Privacy policy

Who we are

Sloted is a product of Gaffiero Digital, Malta ("we", "us"). Contact: hello@sloted.app.

Two roles

For businesses that use Sloted (owners and their staff), we are the data controller of your account data.

For clients who book with a business through Sloted, the business is the controller and we are its processor: we store and process booking data only on the business's instructions, under our Data Processing Agreement.

What we collect

Account data: name, email, password hash, sign-in and security logs.

Business data: services, prices, opening hours, staff, and the bookings, clients and payments you manage in Sloted.

Client data (on behalf of businesses): name, email, mobile number, booking history, messages sent, consent choices and, where the business uses them, notes and forms.

Payment card data is handled by Stripe. Sloted never sees or stores full card numbers.

Why and on what basis

To provide the service (contract), to keep it secure and prevent fraud (legitimate interest), to meet legal obligations such as VAT records (legal obligation), and to send marketing only where you opted in (consent).

Where your data lives

Data is hosted in the European Union. Sub-processors: Railway (hosting, EU), Cloudflare (CDN/DNS), Stripe (payments), Twilio (SMS/WhatsApp), Resend (email), Sentry (error monitoring, EU), PostHog (analytics, EU, only with consent), Anthropic (AI receptionist, Pro plan only).

Google account data

If a business connects its Google account to send emails from its own Gmail address, Sloted requests only the permission to send email (gmail.send) and the account's email address. Sloted cannot read, search or delete the business's emails.

We use this access only to send the business's booking emails (confirmations, changes, cancellations and reminders) to its clients. Access tokens are stored encrypted and are deleted when the business disconnects its account; the business can also revoke access at any time in its Google account settings.

Sloted's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, and don't let people read it.

How long we keep it

Account data for as long as your account is open, then 30 days. Invoices and payment records for the period required by Maltese tax law. Businesses set their own retention for client data and can export or erase it at any time.

Your rights

You can access, correct, export, restrict or erase your data, and object to processing. Clients should contact the business they booked with; we will help the business respond. You may complain to the Information and Data Protection Commissioner (IDPC), Malta.