Privacy Policy

1. Who we are

Holdslots (“we”, “us”) operates a deposit-booking platform for local service businesses. This Privacy Policy explains what personal data we process when you use our website, merchant dashboard, booking pages, or related emails.

2. Data we collect

Depending on how you use Holdslots, we may process:

• Account data — email, authentication identifiers (including Google / Firebase), and password hashes managed by our auth provider.
• Merchant profile — business name, category, city, country, address, phone, business link, bio, timezone, services, and availability.
• Booking data — client name, email, phone (if provided), appointment times, notes, deposit amounts, and status.
• Payment data — Stripe account IDs, charge/payment identifiers, and payout-related status. Card numbers are handled by Stripe, not stored by Holdslots.
• Trust & support data — reviews, ratings, scam reports, and admin notes related to investigations.
• Technical data — IP address, device/browser type, and basic usage logs needed to secure and operate the Service.

3. How we use data

We use personal data to: create and manage accounts; run booking and deposit flows; send transactional emails (confirmations, reminders, review requests); prevent fraud and abuse; improve the product; comply with law; and communicate about the Service.

4. Legal bases

Where GDPR/UK GDPR apply, we process data under: contract performance (providing bookings and payments), legitimate interests (security, fraud prevention, product improvement), consent where required (e.g. optional marketing), and legal obligation where applicable.

5. Sharing

We share data with:

• Stripe — payment processing and Connect onboarding / payouts.
• Firebase / Google — authentication.
• Neon / database hosting — storing application data.
• Email provider (e.g. Resend) — transactional messages.
• Merchants and Clients — as needed to fulfill a booking (e.g. Client contact details shown to the Merchant).
• Advisors, authorities, or successors if required by law or a business transfer.

We do not sell personal data.

6. Cookies

Holdslots uses essential cookies and similar storage needed to keep you signed in (Firebase Auth), remember cookie-notice preferences, and run the site securely. We do not use advertising or third-party marketing cookies. You can clear cookies in your browser; doing so may sign you out.

7. Retention

We keep account and booking records for as long as needed to operate the Service, resolve disputes, meet tax/accounting needs, and enforce our Terms. You may request deletion of your account; some records may be retained where legally required or for legitimate security purposes.

8. Security

We use industry-standard safeguards (encryption in transit, access controls, and provider security features). No method of transmission or storage is 100% secure.

9. International transfers

Our providers may process data in the EU, UK, US, or other countries. Where required, we rely on appropriate transfer mechanisms (such as standard contractual clauses) offered by those providers.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your data, and to object to certain processing. Contact us using the details on the Holdslots site. You may also lodge a complaint with your local data protection authority.

11. Children

Holdslots is not directed to children under 16. We do not knowingly collect personal data from children.

12. Changes

We may update this Policy by posting a new version here. Material changes will be reflected in the “Last updated” date.