Legal
Privacy Policy
This policy explains how Slotvine handles personal information when people use our scheduling, calendar, team, email, support and payment features.
1. Who we are
Slotvine is operated by Daniel Kirwan, trading as TurtleFrameLabs ("Slotvine", "we", "us" or "our"). We are established in England and Wales.
For UK data-protection law, we are the controller of personal information used to run Slotvine accounts, subscriptions, security, support and our own business operations. When a Slotvine customer collects booking information from an invitee, that customer normally decides why it is collected and is the controller; we process it to provide the scheduling service on the customer's behalf.
Daniel Kirwan, trading as TurtleFrameLabs18 West Holme
Erith, Kent, DA8 3NS
United Kingdom
support@slotvine.app
2. Who this policy covers
This policy covers Slotvine account owners, workspace members and invited team members; people who book, reschedule or cancel appointments; people who connect Google or Microsoft accounts and calendars; support contacts; and visitors to slotvine.app.
Slotvine accounts are intended for businesses and professionals aged 18 or over. Customer booking pages may be used by other invitees, and the customer remains responsible for making its booking activity and privacy information suitable for those invitees.
3. Information we process
Account and workspace information
Name, email address, account identifiers, time zone, email-confirmation state, workspace name, role and permissions, invitations, plan configuration, password hash, multi-factor authentication settings and security metadata. We do not store account passwords in readable form.
Scheduling and booking information
Event types, descriptions, prices, availability, buffers, meeting type, location, joining link and instructions; invitee name, email address, optional message and time zone; booking date, time, status, management token, payment status, cancellations, rescheduling details and history.
Google Calendar information
Connected Google email address, protected OAuth access and refresh tokens, selected calendar identifiers and names, token expiry, free/busy information used for conflict checks, and identifiers for events created or updated for bookings.
We use Google information only for the calendar connection, availability, scheduling, event and meeting features requested by the user. We do not use it for advertising or sell it. Slotvine's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
Microsoft Outlook and Teams information
Microsoft account identifier and email address, protected OAuth access and refresh tokens, selected Outlook calendar identifiers and names, token expiry, schedule or free/busy information, event identifiers and, where available, Microsoft Teams meeting links. We use it only for features requested by the user.
Payments and subscriptions
Stripe customer, subscription, price, invoice, Checkout, connected-account and payment references; plan, billing status, amount, currency and billing-period dates. Stripe collects full payment-card details. Slotvine does not store full card numbers or card security codes.
Communications and technical information
Workspace invitations, verification and security messages, booking notifications, delivery metadata, support correspondence, IP address, browser/device information, request timestamps and server/security logs where processed by our infrastructure.
Product and visitor statistics
We record account registration, verification, setup milestones, daily signed-in activity, booking creation, cancellations, subscription activation and technical failure counts to understand service use and reliability. Internal pseudonymous account keys allow distinct counts and return-visit calculations; these are not anonymous source records. The owner dashboard exposes only aggregate results, not names, emails, booking messages, meeting links, payment references or account identifiers.
If you allow optional visitor analytics in the footer, we use a random first-party browser identifier to estimate visits and returning browsers on marketing and public booking pages. We record coarse referral categories, device categories and, only where supplied by a configured trusted hosting proxy, a country code. These measurements do not store raw IP addresses, complete browser headers, referral URLs, query strings or booking-page identifiers. They are not used for advertising, cross-site tracking or linking anonymous visitors to customer accounts.
4. Where information comes from
We receive information directly from account users, workspace administrators, invitees and support contacts; from connected Google and Microsoft accounts; from Stripe; from transactional email and support-mailbox providers; and from normal hosting, security and application logs.
5. Why we use information
| Purpose | UK GDPR lawful basis |
|---|---|
| Create accounts, workspaces, event types and bookings; provide calendar, scheduling and meeting features | Performance of a contract or requested pre-contract steps |
| Process subscriptions, paid bookings, cancellations and refunds | Performance of a contract and legal obligations |
| Authenticate users, provide MFA, prevent abuse, investigate faults and protect Slotvine | Legitimate interests in a secure and reliable service; legal obligation where applicable |
| Send verification, booking, payment and service messages | Performance of a contract and legitimate interests in service administration |
| Provide support and answer rights requests or complaints | Performance of a contract and legitimate interests in customer support |
| Keep financial, fraud and legal records | Legal obligation and legitimate interests in establishing or defending claims |
| Measure account setup, service use and reliability using aggregate reporting | Legitimate interests in operating and improving the service, subject to necessity and balancing assessments |
| Use optional visitor analytics cookies | Consent, requested through the footer analytics preferences |
Where we rely on legitimate interests, we consider necessity and balance our interests against affected people's rights and reasonable expectations.
