Slotted
Log in Polls

Privacy Policy

Last updated 5 October 2026

This Privacy Policy explains how personal data is processed in connection with Slotted (“Slotted”, “the Service”).

Slotted is an independently developed and operated scheduling and availability-polling service.

1. Who is responsible for your data?

Slotted operator / controller

For personal data that Slotted processes for its own purposes, such as account administration, authentication, service security and administration, the data controller is Panagiotis Tatoulis, operating Slotted.

Poll organisers

Depending on the circumstances, the organiser of a poll may be a separate controller for personal data concerning participants that the organiser collects and uses for organising the relevant activity. Where Slotted processes such information solely on behalf of the organiser, Slotted may act as a processor for the organiser.

2. What personal data do we collect?

The information we process depends on how you use Slotted.

2.1 Account information

When you create an account, we may process:

Supabase Auth manages password authentication. We do not store or have access to users' passwords in plaintext.

If you choose to sign in with Google, we receive the Google account information made available through the Google authentication flow, which may include your name, email address and profile picture. We use the information necessary to create and authenticate your Slotted account. We do not request access to your Gmail, Google Drive, contacts or other Google services unless expressly stated.

2.2 Poll information

When you create a poll, we process information necessary to operate it, which may include:

You should not include unnecessary sensitive or confidential information in a poll.

2.3 Response information

When you participate in a poll, we may process:

An Slotted account is not normally required to submit a response.

When you submit a response, and each time you change it, we send a confirmation email to the email address you gave. It includes the link to your response, unless you changed it while logged in. We keep that link with the queued email only until the email is sent, and never for more than 24 hours. We retain a cryptographically protected representation of the link rather than the link itself.

2.4 Bug reports and feedback

When you send a report through the Bugs & Feedback page, we may process:

whether the report concerns a bug, feedback, support request, or a combination; the title and description you provide; your name and email address, where you choose to provide them or where they are associated with your account; a link to your Slotted account, where applicable; files or other information you choose to attach; technical information associated with the report, such as the version of Slotted, the page on which the report was submitted, browser and device information, language and time-zone settings; a reference number and information about when the report was submitted or updated; and information relating to the handling of the report, such as its status, administrative notes and relevant dates.

If you choose to submit a report without identifying yourself, we will not intentionally associate the report with your name or email address. Certain functionality, such as attaching files or receiving a response, may not be available for anonymous reports.

We may retain limited technical or account-related information for a short period where reasonably necessary to prevent abuse, limit repeated submissions or protect the Service. Such information is not retained for longer than reasonably necessary for those purposes.

Bug reports and feedback are accessible only to persons authorised to administer or support Slotted. We use this information to investigate problems, respond to support requests, improve the Service and maintain its security and reliability.

2.5 Information supplied about other people

A poll organiser may provide information about another person, such as a contact name or organisation name.

Where this happens, the organiser is responsible for ensuring that the information is provided to Slotted lawfully and for an appropriate purpose.

3. Technical information

When you use Slotted, technical information may be processed by Slotted and its infrastructure providers.

Depending on the Service configuration, this may include:

Some of this information may be generated or retained automatically by third-party infrastructure providers.

4. Why do we process personal data?

We process personal data to:

We do not sell personal data.

We do not use Slotted data for behavioural advertising.

We do not use personal data collected through Slotted to make decisions based solely on automated processing that produce legal or similarly significant effects.

Where the GDPR applies, processing is based on one or more of the following legal bases.

Performance of a contract - Article 6(1)(b)

Where you create an account, create a poll or otherwise request functionality from Slotted, processing necessary to provide that functionality may be based on the performance of a contract with you or steps taken at your request before entering into a contract.

Legitimate interests - Article 6(1)(f)

We may process information where necessary for legitimate interests such as:

We consider the relevant interests and the rights and freedoms of individuals when relying on this legal basis.

Legal obligations - Article 6(1)(c)

We may process information where necessary to comply with a legal obligation.

Consent - Article 6(1)(a)

Where we specifically request consent and rely on consent as the legal basis, you may withdraw that consent at any time.

Withdrawal does not affect processing carried out lawfully before withdrawal.

6. Poll organisers and participant information

A poll organiser may provide personal information about other people, for example by entering the name or contact details of an expected participant.

Where the organiser determines why participant information is collected and how it is used for the organiser's activity, the organiser may be a separate data controller for that processing. Slotted may process the information on the organiser's behalf in order to provide the Service.

In such circumstances, the organiser is responsible for ensuring that the information is collected and provided to Slotted lawfully and for an appropriate purpose, and for meeting any transparency or other obligations that apply to the organiser.

Slotted may also process information for its own purposes where necessary to operate, secure, maintain and improve the Service. The applicable responsibilities depend on the particular processing activity.

If you provide information about another person, you should provide only information that is reasonably necessary for the relevant activity and should not provide sensitive or confidential information unless doing so is appropriate and lawful.

7. Who can see your information?

Access depends on the type of information and the way a poll is configured.

Poll organiser

The organiser may be able to see participant names, email addresses and availability responses.

Other people accessing a poll

Depending on the organiser's settings, other people with access to the poll may be able to see participant names and availability information.

Participant email addresses are not displayed to other participants unless the Service explicitly provides a feature that does so.

Bug reports and feedback

Bug reports and feedback are read only by Slotted's administrators, on a page available to administrators alone. They see the report, its attachments and technical information, and your name and email address unless you hid them. Other users never see your reports.

Slotted operator

The operator may access information where reasonably necessary to operate, maintain, secure or troubleshoot the Service. Access to personal data is restricted to what is reasonably necessary for these purposes.

Service providers

Slotted may use third-party providers to process information necessary to operate the Service.

