Privacy Policy

This policy explains what Keptslot does with personal information. It is written to meet Canada's PIPEDA, and the part on California residents sets out the additional rights of California residents under the CCPA/CPRA.

Keptslot is operated by Noctis Nova, a Canadian business. Noctis Nova is the organisation accountable for the personal information described here, and the one to contact about it.

The two people this policy covers

Keptslot provides booking software to businesses. Two different people appear in it, and their rights differ:

• The business that holds a Keptslot account and publishes a booking page.
• The customer who books an appointment through that page.

For a customer's booking information, the business decides what is collected and why. It chooses the questions its booking form asks. We hold and process that information on the business's behalf and on its instructions.

For a business's own account and billing information, Keptslot decides the purposes, and this policy describes them directly.

The practical consequence: if you booked an appointment and want a record changed or deleted, the business you booked with is the first and fastest place to ask. We will also help. See your rights, and how to use them, below.

If you booked an appointment

The booking form asks for:

• Your name, so the business knows whose appointment it is.
• Your email address, so we can send your confirmation and any change to the appointment.
• Your mobile number, which is optional. The booking completes without it. Entering it is how you opt in to text messages. See the Text Message Terms.

We also store the appointment itself: the service, the time, the calendar it was booked against, and its status.

We store your answers to any additional questions the business has added to its own booking form. Those questions are written by the business, not by us, so we cannot list them here. Under the Acceptable Use Policy a business must not use them to collect information for a purpose other than the appointment, and must not ask for more than the appointment needs.

If you paid a deposit or a service price, see payment information below.

That is the whole of it. There is no analytics, no advertising, no tracking and no third-party script on a Keptslot booking page. We do not build a profile of you, we do not follow you to other websites, and the page sets no advertising or analytics cookies.

If you run a business on Keptslot

We store the identity you sign in with, which is your name and email address as held by our sign-in provider, and whether your email is verified.

We store your workspace: your services and prices, your calendars and the people on them, your availability, your booking page settings, and any branding you upload.

We store your billing relationship: your plan, your allowances and usage against them, and our payment processor's identifiers for your customer and subscription records. Your card details are held by that processor, not by us.

Your customers' booking information belongs to your workspace. It is not shared with any other business on Keptslot, and we do not use it to market to your customers.

Information collected automatically

When you make a request to Keptslot we process your IP address, in order to rate-limit abusive traffic and protect booking pages from automated attack. This is the only automatic collection there is, and it is a security measure, not measurement.

Rate-limit records containing an IP address are deleted after one hour. They are counters, not a history of your visit, and they are not linked to a booking or to any account.

We keep operational logs to run and secure the service and to diagnose faults. They are kept only as long as that purpose requires.

Our network and hosting provider processes request data including IP addresses to route traffic and block attacks. See service providers below.

Why we use this information

PIPEDA requires that purposes be identified before or at the time of collection. Ours are:

• To create, hold and display an appointment.
• To send the transactional messages an appointment requires: a confirmation, a reminder, and notice that it moved or was cancelled.
• To let a business run its workspace and see its own bookings.
• To take a deposit or payment where a business requires one, and to refund it where one is owed.
• To bill a business for its subscription and to meter its allowances.
• To keep the service secure and available, including rate limiting and abuse prevention.
• To answer support requests, including a request about your own information.
• To comply with the law, and to establish or defend legal claims.

We do not use personal information for any purpose other than these without asking first.

We may use aggregated and de-identified information, which does not identify anyone, to operate and improve Keptslot.

Consent

Where you provide information to complete a booking you have started, your consent is given by providing it, for the purposes listed above.

Entering a mobile number is a separate, optional consent to receive text messages about your appointment. The disclosure appears beside the field before you type. Leaving it blank means no texts and does not prevent the booking.

You may withdraw consent at any time, subject to legal and contractual limits. Reply STOP to a text to withdraw consent to texts. To withdraw more broadly, contact the business or us. Withdrawing consent for information an appointment depends on may mean the appointment cannot go ahead.

We never send marketing texts, and a business cannot use Keptslot to send you any.

Payment information

Where a business requires a deposit or payment, card details are entered into payment fields hosted by our payment processor. Keptslot never receives, sees or stores a card number, expiry date or security code.

What we record against a booking is the amount, the currency, the status of the payment, and the processor's identifiers for it, so that the business and the customer have a consistent record and so that a refund can be traced to the person owed it.

The payment is a payment to the business, not to Keptslot, and the business is the merchant of record. The processor handles it under its own privacy policy and its agreement with that business. See payments from Customers to Businesses in the Terms of Service.

Text messages

Where you have given a mobile number, it is used to send messages about your own appointment and nothing else. The Text Message Terms describe the full flow, including how you opted in and how to stop.

Text messages are delivered by our text message provider on our behalf, to numbers in the United States and Canada only. A booking made with a number outside those countries still completes, and its messages arrive by email instead.

Service providers

We use seven outside services to operate Keptslot. Each receives only what its function requires, is bound to use it only to provide that service to us, and may not use it for its own purposes.

• A sign-in provider — sign-in identity and email address, for business logins. Customers who book do not have an account and are never sent to it.
• A payment processor — card details and payment records, for subscriptions and for deposits taken by businesses.
• An email delivery provider — email addresses and message contents, to deliver confirmations, reminders and alerts.
• A text message provider — mobile numbers and message contents, to deliver text messages. United States and Canada only.
• A network and hosting provider — DNS and request traffic for our websites, including IP addresses, to route it and to block attacks.
• A cloud infrastructure provider — the servers and database everything runs on.
• An error monitoring provider — error reports and application logs, which can include the name, email address and phone number given with a booking, to find and fix faults.

