Introduction
Welcome to SlotMate ("we", "our", or "us"). SlotMate is a Shopify application designed to help merchants manage appointment bookings, scheduling, and customer reservations directly within their Shopify store.
This Privacy Policy explains how we collect, use, store, and protect your information when you install or use the SlotMate application ("App"). By installing or using SlotMate, you agree to the practices described in this Privacy Policy.
Information We Collect
To provide our services, we may collect:
- Shopify store information, including store name, email, and access token
- Customer booking details, including name, email, phone number, and appointment information
- Billing information processed through Shopify
- Technical information such as IP address, browser, and device details
- Google Calendar information, only if you connect Google Calendar, including calendar list, free/busy availability, and booking event details needed to create, update, reschedule, or cancel booking events.
- Microsoft Calendar information, only if you connect Microsoft Outlook, including calendar list, free/busy availability, and booking event details needed to create, update, reschedule, or cancel booking events.
- Zoom integration information, only if you connect Zoom, including user profile details and video meeting links generated for bookings.
How We Use Your Information
We use your information to:
- Provide and maintain the SlotMate app
- Manage appointments and bookings
- Synchronize calendar events
- Provide customer support
- Improve our services
- Prevent fraud and comply with legal obligations
Data Retention
Google, Microsoft, and Zoom OAuth tokens and integration metadata are deleted when the respective integration is disconnected or SlotMate is uninstalled. Existing SlotMate booking records may be retained for up to 60 days after uninstall, unless earlier deletion is requested or longer retention is legally required. Existing events or meetings already created in external platforms (Google Calendar, Microsoft Outlook, or Zoom) are not automatically deleted when the integration is disconnected.
Data Security
We implement industry-standard technical and organizational security measures to protect your personal information and merchant data.
Our data security practices include:
- Encrypted database storage and encrypted database backups protecting sensitive data and integration records at rest.
- HTTPS/TLS encryption enforced for all data transmissions, API communications, and web traffic in transit.
- Restricted staff access based on the principle of least privilege, allowing access only to authorized personnel who require it to operate, maintain, or secure the service.
- Multi-factor authentication (MFA) required for all administrative and staff access to systems and infrastructure.
- Centralized security logging and monitoring to detect, analyze, and prevent unauthorized access or anomalous activity.
- Encrypted OAuth access and refresh tokens (Google, Microsoft, and Zoom) that are never exposed to merchants, customers, or unauthorized third parties.
- No storage of sensitive Shopify login credentials or payment card information.
Security Incident Response
SlotMate maintains a documented process for identifying, containing, investigating, and recovering from security incidents. If an incident affects personal information, we assess the impact and provide notifications to Shopify, affected merchants, affected individuals, service providers, or regulatory authorities when required by applicable law or contractual obligations. Security or privacy concerns can be reported to [email protected].
Third-Party Services
SlotMate may use trusted third-party providers, including Shopify, cloud hosting services, and integrated services (Google Calendar, Microsoft Outlook, or Zoom) if connected, solely to operate and improve our services.
Google User Data
If you connect Google Calendar, SlotMate may access your Google account email, basic profile information, calendar list, free/busy availability, and calendar event data needed to create, update, reschedule, or cancel booking events.
While Google Calendar is connected, SlotMate stores the connected account email and name, encrypted OAuth tokens, selected calendar identifiers and calendar metadata, and Google Calendar event identifiers associated with bookings. Free/busy information is retrieved to calculate availability and is not retained as a permanent calendar history.
SlotMate requests the following Google OAuth permissions:
- calendar.calendarlist.readonly: Used to display the merchant’s available Google Calendars so they can select a calendar.
- calendar.events: Used to create, update, reschedule, and cancel booking events.
- calendar.events.freebusy: Used to check busy periods and prevent scheduling conflicts when calendar conflict checking is enabled.
- Basic profile permissions (openid, email, and profile): Used to identify the connected Google account.
SlotMate uses Google user data only to provide calendar synchronization and booking-related features requested by the merchant. SlotMate does not sell Google user data and does not share Google user data with advertising platforms or data brokers.
