Privacy policy

Last updated: 30 October 2026

BookSlot is a Shopify app that lets stores take bookings for appointments, consultations, classes and demos. This policy explains what personal data BookSlot handles, why and on what legal basis, where it is kept, who helps us process it, how it is transferred, how long it stays and what rights you have. It applies to the BookSlot app, the booking page it adds to a store, and this website.

If you are a merchant, this policy together with the terms of service and the data processing agreement governs how we handle data for your store. If you are a customer who booked with a store, the store is the controller of your data and its own privacy policy applies first; this policy tells you what BookSlot does with that data on the store’s behalf.

1. Who we are and our role

BookSlot (“we”, “us”, the “Provider”) is developed and operated by Fenloft FZE, a free zone establishment incorporated in the United Arab Emirates and licensed by the Sharjah Publishing City Free Zone Authority (licence no. 4431620.01), registered at Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. You can reach us at support@fenloft.com. We have not appointed a data protection officer because the law does not require one for an organisation of our size and activity; the same address reaches the person responsible for data protection.

We act in two roles:

Processor for the personal data of a store’s customers and staff. Merchants (Shopify stores that install BookSlot) are the controllers of that data. BookSlot processes it only on the merchant’s behalf and on their documented instructions, which are the settings they choose in BookSlot and the terms of the data processing agreement.
Controller for the data we need to run a merchant’s BookSlot account: the shop, its admin users, plan and billing status, support correspondence and the security records of our own systems.

If you booked with a store and have a question about your data, the store is your first contact. You can also write to us and we will pass your request to the store or answer it with them.

Shopify permissions we ask for

When a merchant installs BookSlot, Shopify shows the permissions below. We request nothing else.

Permission	What it is used for
`read_customers, write_customers`	Find or create the Shopify customer for a booking, tag them, record marketing consent
`read_locations`	Offer the store's Shopify locations when the merchant creates a BookSlot location
`read_themes`	Check that the booking page's app embed is turned on in the theme
`read_products`	List the product variants a paid service can be linked to and read their prices
`read_orders, write_orders (optional, asked only when the merchant turns on paid bookings)`	Confirm a paid booking when its order is paid, and release it when the order is cancelled or refunded

2. Data about merchants and their staff

Shop details from Shopify: shop domain, store name, contact email, time zone, currency and language.
Shopify access: the access token Shopify issues so BookSlot can act for the store, and, for people who open BookSlot in the Shopify admin, the Shopify user id, name, email and language that Shopify includes with the session.
Plan and billing status: plan, trial end date and Shopify subscription id. Shopify bills the merchant; BookSlot never sees card or bank details.
Settings the merchant enters: locations (name, address, phone, meeting link, opening hours, team inboxes for notifications), services, booking questions, email templates and notification settings.
Staff profiles the merchant creates: name, and if entered, email, phone, title, bio, photo link, time zone, working hours and time off; a private calendar feed link per staff member.
Google Calendar connections for staff who connect one: see Google Calendar data.
Access records: when someone opens a booking’s details, views the bookings list or calendar, or exports bookings or customers, BookSlot records who did it, when, and the IP address of the request. BookSlot also records when a customer looks up their own bookings on the storefront, when it creates or tags a Shopify customer for a booking, and each privacy request from Shopify. These records exist so that access to personal data can be reviewed, as Shopify’s protected customer data requirements ask.
Support correspondence: emails a merchant or customer sends to our support address, kept in our mailbox for as long as needed to resolve the matter and for our records.

3. Data about customers who book

When a customer books or requests a booking on a store that uses BookSlot, BookSlot stores:

Name, email address and, when the store asks for it, phone number.
The booking itself: service, location, staff member, date and time (or the preferred time for a request), party size, answers to the store’s booking questions, notes the customer types, language, the booking reference, and the history of the booking (requested, confirmed, rescheduled, cancelled and by whom).
Notes the store’s team adds to the booking, and when they contacted the customer.
Campaign tags (utm_ parameters) from the page address, if the page was opened from a tagged link.
Whether the customer agreed to receive marketing email from the store (see consent).
For paid bookings: price, currency, payment status, and the Shopify order number and ids. Payment happens in the store’s Shopify checkout. BookSlot never receives or stores card or bank details.
Shopify customer link: when the store has “Create Shopify customers from bookings” turned on, BookSlot finds or creates the customer in the store’s Shopify customer list (name, email, phone), tags them with the service and location booked, records email marketing consent only when the customer ticked the box, and stores the Shopify customer id.

