may follow a separate process. Contact support@siteslot.app for a request or questions about particular records.

10. Cookies and similar technologies

SiteSlot uses cookies and similar technologies that are necessary to keep accounts secure and the service working, including authentication and session cookies on the Owner Portal. We do not use Google Analytics, Meta Pixel or advertising cookies in this version of SiteSlot. Some embedded or security services, such as Google Maps and Cloudflare Turnstile, may process information or use their own technologies; the relevant providers and their notices are described above. You can manage cookies in your browser, but disabling essential cookies may prevent sign-in and other features from working.

Owner and operator authentication uses cookies scoped to the relevant host, rather than shared across all business websites. Some session cookies are HttpOnly, restricting access from browser scripts, and Secure when served over HTTPS. Paddle may also use its own technologies during checkout or subscription management; its notice governs that processing.

11. Security

We use proportionate technical and organizational measures to protect the service and its information, including access controls, authenticated management surfaces and infrastructure security features. No online service can guarantee absolute security. Keep your credentials and booking-management links private and report suspected compromise or a security concern to support@siteslot.app.

12. Rights and requests

Depending on applicable law and the circumstances, you may request access, correction, erasure, restriction of processing, portability or object to processing based on legitimate interests. Where consent is the basis, you may withdraw it. Send requests to support@siteslot.app. We may need to verify your identity and connection to the relevant records, and lawful exceptions may limit a request or require continued retention.

For customer booking data, the business may need to handle your request as the controller; you may contact both the business and SiteSlot. You may complain to the competent data protection authority where applicable, including the Serbian Commissioner for Information of Public Importance and Personal Data Protection: poverenik.rs.

13. Children and minors

Business owners must not use SiteSlot unlawfully to process children's or minors' information. Where a business handles customer data involving minors, it is responsible for the required legal basis, permissions and parent or guardian involvement under applicable law, and for limiting the information to what its service needs. Parents or guardians with concerns may contact the business or support@siteslot.app.

14. International transfers

Providers may operate infrastructure or process information in more than one country. International transfers are subject to applicable data protection requirements. Where safeguards are legally required, the relevant arrangements must use a recognized lawful mechanism, such as an applicable adequacy decision or appropriate contractual safeguards. Contact support@siteslot.app for information about the arrangements relevant to your data.

15. Policy changes and contact

We may update this policy as SiteSlot or legal requirements change. Material changes will be communicated appropriately, and the published version will identify its revision date. Questions, requests or complaints can be sent to support@siteslot.app. The operator is Codedrops Solutions DOO, Belgrade, Serbia; registration number 21572080, PIB 111925187. See our Terms of Service and Contact page for related information.