SlotSaver — Privacy Policy

Effective date: July 18, 2026

This Privacy Policy explains how The Atlas Project ("we," "us," "our") handles personal information in connection with SlotSaver at slotsaver.the-atlas-project.net. It applies to the Service and our marketing site. It does not cover the Third-Party Services you connect (Stripe, Calendly, and later Cal.com or Acuity), which have their own privacy policies.

SlotSaver is a no-show guard that sits on top of your existing booking tool. To do its job, it handles two kinds of personal information: (1) your account and billing information, for which we are the controller; and (2) personal information about your clients — names, email addresses, appointment times, and deposit records — which the Service processes on your instruction and on your behalf, so that you are the controller and we are your processor. The mini-Data Processing Addendum at the end of this Policy governs that second category.

§P1 Who we are; scope

The Atlas Project operates SlotSaver and the other products in the "An Atlas Project" family. This Policy covers SlotSaver only. Questions and privacy requests go to admin@the-atlas-project.net or admin@the-atlas-project.net.

Controller / processor roles. For your account and billing data, we act as controller. For client data the Service processes on your instruction (your clients' names, email addresses, appointment/booking details, deposit lifecycle records), you are the controller and we are your processor — see §P13-DPA.

§P2 Categories of personal information we handle

We do not use analytics or advertising cookies or pixels, and we do not build advertising profiles. If this changes, we will update this Policy and, where required, obtain consent first.

Client payment-card details are collected and stored only by Stripe on your connected Stripe account when a deposit is placed. We never receive or store your clients' full card numbers.

§P3 How and why we use personal information

• Provide the Service — authenticate you, run the no-show scan, arm the guard, place and refund deposits on your connected Stripe account, send reminders, and (on Pro+) run the auto-rebook waitlist.
• Billing — process your subscription via Stripe.
• Communicate — send you transactional and service messages (receipts, security notices, product notices) via Resend; and send your clients the appointment reminders, deposit-status messages, and waitlist offers that you configure, on your behalf, via Resend.
• Secure and maintain — detect abuse, debug, and protect the Service and its users.
• Comply — meet legal obligations and enforce our Terms.
• Improve — understand feature usage in aggregate. We do not use your booking data or your clients' data to train generalized AI models, and we do not sell it.

§P4 Legal bases (GDPR / UK GDPR)

Where GDPR/UK GDPR applies, for your account and billing data we rely on: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure, maintain, and improve the Service, and for limited service communications), balanced against your rights; consent (where required, e.g., any future non-essential cookies or optional marketing); and legal obligation (e.g., tax/records). For client data we process on your behalf, you are the controller and are responsible for the legal basis and for any consent or disclosure owed to your clients; we process it under your instructions and the mini-DPA.

§P5 Subprocessors and third-party recipients

We use the following subprocessors and service providers for SlotSaver:

We do not use, for SlotSaver, any advertising, analytics, AI/vision, mailbox, accounting, or marketplace subprocessors. We enter data-processing terms with subprocessors where required and require appropriate safeguards. We will update this list and, where required, give notice before adding a subprocessor that materially changes the processing of your data. We do not sell personal information and do not share it for cross-context behavioral advertising.

§P6 Cookies and similar technologies

We use essential cookies only — specifically, the Supabase authentication-session cookie needed to keep you signed in. We do not use analytics, advertising, or tracking cookies or pixels. Because we use only strictly-necessary cookies, we do not show a consent banner for non-essential cookies. If we ever introduce non-essential cookies, we will update this Policy and obtain consent where required.

§P7 Retention

We keep your account and billing data for as long as your Account is active and as needed for legitimate business and legal purposes (e.g., tax records) after closure. Booking, scan, appointment, and deposit records, and client data processed on your behalf, are retained while your Account is active and per your settings, and are deleted or de-identified on your request or on termination, subject to residual backups purged on our ordinary cycle and records we must keep by law. Deposit records may be retained as needed to substantiate the deposit lifecycle and handle any dispute. Deposit charges themselves live on your Stripe account and are governed by Stripe's retention.