These are described by function rather than by company name, because the company behind a function can change while the function, and the limits on it, do not. If you want to know which company performs one of them, ask privacy@keptslot.com and we will tell you.

These providers process information outside Canada, including in the United States. While it is outside Canada it is subject to the laws of that country, and may be accessible to its courts and law enforcement under those laws. We use providers that contractually commit to protecting it to a comparable standard.

We may also disclose personal information where we are legally required to, to enforce the Terms of Service or the Acceptable Use Policy, to protect the rights or safety of any person, or in connection with a merger, acquisition or sale of assets, in which case the information stays subject to a policy no less protective than this one.

What we do not do

We do not sell personal information.

We do not share personal information with anyone for their own marketing or advertising.

We do not sell or share your mobile number, or the fact that you gave it to us, with third parties or affiliates for their own marketing or promotional purposes.

We do not use your information to train advertising models or to build behavioural profiles.

We do not run advertising or analytics trackers on booking pages.

Security

Traffic to Keptslot is encrypted in transit. Access to production data is restricted to the people who need it to operate the service. Card details never reach our systems, as payment information above explains.

Each workspace's data is separated from every other workspace's, and requests are scoped so that one business cannot read another's.

No system is perfectly secure, and we do not claim otherwise. If a breach occurs that creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep the records of it that PIPEDA requires.

Accuracy

Personal information is used as it was given to us. A business can correct a customer record in its dashboard, and a customer can ask the business to. If something is wrong and the business cannot fix it, contact us as your rights, and how to use them, describes.

How long we keep it

Booking information is kept for as long as the business's workspace exists, because it is the business's record of its own appointments.

When a workspace is deleted it stops being reachable immediately, and it is permanently erased 30 days later, together with the bookings, customer records and answers in it.

There is one exception, and it exists to protect customers. A workspace holding a payment that has not been settled or refunded is not erased while that remains true, however long that is. Erasing it would destroy the only record connecting a refund owed to the person owed it. Once the payment is resolved, the ordinary 30-day erasure applies.

Rate-limit records containing an IP address are deleted after one hour, as information collected automatically explains.

We may keep information longer where the law requires it, such as financial records for tax purposes, or where it is needed to establish or defend a legal claim.

Your rights, and how to use them

Under PIPEDA you have the right to ask what personal information we hold about you, what it has been used for, and who it has been disclosed to; to ask that it be corrected; and to withdraw consent as the part on consent describes.

If you booked an appointment, ask the business first. They control that record and can act on it immediately. We hold it on their behalf, so a request to us about a booking is usually passed to them.

You can also email privacy@keptslot.com and we will help, including where a business is unresponsive.

We will respond within 30 days, as PIPEDA requires, and will tell you if we need an extension and why. We may need to verify your identity before acting, and we will ask only for what verification needs.

There is no charge for a request. We will tell you in advance if a request is unusually costly and what it would cost, so you can decide whether to proceed.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. We would rather you told us first, at the address in 14.3, so we have a chance to fix it.

California residents

This section applies to California residents and is given under the California Consumer Privacy Act as amended by the CPRA. It does not replace the rest of this policy.

In the last twelve months we have collected these categories of personal information, in each case for the business purposes listed in why we use this information:

• Identifiers — name, email address, optional mobile number, IP address, and account identifiers. Collected from you when you book or sign up, and from our sign-in provider.
• Commercial information — appointments booked, services purchased, deposits and payments, and subscription and usage records.
• Internet or network activity — request data used for rate limiting and security only, deleted after one hour. We do not collect browsing history or cross-site activity.
• Other information you choose to provide — your answers to a business's own booking questions, whose content is set by that business.

We have not sold or shared personal information in the last twelve months, and we do not do so. "Sold" and "shared" carry their CCPA meanings, and "shared" includes disclosure for cross-context behavioural advertising. We have not sold or shared the personal information of anyone under 16, and we do not knowingly collect it.

We disclose personal information for business purposes only, to the service providers named above, each of which is bound not to use it for its own purposes.

We do not use or disclose sensitive personal information for any purpose that gives rise to the right to limit its use.

As a California resident you have the right to know what we have collected and how it has been used and disclosed; to obtain a portable copy; to correct inaccurate information; to delete personal information, subject to the exceptions the statute allows; and to opt out of sale or sharing, which is already the case for everyone under 15.3.

We will not discriminate against you for exercising a right. Your service, your price and your booking are unaffected.

To make a request, email privacy@keptslot.com. We will confirm receipt within 10 business days and respond within 45 days, extending by a further 45 days where the statute allows and telling you if we do. We will verify your identity before acting. An authorised agent may act for you with written permission we can verify.

Where you booked an appointment, we act as a service provider to the business, and a deletion or correction request may be passed to it as the party that controls the record.

Children

Keptslot is not directed at children, and we do not knowingly collect personal information from them. A business is responsible for the lawfulness of any booking made for a child through its page. If you believe a child's information has reached us, contact privacy@keptslot.com and we will delete it.

Changes to this policy

We may update this policy. The date at the top of the page changes when we do, and we will give notice of a material change to businesses by email or in the dashboard before it takes effect. A change is not applied retroactively to information already collected under an earlier version in a way that would breach the consent given for it.

Contact

Keptslot is accountable for the personal information in its control. Privacy questions, access requests and complaints go to our privacy contact at privacy@keptslot.com.

For anything else, write to support@keptslot.com. To report a booking page that is being misused, see Acceptable Use.