Privacy Policy

1. Who we are

SlotRevive is a scheduling-rescue service for solo service professionals, operated by Noorilmz (contact: noorilmztech@gmail.com). This policy explains what personal data SlotRevive processes and why.

2. Information we process

• Account information — business owners create an account with an email address and password (handled by our authentication provider, Supabase Auth) and a business name. Email confirmation may be required depending on the project configuration. Your sign-in session persists locally in your browser (Supabase Auth local storage) so you stay signed in; signing out clears it.
• Business configuration — business name, discount settings (0–50%), auto-select preference, scheduling-tool webhook URL, and webhook signing secret.
• Waitlist / customer information — names, mobile phone numbers (stored in E.164 format), priority rank, service preferences, and SMS-consent status of end customers whose business owner added them to a waitlist. When a business imports or updates a customer, the business attests that the customer agreed to receive rescue notifications.
• Rescue and claim data — cancelled-slot details (slot time, slot value, discounted value), claim-link tokens (single-use and time-limited), claim and confirmation status, and rescue history.
• SMS delivery data — claim-link and confirmation messages are sent through Twilio to those waitlist numbers. Twilio processes delivery status data for our account. Customers can opt out at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT, and can opt back in by replying START, UNSTOP, or YES.
• Billing data — subscription status, trial usage (successful-rescue count and trial start date), and messaging-wallet ledger entries. Subscription payments are processed by Dodo Payments; the wallet top-up is identified by the purchased product, not by payment amount. Card details never touch SlotRevive servers; we store only payment-provider identifiers.
• Webhook data — when a scheduling tool sends a cancellation event, we process the slot time, service identifier, and slot value contained in that event.
• Session data — sign-in sessions are stored locally in your browser by our authentication provider so you stay signed in. We do not use analytics cookies, advertising cookies, or tracking pixels.

3. Why we process it

To provide the service: detect cancellations, notify waitlist members by SMS, let them claim the slot, and let the business owner confirm. End customers claim free of charge — claiming never requires a payment, and appointment confirmation is never conditioned on an end-customer payment. Legal bases: performance of a contract (service delivery) and legitimate interest (service security, abuse prevention).

4. Service providers

• Supabase — database, authentication, and scheduled jobs.
• Vercel — application hosting.
• Twilio — SMS delivery.
• Dodo Payments — subscription and messaging-wallet payment processing.

5. Security

Row-level security restricts each business to its own data. Authenticated endpoints derive your identity server-side from your sign-in token, and every waitlist, rescue, and wallet query is scoped to your account. Cancellation webhooks require per-business HMAC-SHA256 signatures, and inbound SMS webhooks (opt-out and delivery status) are verified against the provider signature. Claim links use single-use, time-limited tokens. Your sign-in session is stored locally in your browser (required for staying signed in); we set no analytics or advertising cookies. Secrets are stored server-side (database / environment configuration) and are never exposed in client-side code beyond the owner's own authenticated dashboard.

6. Retention

Account, configuration, and rescue-history data are retained while an account is active. Claim tokens expire automatically when their batch window closes. Deactivating a waitlist customer keeps their historical records but stops future messages; there is currently no self-service account-deletion button — deletion requests are handled via the contact channel below.

7. Your rights & contact

To access, correct, or delete your data, contact noorilmztech@gmail.com or use the contact page. We aim to respond within 1 business week. End customers who received an SMS from a SlotRevive business should contact that business directly; we assist them through the business account holder.

Last updated: September 30, 2026. This page describes the service as implemented; it is not legal advice. Have it reviewed for your jurisdiction before launch.