1. Introduction & Scope
Welcome to Slotwise (“we”, “our”, or “us”). Slotwise provides modern calendar scheduling infrastructure, custom domain booking portals, and collaborative round-robin team dispatching. We are committed to operating as a privacy-first platform that respects your autonomy and protects your digital personal data.
This Privacy Policy explains how personal data is collected, stored, processed, and safeguarded when you visit our website, register as an event host, or book an appointment on a public Slotwise scheduling link. We act as a Data Controller / Data Fiduciary regarding host account details, and as a Data Processor on behalf of hosts regarding attendee booking records.
- Zero Advertising & Data Brokerage: We never sell, rent, monetize, or broker attendee emails or host schedules.
- No Covert Tracking: Zero third-party ad pixels (no Meta Pixel, no Google Ads tracking, no TikTok beacons).
- Strict Regulatory Alignment: Engineered to meet the requirements of the European Union General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection (DPDP) Act 2023.
2. Information We Collect
We adhere to strict data minimization principles. We only collect data that is strictly necessary to calculate free/busy slots, prevent double bookings, and facilitate meetings:
Host Account Credentials
When creating an account, we collect your username, email address, and salted bcrypt-hashed password. Plaintext passwords are never stored, logged, or accessible to our staff.
Availability & Timezone Rules
Host weekly operating schedules, custom meeting durations, buffer times, minimum booking notices, and IANA timezone configurations (e.g. America/New_York, Asia/Kolkata).
Attendee Booking Information
When a guest reserves an appointment, we collect the attendee's full name,email address, optional meeting notes, and selected time slot. No financial data is stored directly on Slotwise; payments are handled directly by PCI-DSS compliant Stripe.
Connected Calendar Tokens
When connecting Google Calendar or Microsoft Outlook, OAuth refresh tokens are encrypted at rest using AES-256-GCM. We only read busy/free intervals and write confirmed booking events. We do not read attendees' personal inbox or email threads.
Statutory Consent Audit Logs
In accordance with GDPR Article 7(1) and DPDP Act 2023 Section 6 (burden of proof), when an authenticated host provides or changes cookie consent, we record an immutable verification log containing the timestamp, category selections, IP address, and User-Agent. This is retained solely for regulatory audit compliance.
Developer Webhook & API Logs
For users configuring developer webhooks and API keys, we record outbound delivery status codes, event payloads, and timestamps to provide delivery visibility in your developer dashboard.
3. Legal Bases for Processing (GDPR & DPDP)
Under European Data Protection Law (GDPR Article 6) and the India DPDP Act 2023 (Section 4 & 6), our processing of personal data is anchored in clear legal grounds:
Performance of a Contract
Processing host credentials, calculating open availability slots, and locking bookings are required to provide the core scheduling service you requested.
Legitimate Interests
Maintaining API rate limits, preventing denial-of-service spam, mitigating slot squatting, and enforcing authenticated access controls.
Freely Given, Specific Consent
For functional preferences (such as remembering your timezone across sessions) and diagnostic telemetry, processing occurs only following affirmative consent via our Cookie & Privacy banner.
4. Your Rights & Autonomy (GDPR & DPDP Act 2023)
Regardless of your jurisdiction, Slotwise affords comprehensive privacy rights to all individuals globally. Use the quick actions below to exercise your statutory rights:
Right to Access & Confirmation
Request a formal summary of what personal data Slotwise processes, recipient entities, and storage retention terms.
Right to Correction & Updating
Update inaccurate username, email, timezones, or schedules directly from your dashboard with immediate sync.
Right to Erasure (“Right to be Forgotten”)
Request complete permanent deletion of your account, event types, and historical booking logs.
Right to Withdraw Consent (DPDP Sec. 6(4))
Withdraw or modify cookie preferences at any time with equal ease using our granular settings dialog.
Right to Data Portability
Export your profile details, cookie consent record, and account metadata in machine-readable JSON format.
Right to Nominate (DPDP Sec. 14)
Nominate an individual to exercise data principal rights on your behalf in the event of incapacity.
5. Attendee Calendar Overlay Privacy (Zero Storage Architecture)
One of Slotwise's standout capabilities is the SavvyCal-style Attendee Calendar Overlay. When an attendee toggles their calendar overlay on a booking page to compare their personal schedule against the host's open slots:
• Client-Side Computation: The attendee's busy/free calendar blocks are fetched or calculated entirely in the attendee's local browser memory.