BookSlot does not collect postal addresses, dates of birth, payment card data, government identifiers, precise location data or any special categories of personal data (such as health data). Stores that offer health, wellness or similar services should not ask for such data in their booking questions; booking questions are free text the store designs, and the store is responsible for what it asks.

Data inventory

Category	Data	Whom it is about	Where it comes from
Store account	Shop domain, store name, contact email, time zone, currency, language, Shopify access token, plan and trial dates, Shopify subscription id	Merchant	Shopify, at install and on each sign-in
Admin users	Shopify user id, name, email and language of each person who opens BookSlot	Merchant staff	Shopify session token
Store configuration	Locations (name, address, phone, meeting link, hours, team inboxes), services, prices, booking questions, email templates, notification settings	Merchant; may name staff	Entered by the merchant
Staff profiles	Name and, if entered, email, phone, title, bio, photo link, time zone, working hours, time off; a private calendar feed token	Merchant staff	Entered by the merchant
Customer contact details	Name, email address, phone number (when the store asks for it), preferred language, marketing consent choice, Shopify customer id	Customer	Typed by the customer in the booking page; Shopify customer record
Bookings	Service, location, staff member, date and time or preferred time, party size, answers to booking questions, customer notes, campaign (utm) tags, booking reference, status history, team notes and contact log	Customer; merchant staff	Booking page; the merchant's admin
Payments for paid bookings	Price, currency, payment status, Shopify order id and number. Never card or bank details	Customer	Shopify checkout and order webhooks
Email records	Recipient address, kind of email, delivery status, time sent	Customer; merchant staff	BookSlot's email sending
Access records	Who viewed a booking, the bookings list or calendar, or exported data; when; the IP address of the request; privacy requests received from Shopify	Merchant staff; customer (as the record viewed)	BookSlot
Error reports and logs	Technical details of an error with the shop domain; application logs with email addresses and tokens removed	Merchant (shop); incidental	BookSlot's servers

The booking form shows an unticked “Email me news and offers” checkbox. BookSlot records marketing consent, and passes it to the store’s Shopify customer record, only when the customer ticks it. BookSlot never ticks it for them and never sends marketing email itself; unsubscribing is handled by the store’s own Shopify marketing emails.
For bookings the store confirms later (requests), the customer must tick “I agree to be contacted about this booking”, next to a link to the store’s privacy policy, before the request can be sent.
Booking emails (confirmations, reminders, changes) are part of the service the customer asked for and are sent without a separate opt-in. A store can turn each kind of email off.
The storefront widget sets no cookies and uses no tracking, so it needs no cookie consent of its own (see the next section).

4. Data collected automatically, cookies and local storage

Email delivery records: for every email BookSlot sends, the recipient address, the kind of email, delivery status and time.
IP addresses: storefront requests are rate-limited by IP address in server memory only; the address is not stored. IP addresses are stored only in the access records described above.
Server logs and error reports: our hosting provider keeps application logs, and errors are reported to our error-monitoring provider. BookSlot removes email addresses and access tokens from logs, and email addresses and phone numbers from error reports, before anything is written or sent.
Storefront widget: sets no cookies. It uses the browser’s local storage on the customer’s own device to keep the details they are typing (name, email, phone, marketing choice) until the booking is sent, and to remember a time held during checkout. Clearing the browser’s site data removes it.
Admin: BookSlot uses Shopify’s session tokens. Connecting Google Calendar sets one short-lived security cookie (about 15 minutes) for the sign-in step.
This website sets no cookies and uses no analytics, tracking pixels or third-party scripts.

5. How we use data

To show availability and take, confirm, reschedule and cancel bookings for the store.
To send transactional emails: confirmations with a calendar file, reminders, reschedules, cancellations, request updates and follow-ups to customers, and new-booking, cancellation and unanswered-request alerts to the store’s team. BookSlot itself sends no marketing email.
To link bookings with Shopify customers, checkout and orders when the store turns those features on.
To provide each staff member’s calendar feed and, when connected, Google Calendar sync.
To manage the merchant’s plan and billing through Shopify.
To keep the service secure, investigate problems, answer support requests and meet legal obligations.
To produce aggregate, non-identifying statistics about how BookSlot is used (for example the number of bookings per plan), which contain no personal data.

We do not sell or share personal data

BookSlot does not sell personal data and does not “share” it for cross-context behavioural advertising, as those words are used in the CCPA and similar US state laws, and has never done so. Personal data goes only to the sub-processors below, for the purposes above, and to the places the store itself chooses. There is therefore nothing to opt out of; customers who want their data removed can use the rights described below.

