Privacy Policy

Last Updated: August 21, 2026

This Privacy Policy explains what personal data Slot processes, why we process it, who we may share it with and what rights you have. It applies to the website, PWA, mobile web interfaces, profiles, calendars, bookings, payments, notifications and other Slot features ("Platform"). The Ukrainian version prevails over any translation.

1. Data Controller

The controller of personal data is Individual Entrepreneur Rudenko Mykhailo Ihorovych ("Operator", "we", "us"), Ukrainian tax ID 3521802553, operating under the Slot trade name.

• Request email: find.slot.ua@gmail.com
• Correspondence address: Ukraine, Pavlohrad, Pryvitna St, 21

2. Data We Process

2.1. Account data: first name, last name or public name, email, phone number, language, user role, account settings, activation statuses, legal-document acceptance version and time, account creation and update dates.

2.2. Master or Company Profile data: public name or business name, photo or logo, description, education and experience, categories, attributes, services, prices, duration, website and social links, address or working area, precise geolocation coordinates, schedule, time off, contact channels, portfolio, Company membership, ratings, reviews, subscription status and billing history. Fields marked as public by the interface are shown to Platform visitors.

2.3. Business verification data: subject type, legal name, registration identifier in raw, normalized, hashed and masked forms, representative name and role, email, phone, applicant note, accuracy-attestation version and time, status, decision reason, review metadata and resubmission history. The current form does not accept document scans or biometric images. The full identifier and internal review data are not published.

2.4. Booking and communication data: Master, Client, Company, service, date, time, duration, price, booking status, party name/photo/contact snapshots, notes, chat messages, change history, cancellation reasons, proposals, notifications and service records needed for booking performance, support and disputes.

2.5. Payment and recurring billing data: amount, currency, selected plan and cadence, paid-through and next-renewal dates, recurring agreement and cancellation status, payment description, order_id, payment status, transaction identifier, payment date, LiqPay status, failure reason and limited technical payment attributes. Where recurring billing is authorized, this also includes the opaque LiqPay card token and payment-specific payer IP supplied in LiqPay's signed successful initial callback. Slot does not store full card numbers, CVV/CVC, PIN codes or full payment instrument credentials.

2.6. Technical, search and analytics data: IP address, device and browser type, operating system, language, time zone, session and device identifiers, Firebase/Auth data, push tokens and web-push keys, Telegram identifiers, search queries and embeddings, error and performance logs, security events, App Check data, Meta _fbp/_fbc, cookies or similar technologies used to operate, secure, analyze and promote the Platform.

2.7. Requests, safety and leads: support requests, emails, messages, attachments, request history, complaints, blocks, Slot team replies, internal support notes, and voluntarily submitted prospective-Master contact, city, work-format/message, marketing source/UTM and landing path.

2.8. Sensitive data in free text: Slot does not request and prohibits special categories of personal data in free-text fields, including diagnoses, symptoms, medical history, test results, medical documents, prescriptions, treatment information, biometric data, political opinions, religion or intimate-life information. Do not add them to a profile, chat, support request, complaint or another free-text field. If you nevertheless disclose such data on your own initiative, that does not mean Slot requested it or that the channel is suitable for medical information.

2.9. Medical bookings: choosing a medical specialty or service may itself indirectly reveal health information. Before every such booking we therefore request separate active consent and process only the appointment metadata needed for scheduling: selected practitioner and service, date, time, parties, booking status, and the notice version and server-recorded consent time. A Client free-text note is not stored for a medical booking. Slot does not create a medical record and does not request diagnoses, symptoms, test results, documents, prescriptions or treatment instructions.

3. Legal Bases

We process personal data on these bases:

• contract performance or pre-contract steps - account creation, bookings, Master or Company Profile, business verification requested by the Profile owner, subscription, authorized recurring payments, cancellation and support;
• consent - marketing messages, push notifications and optional settings where applicable;
• separate explicit consent - metadata of each medical booking that may indirectly concern health; contractual necessity alone is not used as the sole basis for this special category of data;
• legal obligation - accounting, tax, payment and consumer records, responses to lawful requests;
• legitimate interest - security, fraud prevention, Platform improvement, rights protection, service analytics, handling requests and disputes where such interest is not overridden by your rights.

4. How We Use Data

We use personal data to:

• create, authenticate and maintain accounts;
• show Master profiles and help Clients create bookings;
• manage calendars, services, schedules, booking statuses and notifications;
• check business registration information and representative authority, keep decision history and permit resubmission after rejection or revocation;
• process the Master Subscription, keep paid-through access separate from recurring billing, securely store and use the LiqPay token and signed-callback payer IP required for authorized unattended renewals, stop future charges and clear both values after cancellation or terminal renewal failure, confirm payment, keep billing history and process refunds;
• send administrative messages about accounts, bookings, subscriptions, payments, security or document changes;
• provide support and review complaints;
• prevent fraud, unauthorized access, Terms breaches and security threats;
• comply with legal, tax, accounting and payment obligations;
• improve Platform stability, quality and usability.

5. Who We Share Data With

5.1. Masters: when a Client creates a booking, we share with the relevant Master the data needed to organize the service: name, contact, booking details, selected service, date, time and notes if added.

5.2. Clients: if a Master has a public profile, we show Clients Master profile data, including name, photo, description, services, prices, schedule, location or working area, rating and reviews.

