Privacy Policy

What we collect and why

We only collect what the service needs. Depending on how you use it:

Your account

• Your name and email address, so you can sign in and we can contact you about your account.
• Your password, stored only as a salted hash. We cannot read it.
• Sign-in sessions: a session cookie, plus the IP address and browser type of each session, to keep your account secure.
• The content you create in the app, so we can provide the service to you.

Legal basis: performing our contract with you (providing the service you signed up for).

Newsletter

• Your email address, where you signed up, and when you confirmed your subscription (double opt-in).
• You can unsubscribe at any time with the link in every email.

Legal basis: your consent. Withdrawing it does not affect earlier processing.

Contact form

• Your name, email address and message, so we can reply.
• The IP address the message was sent from, to prevent spam and abuse.

Legal basis: our legitimate interest in answering questions and keeping the form free of abuse.

Push notifications

• If you turn notifications on, your browser gives us a push subscription (an address at your browser's push service and encryption keys), linked to your account when you are signed in.
• You can turn notifications off at any time in Settings or in your browser.

Legal basis: your consent.

Payments

• Payments are processed by Stripe. Your card details go directly to Stripe; we never see or store them.
• We store your Stripe customer ID and your subscription status, plan and renewal date.

Legal basis: performing our contract with you, and our legal obligations (for example tax and accounting records).

Analytics

• We use Cloudflare Web Analytics to count page views. It is cookieless: it does not set cookies, use local storage or build a profile of you, and it does not track you across sites.

Legal basis: our legitimate interest in understanding how the service is used.

Google Tag Manager

• If you accept analytics or marketing cookies, we load Google Tag Manager, which runs the tools listed on this page. Nothing from Google loads before you accept. It uses Google Consent Mode, so each tool only gets the permissions you gave.

Legal basis: your consent.

Google Analytics 4

• If you accept analytics cookies, Google Analytics 4 records the pages you visit, how you got here, your device and browser type and your approximate location, so we can see how the service is used.

Legal basis: your consent.

Microsoft Clarity

• If you accept analytics cookies, Microsoft Clarity records how you move through pages (clicks, scrolling and heatmaps, and session replays with form text masked), so we can find and fix problems.

Legal basis: your consent.

Marketing emails

• Once you confirm your newsletter subscription, we send your email address and the name of this product to Resend, which we use for marketing email. You only get emails about products you signed up to.

Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in our emails.

Technical and security logs

• When something goes wrong we log technical details such as the page, the error message and, if you are signed in, your account ID, so we can fix it.
• Short-lived counters keyed to your email or IP address limit repeated requests (rate limiting).

Legal basis: our legitimate interest in running a secure and reliable service.

Cookies

• Necessary (always on): a session cookie to keep you signed in, a setting in your browser that remembers your light or dark theme, and the cc_cookie cookie that remembers your cookie choice for 6 months.
• Analytics, only if you accept: the Google Analytics cookies _ga and _ga_*, kept for up to 2 years.
• Analytics, only if you accept: the Microsoft Clarity cookies _clck (up to 1 year) and _clsk (1 day).
• Marketing, only if you accept: advertising cookies set through Google Tag Manager, such as _gcl_*, kept for up to 90 days.

We ask before using any cookie that is not strictly necessary. Nothing in the analytics or marketing categories loads until you accept it, and you can change your choice at any time with the Cookie settings link at the bottom of every page. If you withdraw consent, we remove those cookies.

Who we share data with

• Cloudflare (hosting, database, content delivery and security).
• Resend (sending email, for example sign-in links and confirmations, and marketing email).
• The push service of your browser vendor (for example Google, Mozilla or Apple), which delivers notifications.
• Stripe (payments and billing). Stripe is also an independent controller for some data, such as fraud prevention.
• Google (Tag Manager, analytics and advertising measurement, only with your consent).
• Microsoft (Clarity session analytics, only with your consent).

We do not sell your data. We use these service providers (processors) to run the service:

International transfers

Some providers process data outside the UK and the European Economic Area. Where they do, we rely on adequacy decisions or the standard contractual clauses (and the UK addendum) to protect it.

How long we keep data

• Account data and your content: while your account exists. When you ask us to delete your account, we delete it, except where the law requires us to keep records.
• Newsletter: until you unsubscribe.
• Marketing contact details: until you unsubscribe and ask us to delete them.
• Contact messages: up to 2 years, then deleted.
• Payment records: as long as tax and accounting law requires (usually 6 to 10 years).
• Technical logs: up to 30 days.

Your rights

Under the UK GDPR and the EU GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Contact us by email at robin@mirratech.co; we reply within one month.

You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU the authority in your country.

Children

Slotted is not intended for children under 16, and we do not knowingly collect their data.

Changes

We will update this page when our practices change and tell you about important changes by email or in the app.