This Privacy Policy explains what data Sllot ("Sllot", "we") collects through sllot.app and the Sllot dashboard, and how we use it. It covers two kinds of people: Club owners who run a business on Sllot, and their customers who book through a Sllot link or message a Club's WhatsApp number.
1. What we collect
- From Club owners: business name, WhatsApp number, prices/hours, a dashboard PIN, and account activity.
- From customers booking a Club: name and phone number (captured through WhatsApp when a booking is confirmed), booking history with that Club, and inbound/outbound WhatsApp message content needed to process a booking.
- From affiliates: name, email, and (optionally) phone number, plus which Clubs signed up through your referral link.
- Automatically: basic technical logs (timestamps, error context, correlation IDs) used to operate and debug the service — never full phone numbers in logs, only the last 4 digits.
We do not collect special-category data (health, biometrics, race, religion, political opinion, sexual orientation), payment card numbers, or government identifiers. Card details are entered directly with our payment processor and never reach Sllot's systems.
2. Data ownership & market intelligence
The player/customer data described above belongs to the Club that collected it, not to Sllot. We process it solely to provide the Service and don't sell it to third parties. Aggregate, anonymized data (e.g. regional pricing benchmarks, booking-pattern averages) may be used to power market-intelligence features shown to Clubs, but never in a form that identifies a specific Club or its players to competitors. Club owners are responsible for having appropriate consent from their customers to process their contact information for booking/communication purposes under applicable law (e.g. Ley 25.326 in Argentina, GDPR in the EU).
The price benchmark shown to Clubs is built from publicly listed prices, not from another Club's private booking data. The occupancy benchmark is derived from Club booking volumes and is only ever shown once enough Clubs are in a market that no single Club's figures can be identified from it.
3. How we use it
- To create holds and bookings, send WhatsApp confirmations and reminders, and keep a Club's schedule accurate;
- To let a Club owner see their own customers, message win-backs to lapsed customers, and view their own analytics — Sllot never shares one Club's customer data with another Club;
- To generate the anonymized, aggregate market-intelligence features described in Section 2;
- To operate, secure and improve the service, including rate-limiting abuse and diagnosing errors;
- To pay affiliate commission on Clubs referred through a valid link;
- To communicate with you about your account or the service.
We do not sell personal data.
4. Cookies and similar technologies
Sllot sets a small number of cookies. We use no advertising or cross-site tracking cookies.
- Language preference (
sllot_lang, 12 months) — remembers the language you picked on the website. Strictly necessary to honour a choice you made. - Affiliate attribution (60 days) — set only when you arrive through a referral link containing a
?ref=code, so the affiliate who introduced you is still credited if you sign up days later. This one is not strictly necessary. - Owner session — after a Club owner enters their dashboard PIN, the session is held in the browser for that tab only and is cleared when the tab closes. Strictly necessary.
Our payment processor may set its own cookies during checkout, on its own pages and under its own policy.
5. Our role: controller and processor
Which role we hold depends on whose data it is, and it changes what you can ask of us:
- Club account data (the business, its owner, affiliates, billing) — Sllot is the controller. Ask us directly.
- A Club's customers' data (players' names, numbers, bookings, messages) — the Club is the controller and Sllot is a processor acting on its instructions. A player's request is ultimately the Club's to answer; contact the Club, or contact us and we will pass it on and assist.
The processor terms required by Article 28 GDPR — scope, duration, security, sub-processors, assistance, deletion on termination — are in our Terms of Service and form part of the contract with every Club.
6. Legal bases for processing (GDPR)
Where the GDPR or UK GDPR applies, we rely on:
- Contract (Art 6(1)(b)) — creating bookings, sending confirmations and reminders, running the dashboard, taking subscription payment.
- Legitimate interests (Art 6(1)(f)) — securing the service, preventing abuse, diagnosing faults, aggregate benchmarks that identify no one, and affiliate attribution. You can object at any time (Section 9).
- Legal obligation (Art 6(1)(c)) — tax, accounting and records we are required to keep.
