Privacy Policy

1. Two different roles

Business owners and staff: SetMySlot is the controller of account data.

Clients who book with a business: the business is the controller and SetMySlot is the processor, handling that data on the business's behalf and following its instructions. Requests about this data should go to the business first; we help it answer them.

2. Data we handle

Business account: email, password (stored encrypted by the sign-in provider), business name, address, phone and WhatsApp, photo, hours, team and services.

Billing: tax ID when needed to issue a charge, the payment method (only a summary, such as the card's last digits) and invoice history. To receive deposits, the Pix key the business provides.

Clients who book: name, mobile number, email (optional), booking note, booking history, their choice about receiving texts, and internal notes the business adds.

Chat assistant: the messages exchanged with the assistant.

Technical data: IP address (to limit abuse of the assistant and protect the service), message delivery logs and essential cookies.

3. Why we use it and the legal basis

To provide the service: creating and managing bookings, showing the page, sending confirmations and reminders (performance of a contract, art. 7, V).

To text a client only when they agreed to receive texts (consent, art. 7, I). Clients can withdraw at any time.

To bill subscriptions and meet tax obligations (contract and legal obligation, art. 7, II and V).

Security and abuse prevention, such as the assistant's usage limit (legitimate interest, art. 7, IX).

We don't sell personal data and don't use it for advertising.

4. Who we share it with

Only with the providers the service needs to work, who process data on our behalf:

Supabase: database, sign-in and file storage.

Vercel: website hosting.

Resend: sending emails.

Mobizon: texts to Brazilian numbers; Twilio: texts to other countries.

Google (Gemini): the chat booking assistant.

Asaas and Stripe: subscription billing.

We may also share data when the law or an authority requires it.

5. Transfers to other countries

Some of these providers store or process data outside Brazil, mainly in the United States and the European Union. We choose providers with security measures and data protection agreements, as required by art. 33 of the LGPD.

6. Artificial intelligence assistant

Messages sent to the assistant are processed by Google's Gemini API to generate replies. While we use the free tier of that API, Google may use this content to improve its own products. So please don't send sensitive data, such as health information, to the assistant.

7. How long we keep it

We keep data while the business account exists. If the business asks for its account to be deleted, we delete the data within 30 days, except what the law requires us to keep longer, such as billing records.

A client can ask the business to delete their data; the business forwards the request to us and we delete it within 15 days.

8. Your rights

Under the LGPD you can ask for: confirmation that we handle your data, access to it, correction, anonymization or deletion of unnecessary data, portability, information about who we share it with, and to withdraw consent (art. 18).

To do so, write to [E-MAIL]. We reply within 15 days. You can also complain to Brazil's National Data Protection Authority (ANPD).

9. Security

We use encrypted connections (HTTPS), passwords that aren't visible even to us, and database rules that stop one business from seeing another's data. No system is 100% secure; if an incident could put you at risk, we will tell you and the ANPD.

10. Cookies

We only use essential cookies: one that keeps you signed in to the dashboard and one that remembers your appearance choice (light or dark). We don't use advertising or tracking cookies.

11. Minors

Business accounts are for people 18 and older. When a minor books as a client, the business is responsible for getting any authorization needed.

12. Changes to this policy

We may update this policy. The date at the top shows the current version, and significant changes will be announced to businesses by email.