We also do not use personal data for advertising, build profiles, make automated decisions with legal or similar effects, or use it to train AI or machine-learning models.

BookSlot uses the providers below to run the service. Each one receives only what it needs for its task and is bound by a written data processing agreement with us. This list is also Annex III of our data processing agreement; we tell merchants by email at least 30 days before adding or replacing a provider.

Provider	What for	Region	Transfer basis
Shopify Shopify Inc. and Shopify International Ltd.	The platform BookSlot runs in: merchant sign-in, customer records, checkout and payment for paid bookings, app billing, compliance webhooks	Shopify's infrastructure (global)	The merchant's own Shopify agreement and Shopify's data processing addendum
Supabase Supabase, Inc.	PostgreSQL database holding all BookSlot data, and its encrypted daily backups	AWS us-east-1 (North Virginia, United States)	Supabase DPA with EU Standard Contractual Clauses
Fly.io Fly.io, Inc.	Hosting of the BookSlot application and background jobs; application logs (redacted) kept for a short period	iad (Ashburn, Virginia, United States)	Fly.io DPA with EU Standard Contractual Clauses
Amazon Web Services (Amazon SES) Amazon Web Services, Inc.	Sending booking emails to customers and store teams; delivery and bounce records	us-east-1 (North Virginia, United States)	AWS GDPR Data Processing Addendum with EU Standard Contractual Clauses
Sentry Functional Software, Inc.	Error monitoring: technical reports of errors in the app and background jobs, tagged with the shop domain. Email addresses and phone numbers are removed before a report is sent	European Union (EU data residency)	Sentry DPA; data stored in the EU
Cloudflare Cloudflare, Inc.	Routing of email sent to the support address to the Provider's mailbox (support correspondence only)	Global network	Cloudflare DPA with EU Standard Contractual Clauses
Google Google LLC	Optional Google Calendar sync, which is not yet offered to stores: once it is, and only when a staff member connects Google Calendar, reading and writing that staff member's chosen calendar. Until then BookSlot sends nothing to Google	Google's infrastructure (global)	Google Cloud data processing terms with EU Standard Contractual Clauses; staff member's own consent

At the store’s choice, booking details also go to places the store controls: the Shopify admin, the store team’s inboxes, each staff member’s private calendar feed (service, customer first name, reference; anyone with the feed link can read it, and the store can change the link at any time), and a connected Google Calendar (see below).

Beyond that, we disclose personal data only when the law requires it: to comply with a court order, subpoena or other binding request from a public authority, to protect the rights, property or safety of BookSlot, our merchants or others, or in connection with a merger, acquisition or sale of assets, in which case the acquirer takes over this policy and merchants are told beforehand. We will challenge requests that are overbroad and, unless prohibited, tell the affected merchant.

7. Google Calendar data

BookSlot’s Google Calendar sync is optional and available on the Pro plan. A merchant’s staff member turns it on by clicking Connect Google Calendar in BookSlot and approving access on Google’s consent screen. BookSlot asks for two permissions:

See, create, change, and delete events on Google calendars you own, used only for the one calendar the staff member chooses: BookSlot adds an event for each confirmed appointment assigned to them, updates it when the appointment is rescheduled and deletes it when the appointment is cancelled; and it reads changes to that calendar’s events so the staff member’s existing commitments are not offered as bookable times.
See the list of Google calendars you’re subscribed to, used only to let the staff member choose which calendar to sync.

What we put in your calendar. Each event BookSlot adds is titled with the service and the customer’s first name, has the location, and its description holds the booking reference, the customer’s name and phone number, party size, the customer’s notes, the meeting link for online locations and a link to the booking in BookSlot. BookSlot does not invite attendees, so Google sends no emails.

What we store. The Google account email, an encrypted access token and refresh token (AES-256-GCM, key held only in our hosting provider’s secret store), the id of the chosen calendar, a sync cursor and push-notification channel id, the ids of the events BookSlot created, and the start time, end time and title of busy events in the chosen calendar for roughly the next 90 days. We do not store the descriptions, attendees or locations of your own events. Titles are kept only with your connection and are never shown to customers or other merchants; the booking page only sees that a time is unavailable.

How we use it. Only to provide the sync feature described above, which is visible in the BookSlot staff panel. We do not use Google user data for advertising, do not sell it, do not use it to train AI or machine-learning models, and do not transfer it to anyone except our infrastructure providers (Fly.io for hosting, Supabase for the database) as needed to run the feature, or where required by law. BookSlot staff do not read your calendar data except with your permission for support, for security investigations, or where required by law.