6. Required and optional information
Name, email and security information are required to create and protect an account. Booking contact and time details are needed to manage a booking. Calendar access is optional, but conflict checks, automatic events and provider-generated meeting links require the relevant connection. Payment information is needed only for a paid subscription or booking.
7. Who receives information
We use providers only where needed to operate Slotvine. These include Replit and the production database provider for hosting; Resend for transactional email; our WHUK/cPanel mailbox provider for support correspondence; Stripe for subscriptions and paid bookings; Google for Google Calendar and Meet; Microsoft for Outlook and Teams; professional advisers and insurers where necessary; and authorities where disclosure is legally required.
These providers receive only information reasonably needed for their function. We do not sell or rent personal information, share it for behavioural advertising, or use Google or Microsoft calendar information for advertising.
A booking host receives information submitted through that host's page and is responsible for its own use of that information.
8. International transfers
Some providers may process information outside the United Kingdom. Where UK law treats this as a restricted transfer, we rely on an applicable UK adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with appropriate security measures. Contact us for information about the safeguard used for a particular provider.
9. Retention
| Information | Normal retention |
|---|---|
| Active account, workspace and scheduling configuration | While the account is active |
| Closed account information not needed for another purpose | Deleted from active systems within 30 days |
| Booking and invitee records | Up to 12 months after the booking, unless deleted sooner or needed for a dispute |
| Expired workspace invitations | Up to 12 months after expiry |
| Google/Microsoft OAuth tokens | While connected. A paused connection may retain protected, unused tokens for up to 7 days. Permanent disconnection, expiry of the pause, a permanent-removal request or account closure causes prompt revocation where supported and deletion |
| Non-secret calendar connection and event identifiers | Up to 30 days after disconnection for recovery or reconciliation |
| Support correspondence | Up to 2 years after closure |
| Security and application logs | Normally up to 12 months |
| Subscription, payment, refund, tax and accounting records | Normally 6 years after the relevant financial period, or longer where required |
| Backups | Rotated or overwritten within 30 days |
| Product and optional visitor analytics measurements | 90 days, removed by a cleanup job scheduled every 6 hours |
We may retain limited information longer to comply with law, resolve disputes, prevent fraud or enforce agreements. Deleted live data may remain in protected backups until those backups are overwritten.
10. Cookies and local storage
Slotvine uses storage needed for authentication, account security, anti-forgery protection, OAuth state and interface preferences such as light or dark theme.
The first-party Slotvine.AnalyticsChoice cookie remembers your analytics choice for 90 days. Only after you choose Allow analytics do we set Slotvine.AnalyticsVisitor, an optional protected random browser identifier lasting up to 90 days. Selecting No thanks removes that identifier and stops future visitor measurements. Earlier measurements expire under the retention period above. Changing your choice is available in the footer on every page, and declining does not restrict functionality. We do not use advertising cookies.
11. Security
We use measures intended to protect information, including HTTPS, password hashing, email verification, optional authenticator-app MFA, role-based access controls, protected application secrets, protected OAuth tokens and restricted production access. Sensitive credentials must not be written to application logs.
No internet service can guarantee absolute security. Use a unique password, enable MFA and contact us promptly if you suspect unauthorised access.
12. Your rights
Depending on the circumstances, UK law may give you rights to access, correct, delete or restrict personal information; object to processing based on legitimate interests; receive certain information in a portable format; and withdraw consent where consent is the basis.
Account users can update some information and manage calendar connections through Slotvine. Send other requests to support@slotvine.app. We may verify identity before acting.
If your request concerns a customer's booking page, contact the booking host first where possible because that host normally controls the booking information. We will assist the host where required.
You may complain to the UK Information Commissioner's Office through its complaints service.
13. Automated decisions and advertising
Slotvine does not sell personal information, use calendar information for advertising, or make solely automated decisions that have legal or similarly significant effects on people.
14. Changes to this policy
We may update this policy when the service, providers or legal requirements change. We will publish the new version and effective date. Where a change materially affects how we use information, we will provide an appropriate additional notice before it takes effect.
15. Contact and complaints
Send questions, privacy requests and complaints to support@slotvine.app or write to Daniel Kirwan, trading as TurtleFrameLabs, 18 West Holme, Erith, Kent, DA8 3NS, United Kingdom.