Privacy Policy

1. Who We Are

Slotly(“Slotly”, “we”, “our”, or “us”) is a multi-tenant appointment-booking platform operated by E-SEEDS (PVT) LTD, a company registered in Sri Lanka. Slotly is the brand name of our product; it is registered on the Meta platform as the app “eDuty” and is currently served from the domain eduty.lk (and, going forward, also from slotly.lk). References to “Slotly”, “eDuty”, “eduty.lk”, and “slotly.lk” in this policy all refer to the same service operated by E-SEEDS (PVT) LTD.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, our booking website, or our WhatsApp booking assistant. By accessing or using Slotly, you agree to the collection and use of information in accordance with this policy.

2. Our Role — Technology Provider for Businesses

Slotly provides booking and messaging technology to independent businesses such as salons, spas, and clinics (“Client Businesses”). When a Client Business uses Slotly, that business decides what customer data is collected and why — it is the data controllerof its customers' booking information, and Slotly acts as a technology provider and data processor on its behalf, handling that data only to deliver the booking service the business has configured.

For our own platform accounts, marketing site, and the operation of the service, Slotly (E-SEEDS (PVT) LTD) acts as the data controller. Each Client Business's data is stored in its own isolated, encrypted database and is never shared with other Client Businesses.

3. Information We Collect

We collect the following types of information:

• Account information: Name, phone number, and email address provided when you register or log in.
• Booking data: Appointment details, selected services, preferred staff, dates and times, and any notes provided during booking.
• WhatsApp conversation data: When you message a Client Business through our WhatsApp booking assistant, we process your WhatsApp display name, phone number, and the content of the messages you send in order to understand and complete your booking request (see Section 6).
• Business profile data: Information submitted by business owners to configure their storefront (business name, address, contact details, branding).
• Usage data: Pages visited, features used, and interactions within the platform (collected via server logs and analytics).
• Device information: Browser type, operating system, and IP address.

4. How We Use Your Information

We use collected information to:

• Create and manage your account.
• Process and confirm appointments, including via the WhatsApp booking assistant.
• Send booking confirmations, reminders, and related service notifications.
• Allow Client Businesses to manage their appointments and customers.
• Operate, maintain, secure, and improve our platform.
• Respond to support requests and inquiries.
• Comply with legal obligations.

We do not use data obtained through Meta or the WhatsApp Business Platform for advertising or profiling, and we do not sell it (see Section 6).

5. How We Share Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

• With the business you book with: When you make a booking, your name, phone number, and appointment details are shared with the relevant Client Business so it can serve your appointment.
• Service providers / sub-processors: We use the third-party providers listed below to operate the service. They process data only on our behalf, under data processing agreements, and are not permitted to use it for their own purposes.
• Legal requirements: When required by law, court order, or governmental authority.

Service Providers / Sub-processors

We use the following third-party service providers to operate our WhatsApp messaging service. They process data only on our behalf, under data processing agreements, and may have access to data we obtain through the WhatsApp Business Platform (including message content, phone numbers, and contact names):

• Oracle Corporation (Oracle Cloud Infrastructure) — cloud hosting, database, and storage of message and appointment data.
• Google LLC (Gemini API) — processing of message text to understand intent and generate automated replies.
• Cloudinary — image hosting for business storefront and profile media.

These providers are not permitted to use the data for their own purposes. We do not sell Platform Data, and we use it solely to provide appointment booking, rescheduling, reminders, and related notifications on behalf of the businesses that use our service.

Requests from Public Authorities

When we receive a request from a government body, law enforcement, or other public authority for users' personal data, we follow these practices:

• Legality review: We review every such request to confirm it is lawful, valid, and issued under proper legal authority before taking any action.
• Challenging unlawful requests: Where a request appears overbroad, improper, or unlawful, we will challenge, narrow, or refuse it through appropriate legal channels.
• Data minimization: If disclosure is legally required, we disclose only the minimum personal data necessary to comply with the specific request.
• Documentation: We document each request, our response, the legal basis, and the individuals involved in handling it, and retain these records.

We will notify affected users of such requests where permitted by law.

6. Meta Platform & WhatsApp Business Data

Slotly (registered on Meta as eDuty) integrates with Meta products, including Facebook Login and the WhatsApp Business Platform (Cloud API), to let customers book appointments with Client Businesses through chat.

We receive and process WhatsApp messages via the Meta WhatsApp Business Platform to provide appointment booking and notifications. Use of data received from Meta complies with Meta's Platform Terms and Developer Policies.

• What we receive:From WhatsApp, we receive the customer's phone number, WhatsApp display/profile name, and the content of messages exchanged with the Client Business. If you connect via Facebook Login, we receive only the basic profile fields you authorize (such as name and email).
• How we use it: Solely to understand and fulfil booking requests, confirm and remind you about appointments, and provide the service to the Client Business. We request only the minimum permissions necessary.
• What we do not do: We do not sell Platform Data, do not use it for advertising or to build advertising profiles, and do not share it with data brokers or unrelated third parties.
• Compliance: Our use of data obtained from Meta complies with the Meta Platform Terms, the Meta Developer Policies, and the WhatsApp Business Messaging Policy. When these terms require deletion of Platform Data, we delete it accordingly.

When you use these integrations, the relevant Meta product's own privacy policy also applies to data processed by Meta.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Booking records may be retained for up to 3 years for business record-keeping purposes. Data received via Meta or the WhatsApp Business Platform is retained only as long as needed to provide the booking service or as required by the applicable Meta terms. You may request deletion of your data at any time (see Section 9).

8. Data Security

We implement industry-standard security measures including per-business isolated and encrypted databases, encrypted storage of credentials, HTTPS for all data transmission, and access controls to protect your personal information. However, no method of transmission over the internet is 100% secure.

9. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, or to request deletion of data (including data connected via Facebook or WhatsApp), please contact us at support@eduty.lk or see our User Data Deletion page. We will respond within 30 days.

10. Cookies

We use cookies and similar technologies to maintain your session and improve your experience. You can disable cookies in your browser settings, though some features may not function properly as a result.

11. Children's Privacy

Our platform is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the “Last updated” date at the top of this page. Continued use of the platform after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: