Privacy Policy

Draft for legal review. This text has not been reviewed by a solicitor and is not yet in force. Bracketed items must be completed before launch.

Last updated: [date of publication]

This policy explains how Merulio Ltd ("we"), the provider of Slotera, handles personal data under the UK GDPR and the Data Protection Act 2018. Contact: slotera@merulio.com. Registered office: [address].

Two roles

Operators' accounts: for people who sign up for Slotera, we are the controller.
Operators' clients: when someone books an operator, the operator is the controller of that booking data and we process it on their behalf under our Data Processing Agreement. Questions about a booking are best sent to the operator first.

What we collect

Account data: name, email, workspace name, booking page address, password hash, sign-in sessions and security logs.
Booking data (on operators' behalf): client name, email, phone, company, billing address, form answers, booking and payment status, and notes the operator writes.
Contact form: name, email and your message.
Technical data: IP address and request logs, used for security and rate limiting.

We do not use advertising trackers or sell personal data.

Why we use it

To provide and secure the service (contract and legitimate interests).
To send transactional emails such as account activation, booking confirmations and reminders (contract).
To answer enquiries (legitimate interests).
To keep financial records required by law (legal obligation).

If you use the calendar subscription link, your calendar provider (for example Google or Apple) fetches your sessions, including your clients' names, from that link. Keep it private; you can turn it off or replace it at any time.

Who we share it with

Hetzner Online GmbH — hosting, in the EU.
Resend — sending transactional email. [Confirm Resend's data location and transfer mechanism, e.g. the UK International Data Transfer Addendum.]
Sentry (Functional Software, Inc.) — error reports from our software, stored in its EU (Germany) region. We configure it so that reports leave out request bodies, cookies, search terms and access links, but an error message can occasionally contain an email address.
Card payment processing will be added later; this policy will be updated before it is.

How long we keep it

Account and workspace data: while the account is active, then deleted 30 days after the operator closes the workspace (Settings → Account), or within 30 days of a request to us.
Sign-in sessions and password-reset links: until they expire, then removed by routine clean-up.
Booking amounts, tax and payment status: [6] years, as financial records.
Backups: overwritten within 14 days.

Your rights

You can ask for access to, correction or erasure of your data, or object to or restrict its use. Operators can export or erase a client's data directly from the client's page in Slotera. Erasure keeps only the financial facts of past bookings. You can also complain to the Information Commissioner's Office (ico.org.uk).