• Zero Host Visibility: The host never sees the attendee's private calendar titles, appointments, or personal events. The host only receives the final chosen meeting slot once confirmed.
• Zero Database Ingestion: Slotwise servers do not ingest, store, or log the attendee's external calendar event titles, attendees, or descriptions.
6. Data Security & Technical Measures
We employ defense-in-depth architecture to ensure data integrity and confidentiality:
• Encryption in Transit: 100% of network requests are enforced over TLS 1.3 with HSTS headers.
• Encryption at Rest: Database backups and OAuth integration tokens are encrypted using AES-256-GCM.
• Cryptographic Salt Rounds: Passwords are one-way hashed using bcrypt with adaptive cost factors.
• Session Protection: JWT authentication tokens are signed with high-entropy secrets and transported over secure SameSite cookies.
• Concurrency Protection: Atomic MySQL row locks prevent race-condition double bookings across distributed nodes.
7. Sub-processors & Third-Party Infrastructure
We maintain agreements with a select group of infrastructure providers who comply with GDPR Article 28 and DPDP Act standards:
| Entity / Provider | Purpose | Location | Compliance Safeguards |
|---|---|---|---|
| Cloudflare, Inc. | DDoS protection, DNS & Edge CDN | Global Edge Network | ISO 27001, SOC 2 Type II, EU SCCs |
| Stripe, Inc. | Payment processing for paid events | United States / Global | PCI-DSS Level 1, GDPR Compliant |
| Transactional Email Provider | Meeting invitations & calendar ICS files | EU / US Cloud Regions | GDPR DPA with TLS Encryption |
8. Google API & Calendar Data Compliance Policy
Slotwise integrates with Google APIs to provide seamless calendar synchronization and video conference scheduling for our users.
Google API Services User Data Policy Statement:
Slotwise's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Requested Google Scopes
.../auth/calendar&.../auth/calendar.events: To read busy intervals to prevent double bookings and insert confirmed appointments with Google Meet links..../auth/userinfo.email&.../auth/userinfo.profile: To authenticate hosts and match the linked calendar email.
Data Usage & Storage
- Google user data is used solely to facilitate user-facing calendar scheduling and provide Google Meet conference links.
- OAuth tokens are encrypted at rest using AES-256-GCM encryption.
- We do not store or read personal email content, contacts, or unassociated calendar entries.
Strict Limited Use Restrictions
- No Data Transfers or Sales: We do not sell, rent, or transfer your Google user data to third parties, data brokers, or advertising platforms under any circumstances.
- No Advertising Use: Information accessed via Google APIs is never utilized for serving advertisements, retargeting, or consumer profiling.
- No Human Access: No Slotwise employee or contractor reads your calendar entries, unless required by law, with your explicit authorization for technical troubleshooting, or in aggregated/anonymized security diagnostics.
- No AI Model Training: Google user data is never used to train or fine-tune generalized machine learning models or artificial intelligence algorithms.
You can disconnect your Google Calendar integration at any time from your Slotwise Dashboard under Settings > Calendar Sync or directly revoke access via your Google Account Security Permissions.
10. Data Retention & Erasure Schedule
Personal data is retained only for the duration necessary to satisfy the purposes specified in this policy:
- Active Host Accounts: Credentials and event configurations are kept active until account termination.
- Confirmed Bookings: Meeting metadata is stored to allow hosts to review historical records. Hosts may purge individual bookings anytime via the dashboard.
- Account Cancellation: When an account is deleted, all event types, booking logs, and availability records are permanently purged from primary databases within 30 calendar days.
11. Grievance Officer & Data Protection Inquiries
Pursuant to Section 12 of India's Digital Personal Data Protection Act 2023 and GDPR Article 37, Slotwise has designated a Data Protection & Grievance Officer:
Slotwise Data Protection & Grievance Redressal Office
Officer: Grievance Redressal Officer, Slotwise Inc.
Email: [email protected]
SLA Timeline: Acknowledgment within 48 hours; complete grievance resolution within 7 business days.
EU Supervisory Authority: EU residents also possess the statutory right to lodge a formal complaint with their local EU Member State Data Protection Authority (DPA).