Privacy policy

This policy explains what personal information Slotwise collects, why, who it is shared with, how long it is kept, and what you can ask us to do with it. It applies to https://slotwise.online and the Slotwise application.

1. Who is responsible for your information

Slotwise has two kinds of user, and our role differs between them. We think it is more honest to describe that split than to claim a single label.

Professionals — people with a Slotwise account. We decide what account information is needed to run the Service and how it is handled. We are the data controller for that information.

Invitees — people who book an appointment. Responsibility here is genuinely shared:

• The professional decides who to invite, why they want a client’s details and what they do with them afterwards. For that purpose they act as an independent controller, and they are responsible for it. They are not acting on our instructions when they choose to meet you.
• We decide how booking data is stored, secured, transmitted and deleted, and we also use it for our own purposes — running and securing the Service, sending the confirmation and reminder emails, preventing abuse, and meeting legal obligations. For those purposes we are a controller too.

If you booked an appointment and want to know why a particular professional holds your details, ask them. If you want to know how Slotwise stores or deletes them, ask us at privacy@slotwise.online — we will help either way.

Slotwise is operated by an individual, not a company. We say so plainly because it is relevant to who holds your information and to the scale at which it is handled.

2. What we collect

If you create an account

If you book an appointment as an invitee

If you sign in with Google

Creating or accessing a Slotwise account with Google is optional — email and password works exactly as before. Authentication is handled by our authentication provider, Supabase Auth, which manages the exchange with Google.

Signing in with Google does not give Slotwise any access to your Google Calendar. Authentication requests only your basic profile and email address. It grants no access to your calendar, Gmail, contacts, files or anything else in your Google account.

Google Calendar is a separate, optional integration with its own authorisation step, described immediately below. Choosing one does not enable the other, and you can use either without the other: sign in with Google and never connect your calendar, or sign in with an email and password and connect it.

If you connect Google Calendar

This is separate from signing in with Google and requires its own authorisation, which you start yourself from Settings.

Records of emails we send

For each email, we record the recipient address, the type of email, the delivery provider, its message identifier, whether it succeeded, and any error. This is how we can tell whether a confirmation or reminder actually went out.

What we do not collect

• No analytics, tracking, advertising or session-replay of any kind. There is no Google Analytics, no advertising pixel, no heatmap or session recorder, and no third-party tracking script anywhere in Slotwise.
• No payment or financial information. Slotwise is free and does not process payments.
• No government identification numbers.
• No location data beyond the timezone you choose and the IP address recorded against a sign-in session.
• We do not buy personal information from anyone, and we do not sell or rent yours.

3. Cookies and similar technologies

Slotwise uses a small number of strictly functional cookies. There are no analytics or advertising cookies, which is why you are not asked to accept any.

All are HttpOnly, meaning they cannot be read by scripts in the page. Session cookies are only set when someone signs in — browsing a public booking page and making a booking does not sign you in.

Fonts are served from our own domain. Using Slotwise does not cause your browser to contact a font provider.

4. How we use information

We use personal information to:

• create, secure and operate accounts;
• generate availability and take bookings;
• send transactional email — confirmations, reminders, cancellations, reschedules, email verification and password resets;
• create and update calendar events, where a professional has connected Google;
• prevent double-booking and enforce a professional’s availability;
• investigate abuse, misuse and security incidents, and enforce our Terms;
• diagnose faults and keep the Service working;
• comply with legal obligations.

We do not send marketing email. Every email Slotwise sends is transactional — the direct result of a booking, a reminder, or an action you took on your account.

We do not use personal information for automated decision-making that produces legal or similarly significant effects.

5. Legal bases

Where a legal basis is required — including under the Nigeria Data Protection Act 2023 — we rely on:

• Performance of a contract, to provide the Service you asked for, including taking bookings and sending the emails that go with them.
• Legitimate interests, in securing the Service, preventing abuse, and keeping records of whether emails were delivered — balanced against your interests.
• Consent, for connecting Google Calendar, which is optional and can be withdrawn by disconnecting. Signing in with Google is also a choice you make, and you can stop using it at any time by signing in with an email and password instead.
• Legal obligation, where the law requires us to keep or disclose something.

6. Who we share information with

We use a small number of service providers to run Slotwise. They process information on our behalf, under their own terms.

We also share:

• With the professional you booked with — your name, email, note, chosen time and timezone. That is the point of the booking.
• With the invitee — the professional’s name and meeting details.
• Where the law requires it, or to establish, exercise or defend a legal claim.
• On a change of operator — if Slotwise is transferred to a company or another operator, information may transfer with it. We will tell you first.

We do not sell personal information, share it with advertisers, or use it to build profiles for marketing.

What Google receives, and what we keep

Google is involved in two separate and independent ways, and neither implies the other.

Signing in with Google. Where a professional chooses this, Google confirms their identity and supplies their email address and basic profile information. This grants no access to Google Calendar — see section 2.

Connecting Google Calendar. Where a professional connects it, events created by Slotwise contain the invitee’s name, email address and note. Those are sent to Google.