5.3. Authorized Slot personnel and reviewers: only as needed for support, moderation, security, checking business registration and representative authority. Verification data is not shared with other users except for the public successful-verification status and date.

5.4. LiqPay and JSC CB "PrivatBank": for hosted card entry, issuing and using an opaque card token, returning the signed initial payer IP and receiving that IP on an authorized unattended token charge, accepting payments, confirming status, refunds, fraud prevention, chargebacks, financial monitoring and compliance with payment system rules.

5.5. Infrastructure and delivery providers: Google/Firebase/Google Cloud, Vercel, Sentry, Resend, FCM/APNs, Telegram and other hosting, authentication, database, file, push/email, support, error-monitoring and analytics providers receive only data needed for the relevant function. Sentry Session Replay is disabled; Slot may send Sentry scrubbed error reports, technical logs and performance data without intentionally recording user-session content.

5.6. Search, maps, sign-in, review and media providers: including Google/Apple, Google Places, Vertex AI, Nominatim/OpenStreetMap, CARTO and external media providers when you use the relevant function. They may receive a search or location request, coordinates, public Profile content, URL or request technical data.

5.7. Authorities, courts, banks and advisers: where required by law, to protect rights, respond to lawful requests, investigate fraud, handle payment disputes, tax or accounting records.

5.8. Business transfer: if Slot is merged, sold, transferred or reorganized, data may be transferred to a successor in compliance with this Policy and the law.

6. International Transfers

Some infrastructure providers may process data outside Ukraine. In that case, we use contractual, technical and organizational safeguards and transfer only data necessary for the relevant purpose.

7. Retention

7.1. Account data is kept while the account is active or while needed to provide the Platform.

7.2. Booking data is kept for the period needed for booking performance, support, disputes, security, analytics and legitimate interests of the parties.

7.3. Business-verification applications and decision history are retained while the Profile is active and while needed for resubmission, audit, security or a dispute. A prior rejected or revoked application is not overwritten by a new one. Once the relevant purpose ends, data must be deleted or minimized except for records that lawfully must be retained.

7.4. Payment, accounting, tax and legally significant records are kept for the periods required by law, LiqPay/bank/payment system rules or limitation periods. The usable LiqPay card token and payment-specific payer IP from the signed initial callback are retained together only while the Recurring Billing Agreement is active. After cancellation or a terminal renewal failure, Slot clears both values, while retaining non-token and non-IP billing records where required. If either value is missing or invalid at initial payment, Slot grants the paid period without retaining renewal credentials or activating recurring billing.

7.5. Self-service deletion is available in Settings after active bookings have finished or been cancelled. It closes the Firebase Auth account and deletes primary User/Profile records from the active database. Some technical records, provider copies, backups or data lawfully required for security, accounting, proof of contract performance or defense against claims may require a separate deletion process or be retained for a documented period. For a comprehensive access or deletion request, including data in secondary systems, email find.slot.ua@gmail.com.

8. Security

We use reasonable technical and organizational measures: authentication, access control, Firebase/App Check, server-side payment signature and merchant validation, server-only access to renewal credentials, database access restrictions, security event logging and payment data minimization. Card tokens, payment-specific payer IPs and private keys are not exposed to clients or intentionally written to routine logs. No transmission or storage method is completely secure, so we cannot guarantee 100% protection.

9. Your Rights

Under personal data protection law, you may have the right to:

• know the sources of collection, location of your personal data, purpose of processing and persons to whom it is disclosed;
• receive information about access conditions for personal data;
• receive confirmation whether your personal data is processed and access it;
• request correction, update, blocking or deletion of data if it is processed unlawfully or is inaccurate;
• withdraw consent where processing is based only on consent;
• object to processing in cases provided by law;
• complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

To exercise your rights, email find.slot.ua@gmail.com. We may ask you to verify your identity proportionately so we do not disclose data to someone else. We will state within 10 business days whether the request will be fulfilled and provide processing/access information within 30 calendar days after receiving a valid request unless the law requires another period.

10. Cookies, Local Storage and Push Notifications

Slot may use cookies, localStorage, sessionStorage, push tokens and similar technologies for login, settings, language, city, session, security, PWA operation and notifications. You can restrict these technologies in browser or device settings, but some features may not work correctly.

Slot may use Meta Pixel and Meta Conversions API to measure marketing campaigns. Tracking is limited to an explicit list of public discovery, Profile, Company and master-setup pages. It is disabled on private/auth pages and URLs containing credentials, unknown parameters or precise coordinates. A browser event may include the allowed public page URL, event name and browser/device data; the server removes all URL query parameters before it may add the request IP address and Meta _fbp/_fbc identifiers. Slot does not add form field values or contact details to those marketing events.

Push notifications are sent only after permission on your device or in your browser. You may revoke permission in device or browser settings.

11. Children's Data

Slot is not intended for independent use by children. If we learn that an account was created by a child without proper consent of a legal representative, we may restrict or delete that account.

12. Policy Changes

We may update this Policy. A new version becomes effective upon publication unless it states otherwise or the law requires otherwise. If changes materially affect your rights or paid features, we may ask you to reconfirm consent.

13. Contacts

If you have questions, requests or complaints about personal data, contact us:

• Email: find.slot.ua@gmail.com
• Correspondence address: Ukraine, Pavlohrad, Pryvitna St, 21