Retention and deletion. Disconnecting in BookSlot revokes BookSlot’s access at Google and immediately deletes the tokens, the chosen calendar id and all cached busy times. Events BookSlot already added to your calendar stay there unless you delete them. If access stops working (for example you revoked it in your Google account), BookSlot keeps the cached busy times for 7 days so you can reconnect, then deletes them. When a store’s data is deleted after it uninstalls BookSlot (see retention), BookSlot first stops its calendar notifications and revokes its access at Google, then deletes all of the above with the rest of the store’s data. You can also remove BookSlot at any time at myaccount.google.com/connections.

BookSlot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Retention and deletion

We keep personal data only for as long as the purpose it was collected for requires, and then delete or anonymise it. The periods below are applied automatically by the service; no one has to remember to run them.

While BookSlot is installed, bookings, customers and settings are kept for as long as the store keeps using BookSlot, so the store can see its booking history. Merchants can export bookings and customers as CSV files at any time.
On uninstall, BookSlot marks the store inactive and deletes its Shopify access sessions straight away. The rest of the data is kept until Shopify sends its shop deletion request (48 hours after uninstall). BookSlot waits a further 48 hours and then deletes everything it holds for that store: shop, settings, staff, customers, bookings, answers, email records, access records and calendar connections. Reinstalling before then picks up where the store left off.
Customer deletion requests (Shopify’s customers/redact, sent when a store or customer asks Shopify to erase a customer): BookSlot replaces the customer’s name and email, removes their phone, notes, language, marketing choice and Shopify customer id, deletes their booking answers, clears the notes on their bookings and removes their address and any free-text reasons from the booking history and email records. Bookings that have not happened yet are cancelled without emailing anyone, and their events are removed from connected staff calendars. The anonymous bookings stay in the store’s reports.
Customer data requests (Shopify’s customers/data_request): BookSlot emails the store owner a JSON file with everything it holds about the customer (contact details, bookings, booking answers, booking history and the emails sent about their bookings) for the store to send to the customer. Addresses of other recipients and of the store’s team are left out.
Email delivery records (recipient address, status) are deleted after 90 days, and access records after 12 months, by a daily job.
Inactive customers: a customer with no booking activity for 24 months (no booking that took place or changed in that time) is anonymised the same way as a customer deletion request, by the same daily job.
Error reports are kept by our error-monitoring provider for 90 days and application logs by our hosting provider for a short rolling period measured in days.
Backups of the database are taken daily, encrypted, and kept for 7 days, so deleted data can remain in a backup for up to 7 days after deletion. Backups are used only to restore the service after a failure, never to recover data a merchant or customer asked us to delete.
Account and billing records we hold as controller (shop domain, plan history, invoices issued through Shopify, support correspondence) are kept for the period our tax and accounting law requires, which is five years after the end of the relationship, and then deleted.

9. International transfers

BookSlot is operated from the United Arab Emirates and all data is stored and processed in the United States (AWS us-east-1, North Virginia). Personal data of people in the European Economic Area, the United Kingdom and Switzerland is therefore transferred to countries that their laws do not consider to provide equivalent protection. We rely on the following safeguards:

Between the merchant and us: the data processing agreement incorporates the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), the UK International Data Transfer Addendum and the Swiss adaptations. Installing BookSlot concludes them; no signature is needed and merchants can download the agreement for their records.
Between us and our sub-processors: each provider in section 6 is bound by its own data processing agreement with Standard Contractual Clauses, as listed in the “Transfer basis” column. Amazon Web Services, Google and Cloudflare are also certified under the EU-US Data Privacy Framework; merchants may rely on either mechanism.
Supplementary measures: encryption in transit and at rest, access limited to the Provider’s personnel, pseudonymised error reports and logs, and our commitment in the DPA to challenge disproportionate government access requests and to inform the merchant where the law allows.

We do not offer EU or UK hosting at present. Merchants who need their customers’ data to stay in a particular region should not install BookSlot until such an option exists.

10. Security

We protect personal data with technical and organisational measures appropriate to the risk, as Article 32 GDPR requires. The full list is Annex II of the data processing agreement. In summary:

All traffic to BookSlot uses HTTPS (TLS 1.2 or higher); the database and email connections are encrypted in transit.
The database and its backups are encrypted at rest (AES-256) by Supabase.
Google OAuth tokens are additionally encrypted by BookSlot (AES-256-GCM) before they are stored, with a key kept only in the hosting provider’s secret store. No secrets are kept in BookSlot’s source code.
Requests from Shopify (webhooks, storefront requests) are checked with Shopify’s signatures, and every database query is limited to the one store it belongs to.
Access to production systems and data is limited to the Provider’s personnel who need it, protected by unique credentials and two-factor authentication, and reviewed quarterly.
Production data is kept apart from development and testing. Stores that install BookSlot from the Shopify App Store use the production database only; development stores and automated tests use separate databases that hold test data only, and the development tools refuse to start when pointed at the production database.
We keep a written security incident response policy and a data loss prevention strategy, rehearse restoring from backup, and review the access records monthly.
If a personal data breach affects a merchant’s data, we will tell the merchant without undue delay, and in any event within 48 hours of becoming aware of it, with the information they need to meet their own notification duties. Where we are the controller we notify the competent authority and the people affected as the law requires.