- Consent (Art 6(1)(a)) — where we ask for it, such as non-essential cookies. You can withdraw it at any time, without affecting processing already carried out.
7. Automated processing
Sllot analyses a Club's own booking history to flag customers who have stopped coming, to identify hours that are consistently full or consistently empty, and to suggest messages and prices. These are suggestions to the Club owner, who decides whether to act on them.
We do not make decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them, and we do not use personal data for profiling for advertising.
8. Where your data is held, and international transfers
Sllot is operated from Lebanon and our infrastructure providers (Section 11) host data in regions including the European Union and the United States. Using Sllot therefore involves transferring personal data outside the country where it was collected, including outside the EEA and the UK.
Where we transfer personal data out of the EEA or UK we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) with the providers concerned. You can ask us for details of the mechanism used for a specific transfer at hello@sllot.app.
9. Your rights
Under Argentina's Ley 25.326, the EU/UK GDPR and similar regimes, you have the right to:
- access the personal data we hold about you, and get a copy;
- have inaccurate data corrected;
- have data deleted;
- restrict how we process it;
- receive it in a portable, machine-readable format;
- object to processing based on legitimate interests, including at any time to direct marketing;
- withdraw consent where we relied on it;
- complain to a supervisory authority — in the EU, the data protection authority where you live or work; in the UK, the Information Commissioner's Office. You can complain without contacting us first, though we would like the chance to put it right.
If your data is held by Sllot on behalf of a Club (Section 5), we will pass your request to that Club and help them answer it.
10. California residents (CCPA/CPRA)
In the last 12 months we have collected these categories of personal information: identifiers (name, phone number, email), commercial information (bookings and subscription records), and internet activity (technical logs). The sources, purposes and recipients are described in Sections 1, 3 and 11.
We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined by the CCPA/CPRA. We have never done so, so there is nothing to opt out of. We do not knowingly collect or sell the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that require an option to limit it.
California residents may request to know, delete, or correct their personal information, and may not be discriminated against for exercising those rights — we will not deny service, change prices, or reduce quality because you made a request. Email hello@sllot.app; you may use an authorised agent, and we will verify the request before acting on it.
11. Who else processes data on our behalf
- Supabase — our database provider, hosting booking, customer and account data.
- Vercel — hosts the application and web pages.
- Meta / WhatsApp Business Platform — delivers WhatsApp messages.
- Paddle — merchant of record for subscription billing; it is the seller of record and handles payment and sales tax.
These are our sub-processors. We will give Clubs advance notice of a change to this list so they have an opportunity to object, as required by our processor terms.
12. WhatsApp / Meta
Booking confirmations and (for Coexistence Clubs) bot replies are sent through Meta's WhatsApp Business Platform, running on the Club's own WhatsApp number. Message content needed to fulfil a booking is processed by Meta as part of delivering that message — see WhatsApp's own Privacy Policy for how Meta handles it on their side.
13. Data retention
Booking and customer data is kept for as long as a Club's account is active, so their history and win-back lists stay useful. Operational logs are retained for a limited window (currently 30 days) and then cleaned up automatically. Billing and tax records are kept for as long as the law requires. You can request deletion — see Section 15.
14. Security and breach notification
Access to Club and customer data is protected by row-level security at the database level, server-side authentication, and rate limiting on public endpoints. No method of storage or transmission is 100% secure, but we treat customer phone numbers and business data as sensitive by default.
If a personal data breach occurs, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will tell affected Clubs without undue delay so they can meet their own obligations to their customers. Where a breach is likely to result in a high risk to individuals, we will inform them directly as well.
15. Requesting access or deletion
Email hello@sllot.app with your request. We'll verify who you are before making a change, and respond within one month — extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge unless a request is manifestly unfounded or excessive.
16. Children
Sllot is a business tool and isn't directed at children. We don't knowingly collect data from children.
17. Changes to this policy
We'll post updates here with a new date. Material changes will be flagged to Club owners.
18. Contact
hello@sllot.app — Sllot, Beirut, Lebanon.