§P8 Security

We use reasonable technical and organizational measures appropriate to the risk, including encryption in transit, access controls, least-privilege, encryption of connected-account OAuth tokens at rest, row-level security that makes deposit, appointment, and reminder records read-only to users (only our service role and signed webhooks write them), and reliance on reputable infrastructure providers (Vercel, Supabase, Stripe). No system is perfectly secure; we cannot guarantee absolute security. We will notify affected users and regulators of a personal-data breach where required by law.

§P9 Your privacy rights

§P9.1 GDPR / UK GDPR (EEA/UK residents). Subject to conditions, you may request access, rectification, erasure, restriction, portability, and objection, and may withdraw consent where processing is based on consent. You may lodge a complaint with your supervisory authority. Where we act as processor (client data), we will route your request to the relevant controller — for SlotSaver, that is typically the provider (our customer) — or assist them.

§P9.2 CCPA / CPRA (California residents). You have rights to know/access, delete, correct, and to opt out of "sale" or "sharing." We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes that would trigger a right-to-limit. We will not discriminate against you for exercising rights. Authorized agents may submit requests with proof of authorization.

§P9.3 Client data / processor role. SlotSaver processes personal data about your clients on your behalf. Where one of your clients wishes to exercise privacy rights over their data, that request is typically directed to you as the controller; we assist you as your processor. If a client contacts us directly, we will direct them to you.

§P9.4 How to exercise rights. Email admin@the-atlas-project.net (or admin@the-atlas-project.net) from your Account address, describing your request. We will verify your identity and respond within the time required by law.

§P10 International data transfers

We are based in the United States, and our subprocessors may process data in the US and elsewhere. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK Addendum, or another lawful mechanism. By using the Service, you understand your information may be processed in the US.

§P11 Children

The Service is not directed to individuals under 18, and we do not knowingly collect their personal information (see Terms §16).

§P12 Changes to this Policy

We may update this Policy. We will post the new version with a revised effective date and, for material changes, provide additional notice (email or in-product). Continued use after the effective date constitutes acceptance where permitted by law.

§P13 Contact

Questions or requests: admin@the-atlas-project.net (privacy) or admin@the-atlas-project.net. Postal address: The Atlas Project, [MAILING_ADDRESS — to be added once the entity is formed].

§P13-DPA — Mini-Data Processing Addendum (client data)

This addendum applies to the personal data SlotSaver processes on your behalf about your clients ("Customer Personal Data" — e.g., client names, email addresses, appointment times, and deposit records). It forms part of these Terms.

1. Roles. For Customer Personal Data, you are the controller and we are the processor (or, where you are yourself a processor, we are your sub-processor).

2. Instructions. We process Customer Personal Data only (a) to provide and secure the Service, (b) per your documented instructions (including your configuration, your connected booking tool and Stripe scopes, and your reminder/deposit/waitlist settings), and (c) as required by law (we will tell you unless legally barred).

3. Purpose limitation. We will not sell Customer Personal Data, use it for advertising, or use it to train generalized AI models. SlotSaver uses no AI/vision subprocessor.

4. Confidentiality. Personnel with access are bound by confidentiality. Human access to Customer Personal Data occurs only as needed for security or support.

5. Sub-processors. You authorize the subprocessors listed in §P5 (Vercel, Supabase, Stripe, Resend, Calendly). We remain responsible for their performance and will give notice of material changes with a chance to object.

6. Security. We maintain the measures in §P8 appropriate to the risk.

7. Assistance. Taking into account the nature of processing, we will reasonably assist you with data-subject requests, security, breach notification, and DPIAs. We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.

8. Deletion/return. On termination or your request, we will delete or return Customer Personal Data, subject to residual backups purged on our ordinary cycle and legal-retention requirements. Deposit charges held on your own Stripe account are governed by your Stripe account, not by us.

9. International transfers. Where applicable, the SCCs/UK Addendum referenced in §P10 apply to Customer Personal Data.

10. Audit. We will make available information reasonably necessary to demonstrate compliance and allow for reasonable, confidential audits on notice, subject to appropriate limits.

Effective date: July 18, 2026 · The Atlas Project · admin@the-atlas-project.net · admin@the-atlas-project.net

This document was prepared with automated assistance and has not been reviewed by an attorney. It is not legal advice.