8. Service providers

Depending on the deployed configuration, Slotted may use providers including:

Supabase: Database, authentication, file storage (files attached to bug reports and feedback) and related infrastructure.

Cloudflare: Website hosting/delivery and security infrastructure.

Resend: Email delivery: confirmations to respondents, notifications to organisers and administrators, and account emails such as password resets.

GitHub: Software-development infrastructure and, where specifically configured, automated operational processes.

Google: Third-party authentication or other Google services where applicable.

9. International transfers

Slotted is operated from the European Union and the primary Slotted database is currently hosted in Supabase's Central EU (Frankfurt) region. The location of the primary database does not, however, mean that every service provider involved in operating Slotted processes data exclusively within the European Economic Area.

Some of our service providers are global companies and may process or access personal data from countries outside the European Economic Area.

Where the transfer of personal data from the EEA to a country outside the EEA constitutes a restricted transfer under Chapter V of the GDPR, Slotted will rely on a legally recognised transfer mechanism before making or permitting that transfer. Depending on the circumstances, this may include:

Where Standard Contractual Clauses or another appropriate transfer mechanism is used, applicable supplementary safeguards will also be taken into account where required.

Our service providers may have their own Data Processing Agreements, Standard Contractual Clauses, transfer frameworks and other contractual safeguards governing international processing. We rely on those contractual arrangements where applicable to the services we use.

Where a transfer mechanism becomes invalid or unavailable, we will take reasonable steps to replace it, suspend the affected transfer, or otherwise bring the processing into compliance with applicable data-protection law.

Information about the specific transfer mechanism applicable to a particular provider may be requested using the privacy contact address.

10. How long do we keep your data?

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law.

Accounts

Account information is retained while the account remains active and for a limited additional period where necessary for security, legal or operational purposes.

Polls

Poll information and responses are retained while the relevant poll remains available, or stored, unless deleted earlier.

Responses

You may delete your response where the relevant functionality is available. Deleting a poll may delete the responses associated with that poll.

Deleted accounts

Deleting an account may delete polls created by that account and their associated information.

Responses that the account submitted to another person's poll may remain associated with that poll unless separately deleted.

Bug reports and feedback

A report is kept while it is being dealt with and for no longer than 12 months after it is marked resolved. Files attached to a report are deleted when the report is resolved.

If you delete your account, the link to your account and the name and email address stored with your reports are removed; the rest of each report is kept for the period above.

Backups

Deleted information may remain temporarily in backups.

Backups are taken every 24 hours. Backup retention period: 14 days.

After the applicable backup-retention period, the information should be removed from those backups through the normal backup lifecycle.

11. Cookies and browser storage

Slotted does not use advertising cookies or third-party advertising trackers. Where technically necessary, Slotted may use browser storage or similar mechanisms to provide functionality. This may include:

Clearing browser data may remove locally stored information and may prevent you from recovering information that was stored only in your browser.

12. Security

We use reasonable technical and organisational measures intended to protect personal data.

Password security

Slotted uses Supabase Auth to manage password-based authentication. We do not store or have access to users' passwords in plaintext. Supabase Auth stores password credentials as cryptographic bcrypt hashes with randomly generated salts, rather than as plaintext passwords.

Slotted is served over HTTPS, and authentication requests and other communications between your browser and the Service are transmitted using TLS-encrypted connections.

Access controls

Slotted uses authentication and access controls to restrict access to data and functionality according to the user's permissions.

Where applicable, database access is additionally controlled through Supabase's Row Level Security (RLS) policies. Where RLS is enabled, database access is additionally restricted by policies configured for the relevant data.

Other security measures

Our security measures may include:

No online system can be guaranteed to be completely secure.

If you believe that your account or a poll has been compromised, please contact us using the privacy/contact address.

13. Your rights

Where the GDPR applies, you may have the right to:

These rights are subject to the conditions and limitations established by applicable law.

To exercise a right, contact:

[email protected]

We may request information necessary to verify your identity before responding to a request. We will normally respond to a request without undue delay and, in any event, within one month of receiving it. Where permitted by GDPR, this period may be extended by up to two further months depending on the complexity and number of requests.

14. Information concerning people entered by an organiser

Personal information in Slotted may sometimes be provided by someone other than the person the information concerns, such as a poll organiser.

Where another person provides your information, the organisation or person who provided it may be responsible for informing you about the collection and use of your information, depending on their role and the circumstances of the processing.

Where Slotted is responsible for providing information to you under applicable data-protection law, we will provide the information required by law, including information about the purposes of processing, the categories of personal data concerned and, where applicable, the source from which the information was obtained.

If you believe that your personal information has been entered into Slotted without an appropriate basis, or if you wish to exercise your data-protection rights, you may contact us at [email protected]. Where another person or organisation is responsible for the relevant processing, we may also direct you to that person or organisation.

The information requirements that apply when personal data are not obtained directly from the individual are subject to the applicable exceptions and limitations under data-protection law.

15. Supervisory authority

If you are in Greece, you may lodge a complaint with the Hellenic Data Protection Authority (HDPA) where you believe your data protection rights have been violated.

Hellenic Data Protection Authority

Website: https://www.dpa.gr/

You may also have the right to complain to the supervisory authority in another EU/EEA country, depending on your circumstances.

16. Changes to this Privacy Policy

We may update this Privacy Policy when the Service, its infrastructure, data-processing practices or applicable legal requirements change.

The “Last updated” date indicates the current version.

Where required, significant changes will be communicated through the Service or another appropriate method.

17. Contact

For privacy questions, data-subject requests or concerns regarding Slotted:

Contact name: Panagiotis Tatoulis

Email: [email protected]

The legal identity and contact details of the data controller are provided in Section 1.

Related document: Slotted Terms of Service