Reading works differently: to find when a professional is busy we read their calendar over a rolling 30-day window, but we store only an event identifier and its start and end times. Event titles, descriptions, attendees and locations are never stored by Slotwise.

For calendar access Slotwise requests only the calendar.events permission. Neither signing in with Google nor connecting Google Calendar gives Slotwise access to Gmail, contacts, files or any other Google data.

7. Where information is stored, and international transfers

Slotwise is operated from Lagos, Nigeria. Our database and authentication data are stored in Amazon Web Services’ Europe (Stockholm) region, in Sweden. Application hosting and email delivery run on infrastructure operated by Vercel and Resend, which may process data in other countries.

Slotwise is available worldwide. If you use it from outside Sweden or Nigeria, your information will be transferred to and processed in countries other than your own, including Sweden, Nigeria and wherever our providers operate. Data-protection law in those countries may differ from your own.

We rely on the terms of our agreements with these providers, and on their published security practices, to protect information in transit and at rest. We do not claim certification under, or formal adequacy for, any particular international transfer mechanism.

8. How long we keep information

Deleting your account deletes the data above ahead of these periods, other than what is described in section 10.

9. Administrator access

Slotwise has a private administrator interface used to operate the Service. An administrator can see the list of professionals and their bookings — including invitee names and email addresses — and can suspend, reinstate or delete an account.

Administrator access is restricted to explicitly authorised accounts, held in a table that ordinary users cannot read or grant themselves membership of, and reachable only through a separate sign-in. Suspending, reinstating and deleting an account are recorded in an audit log, which stores the identifiers of the administrator and the account acted on and nothing else — no names and no email addresses, so that the log can survive a deletion without preserving the data that deletion removed. Ordinary administrator activity, such as viewing a page, is not logged.

Suspending an account does not delete or alter any data. It stops the public booking page accepting new bookings and hides the professional’s details; existing appointments are untouched.

10. Deleting your account, and what deletion cannot reach

You can delete your account from Settings. It is permanent. When you do:

1. Every upcoming confirmed booking is cancelled and each invitee is emailed a cancellation notice.
2. Your Google Calendar authorisation, if connected, is revoked at Google.
3. Records of emails sent on your behalf are deleted.
4. Your account and everything cascading from it is removed — profile, availability, blocked time, calendar connection, mirrored busy times, all bookings past and future, and your sign-in sessions.

Some things are genuinely beyond our reach, and we would rather list them than imply otherwise:

• Emails already delivered are in the recipient’s mailbox and cannot be recalled. Our email provider also retains its own sending records under its policy.
• Calendar events for past appointments remain in the professional’s own Google Calendar. Only upcoming bookings are cancelled and removed; past events are theirs to delete.
• Routine infrastructure backups kept by our database provider may contain deleted data until those backups age out on their normal cycle.
• Operational logs kept by our hosting and database providers may briefly contain technical records of requests.

To ask us to delete information, write to privacy@slotwise.online.

If you booked an appointment and want your details removed, contact the professional you booked with — they control that relationship — or write to us and we will help.

11. Security

• All traffic is encrypted in transit using HTTPS.
• Passwords are stored only as cryptographic hashes, by our authentication provider. We cannot read them.
• Google access and refresh tokens are encrypted with AES-256-GCM before being stored, and are never exposed to the browser.
• Access to data is enforced in the database itself with row-level security, so a professional can only read their own records.
• Privileged operations run only on the server, never in the browser.
• Booking management links use unguessable random tokens.
• The administrator interface is isolated from ordinary sign-in and denied by default.

No service can promise perfect security, and we do not. We hold no security certification — we make no SOC 2, ISO 27001, HIPAA, PCI or equivalent claim, and Slotwise should not be used where such a certification is required of your suppliers.

If you believe you have found a security problem, please write to privacy@slotwise.online.

12. Children

Slotwise is not for children. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18. If you believe a child has provided us information, contact privacy@slotwise.online and we will delete it.

13. Your rights

Depending on where you live, you may have rights to:

• access the information we hold about you;
• correct it if it is wrong;
• delete it;
• object to or restrict how we use it;
• receive a copy in a portable form;
• withdraw consent where we relied on it — for example by disconnecting Google Calendar;
• complain to your data-protection authority. In Nigeria, that is the Nigeria Data Protection Commission (NDPC).

If you have an account, you can exercise most of these directly: edit your profile and availability in Settings, disconnect Google at any time, and delete your account yourself.

Otherwise, write to privacy@slotwise.online. We will respond within 30 days. We may ask you to confirm your identity before acting on a request, so that we do not disclose someone’s information to the wrong person.

We reference the Nigeria Data Protection Act 2023 because it is the law of the place Slotwise is operated from. Referencing it is not a claim of certified or formally assessed compliance, and we make no claim of compliance with the GDPR, the CCPA or any other regime.

14. Changes to this policy

We may update this policy as the Service changes. The “Last updated” date at the top shows when it last changed.

If a change materially affects how we handle your information, we will make reasonable efforts to tell you in advance — by email to the address on your account, or by a notice in the app.

15. Contact

Slotwise is operated by John Igbogbo, Lagos, Nigeria.

See also our Terms of service.