Privacy Policy

1. Who controls your data

Slotora online booking software is operated by Belavin Limited, (company no. 16735157), 6 Salstar Close, Birmingham, B6 4PP, United Kingdom. For privacy matters contact hello@slotora.io. We are registered with the UK ICO (registration 00014129250).

2. Two roles

For your own account and our marketing, Slotora is the data controller. For your clients' booking data (what your customers submit on your booking page), YOUR business is the controller and Slotora is a processor acting on your instructions — governed by the data-processing section of our Terms.

3. What we collect

• Account data: name, email, password (hashed), role.
• Business data: business name, services, prices, working hours, images.
• Booking/client data: the guest's name, email, phone, appointment details and intake-form answers.
• Technical data: logs, device/browser info; on the marketing site, cookieless anonymous visit counting (a daily-salted hash, not personally identifying).
• Mobile app: if you enable notifications, a push registration token plus your device platform and language, stored against your account and deleted when you sign out, uninstall, or delete your account.

3a. The mobile app

The Slotora app for iOS and Android shows the same admin as the website. It asks for camera and photo-library access only when you attach an image yourself (portfolio, before/after, logo) — nothing is captured in the background, and we never scan your library. It contains no advertising identifiers, no analytics SDK and no tracking of any kind, and we do not share app data with data brokers. Notification permission is optional; declining it changes nothing else in the app.

4. Legal bases

• Performance of a contract (Art. 6(1)(b)): running your account and bookings.
• Legitimate interests (Art. 6(1)(f)): service security, improvement, abuse prevention.
• Legal obligation (Art. 6(1)(c)): e.g. accounting duties for paid plans.
• Consent (Art. 6(1)(a)): where we ask for it (e.g. non-essential communications).

5. How we use it

Solely to run the service: showing availability, creating bookings, and sending transactional emails (confirmations, reminders, cancellations, waitlist notices). We do not sell data and we do not run third-party advertising trackers.

6. Recipients and processors

We keep data confidential; our sub-processors are: Neon (database hosting, EU/London), Netlify (application hosting/CDN), Resend (transactional email), Twilio (text messages, only if you switch SMS on), Google Firebase (mobile push notifications), Google (Gemini AI — only for the optional AI features you trigger yourself, and never used to train their models), and Stripe (payments — used whenever a business takes card payments from its clients through Slotora, and separately if that business subscribes to a paid plan). Each processes data under a data-processing agreement and only as needed to run the service.

7. International transfers

Data is primarily stored in the EU/EEA and the United Kingdom. Where a transfer occurs, it is protected by an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK IDTA).

8. Retention and deletion

Data is retained while an account is active. Request deletion at hello@slotora.io; we action requests within 30 days. Data we are legally required to keep (e.g. invoicing) is retained for the mandatory period.

9. Your rights

• Access, rectification, erasure, restriction, portability and objection.
• Withdraw consent at any time (without affecting prior lawful processing).
• Complain to a supervisory authority: the ICO (ico.org.uk) in the UK, or the NAIH (naih.hu) in Hungary.

10. Cookies

We use strictly necessary cookies only (your login session and language preference). See our Cookie Policy for detail.

11. Children

The service is for businesses, not for under-16s. We do not knowingly collect data from children.

12. Security

Encrypted transport (HTTPS), password hashing, access controls and regular backups protect your data.

13. Changes

We may update this policy; we will notify you of material changes. Last updated: 26 July 2026.