Google user data may be processed by our production hosting, database, and infrastructure providers only as necessary to operate, secure, and maintain the SlotMate service. These providers process data on our behalf and are not permitted to use Google user data for their own purposes.
SlotMate does not use Google Workspace API data to train, improve, or develop generalized artificial intelligence or machine learning models.
SlotMate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When a merchant disconnects Google Calendar or uninstalls SlotMate, SlotMate deletes the locally stored Google OAuth access and refresh tokens and the associated Google integration metadata. Users can also revoke SlotMate’s access from their Google Account under Security → Third-party connections.
Microsoft User Data
If you connect Microsoft Calendar (Outlook), SlotMate may access your Microsoft account email, basic profile information, calendar list, free/busy availability, and calendar event data needed to create, update, reschedule, or cancel booking events.
While Microsoft Calendar is connected, SlotMate stores the connected account email and name, encrypted OAuth tokens, selected calendar identifiers and calendar metadata, and Microsoft Calendar event identifiers associated with bookings. Free/busy information is retrieved to calculate availability and is not retained as a permanent calendar history.
SlotMate requests the following Microsoft OAuth permissions:
- User.Read: Used to retrieve the connected Microsoft account profile and email to identify the account.
- Calendars.ReadWrite: Used to create, update, reschedule, and cancel booking events in the selected Outlook calendar.
- Calendars.Read.Shared: Used to check busy periods and prevent scheduling conflicts when calendar conflict checking is enabled.
SlotMate uses Microsoft user data only to provide calendar synchronization and booking-related features requested by the merchant. SlotMate does not sell Microsoft user data and does not share Microsoft user data with advertising platforms or data brokers.
Microsoft user data may be processed by our production hosting, database, and infrastructure providers only as necessary to operate, secure, and maintain the SlotMate service. These providers process data on our behalf and are not permitted to use Microsoft user data for their own purposes.
When a merchant disconnects Microsoft Calendar or uninstalls SlotMate, SlotMate deletes the locally stored Microsoft OAuth access and refresh tokens and the associated Microsoft integration metadata. Users can also revoke SlotMate's access from their Microsoft account security settings.
Zoom User Data
If you connect Zoom, SlotMate may access your Zoom account email, basic profile information, and meeting settings needed to generate and manage video conferencing meetings.
While Zoom is connected, SlotMate stores the connected account email and name, encrypted OAuth tokens, and Zoom meeting links and identifiers associated with bookings.
SlotMate requests the following Zoom OAuth permissions:
- user:read or user:read:admin: Used to view user profile information to identify the connected account.
- meeting:write or meeting:write:admin: Used to create and manage Zoom meetings on behalf of the user for appointment bookings.
SlotMate uses Zoom user data only to generate and manage video meeting links for bookings. SlotMate does not sell Zoom user data and does not share Zoom user data with advertising platforms or data brokers.
Zoom user data may be processed by our production hosting, database, and infrastructure providers only as necessary to operate, secure, and maintain the SlotMate service. These providers process data on our behalf and are not permitted to use Zoom user data for their own purposes.
When a merchant disconnects Zoom or uninstalls SlotMate, SlotMate deletes the locally stored Zoom OAuth access and refresh tokens and the associated Zoom integration metadata. Users can also revoke SlotMate's access from their Zoom App Marketplace account settings.
Cookies
SlotMate does not use cookies to track users outside of those required by Shopify or integrated services.
Your Rights
Depending on your location, you may request access to, correction of, or deletion of your personal information. SlotMate complies with applicable privacy laws, including GDPR and CCPA where applicable.
Changes to This Policy
We may update this Privacy Policy from time to time. Any updates will be posted on this page.
Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us:
Legal Business Name: Digitrix Agency
Registered Address: OFFICE NO.3, SAI JYOTI APT, Pelhar Rd, near ZAIKA HOTEL, Wakanpada, Vasai East, Maharashtra, India
Country: India
Privacy Contact Email: [email protected]