Privacy Policy

1. Our role

We process two groups of data in different roles:

• Business owners, staff and visitors to the Slotwise site: we are the controller of personal data. This policy applies to you directly.
• Customers of businesses that use Slotwise (for example people who book or buy): the business is the controller and we are the processor acting on that business’s instructions under the Data Processing Agreement (DPA). If you are a Customer, contact the business first about your data. We will help the business respond.

2. Data we process

• Business owners and staff: name, email address, phone number, password (stored as a hash, not as plain text), role and access, business information, subscription and billing data, and records of acceptance of legal documents (version, time, IP address as a hash, and browser type).
• Customers (on behalf of the business): name, phone number, email, date of birth if the business enters it, booking and transaction history, notes, preferences, loyalty points or stamps, and family profiles including children. If the business uses care records, the data may include health information, which is specific personal data.
• Technical data: IP address, device and browser type, access and security logs, and the cookies described in section 11.
• Sign in with Google: the name and email address of your Google account, if you choose this method.

3. Purposes and legal bases

We do not sell personal data, and we do not use businesses’ Customer data for our own marketing.

4. Retention

• Account data is kept while the account is active. Moving to the Free plan does not close the account. After the account is closed or the agreement ends, data can be exported for 30 days, then deleted or anonymised from live systems. Backup copies are removed within 90 days after that.
• Customer data is kept while the business uses it. When a business deletes a Customer, the profile is deactivated and anonymised. Transaction history is kept without identifiable details, because businesses must keep financial records.
• Billing and financial records are kept as long as the law requires.
• Records of acceptance of legal documents are kept for the duration of the relationship and as long as needed as evidence.
• Security logs are kept as long as needed for security, generally no more than 12 months.

5. Sharing and sub-processors

We share data only where needed to run the Service, and with parties bound by data protection obligations. The providers we currently use:

Changes to our sub-processors are announced at least 30 days in advance by email or in the app. We may also disclose data when required by law or a valid order of an authority, and to a successor to our business with notice to you and the same protections.

6. Transfers abroad

Some providers, such as cloud services, Meta and Google, may process data outside Indonesia. We transfer data only where the destination country offers an equivalent or higher level of protection, or where an adequate and binding agreement and safeguards are in place, as the PDP Law requires. Contact us if you want to know the processing locations that apply.

7. Security

We apply reasonable technical and organisational measures, including:

• encrypted connections (HTTPS);
• separation of data between businesses at database level (row-level security);
• passwords stored as hashes;
• role-based access control, with our staff’s access to business data limited to support and logged;
• audit logging of important actions, and data backups.

No system is completely secure, but we keep improving our safeguards.

8. Your rights as a data subject

Under the PDP Law you have the right to:

• know about and access your data and obtain a copy;
• complete or correct inaccurate data;
• request deletion or destruction of your data;
• withdraw consent you have given;
• receive your data in a readable format (portability) where possible;
• object to decisions based solely on automated processing, and restrict or postpone processing;
• sue and receive compensation for breaches in the processing of your data as the law provides.

For your account data, send a request to [email protected] from your account email address. We may ask to verify your identity and respond within the time limits set by law, and within 14 business days where none is set. For your data as a Customer of a business, contact that business. If the request reaches us, we forward it to the business within 5 business days. Some rights may be limited where the law requires the data to be kept.

9. Personal data breach notification

If a personal data protection failure puts you at risk, we notify the affected persons and the competent authority in writing within 3 x 24 hours as the PDP Law requires, explaining the data involved, the likely consequences and the steps taken. For Customer data, we notify the controlling business within 48 hours of becoming aware, so the business can meet its own obligations.

10. Children’s data

Slotwise accounts are for people aged 18 and over. Businesses such as baby spas or clinics may keep family profiles that contain children’s data. Processing children’s data requires the consent of a parent or guardian, and the business as controller must obtain it. We do not knowingly collect children’s data directly. If you are a parent or guardian and want to access, correct or delete your child’s data, contact the business concerned or us.

11. Cookies and local storage

We use the cookies and local storage needed for the Service to work: sign-in session, language preference, display settings, security steps such as the Google sign-in flow, and the point-of-sale offline work queue on the device. We do not use advertising or cross-site tracking cookies. You can delete cookies in your browser settings, but you may need to sign in again.

12. Changes to this policy

Important changes are announced by email and in the app at least 30 days before they take effect. Where consent is needed, you will be asked to accept the new version in the app. The version number and effective date are shown at the top of this page.

13. Contact

Artha Code Studio, PNI F17 No. 41, Cibitung, Muktiwari, Kabupaten Bekasi, Jawa Barat. Email: [email protected]. You may also complain about a breach to the competent personal data protection authority.