11. Legal bases (GDPR and UK GDPR)

Where the GDPR or the UK GDPR applies, we rely on the following legal bases. For customer data processed on a merchant’s behalf, the merchant chooses the legal basis as controller; the table shows the usual one.

Purpose	Legal basis
Providing BookSlot to a merchant: the account, settings, plan and billing	Performance of our contract with the merchant (Article 6(1)(b) GDPR)
Taking, confirming, changing and cancelling bookings and sending booking emails to customers	Processing on the merchant's instructions under the DPA; the merchant's own basis is usually the performance of its contract with the customer (Article 6(1)(b))
Recording a customer's marketing consent and passing it to the store's Shopify customer record	The customer's consent (Article 6(1)(a)), given by ticking an unticked box; the store is the controller of the resulting marketing
Security, fraud prevention, access records, error monitoring, backups	Our legitimate interest in running a secure and reliable service (Article 6(1)(f)), and Article 32 GDPR
Answering support requests from merchants and customers	Performance of the contract and our legitimate interest in providing support (Article 6(1)(b) and (f))
Keeping records required by law, and responding to lawful requests from authorities	Compliance with a legal obligation (Article 6(1)(c))

Where we rely on legitimate interests we have balanced them against your rights and found no overriding prejudice; you can object at any time (section 12). We do not use personal data for automated decision-making that produces legal or similarly significant effects.

12. Your rights

Depending on where you live, you may have the right to access your personal data and receive a copy, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw a consent you gave (without affecting what was done before), and to complain to a supervisory authority. Nothing we do depends on you giving up these rights, and we will not treat you differently for exercising them.

Merchants can see and change their data in BookSlot, export bookings and customers, delete everything by uninstalling, or email us for anything else. We answer within 30 days (one month under the GDPR), or tell you why we need longer.
Customers should contact the store they booked with; stores handle these requests through Shopify’s customer privacy tools, which send them to BookSlot automatically, and we act on them as section 8 describes. You can also email us and we will forward your request to the store and help answer it. We may ask for information to confirm who you are before acting.
Staff who connected a Google Calendar can disconnect it in BookSlot or revoke it at Google at any time.

Supervisory authorities. In the EU you may complain to the authority of the country where you live or work; in the UK to the Information Commissioner’s Office; in Switzerland to the Federal Data Protection and Information Commissioner. We would appreciate the chance to answer your concern first.

UK and EU representatives. We process the data of people in the EU and the UK only occasionally, as a processor for merchants, and have not appointed a representative under Article 27 GDPR or Article 27 UK GDPR. We will appoint one if our processing changes in a way that requires it.

13. California and other US states

For residents of California and other US states with consumer privacy laws: BookSlot acts as a “service provider” or “processor” to the merchant for customer data. In the preceding twelve months we collected the categories of personal information listed in section 3 (identifiers, commercial information about bookings, and the free-text answers a store asks for) for the business purposes in section 5, from the sources in the inventory table, and disclosed them for business purposes only to the sub-processors in section 6. We did not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information to infer characteristics about anyone. You have the rights to know, delete, correct and port your information and to be free from discrimination for exercising them; for customer data, direct your request to the store, and for data we hold as controller, to us. You may use an authorised agent; we will verify the request with you.

14. Children

BookSlot is a tool for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16 (or the age at which a person can consent under their local law). Stores are responsible for the services they offer through BookSlot and for any age requirements that apply to them. If you believe a child’s data has reached BookSlot, tell us and we will delete it.

15. Changes to this policy

When BookSlot’s data handling changes we update this page and the date at the top. For material changes (a new purpose, a new category of data, a new sub-processor, a change of hosting region) we also tell merchants by email at least 30 days before the change takes effect, so they can object or stop using BookSlot. Earlier versions are available on request.

16. Contact

Fenloft FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Questions, requests and complaints about privacy: support@fenloft.com. Security reports to the same address with “Security” in the subject line.