Privacy policy

GrabYourSlot is an online booking service for clinics, sports venues and other businesses in India. It is run by [Legal name of the business], [Registered address, city, state, PIN] (“we”, “us”). This policy explains what personal data we handle, why, and the choices you have.

Who is responsible for your data

• If you book with a clinic or venue, that business decides why your data is collected and is responsible for it (the “Data Fiduciary” under the DPDP Act). We process it on the business’s behalf to run its booking page and calendar.
• If you run a business on GrabYourSlot, or contact us, we are responsible for your account data.

What we collect

• When you book: your name and mobile number, optionally your email, the time and service you picked, and any questions the business asks (for example age or the reason for the visit). Please share only what the business needs.
• Business accounts: the owner’s and staff members’ names, emails and passwords (stored only as a secure hash), the business’s name, address, phone, prices and timings.
• Automatically: your IP address and basic request details, kept briefly to protect the service from misuse (for example limiting repeated sign-in attempts).
• Phone app (business staff only): if a staff member turns on booking alerts, a notification address for that phone or browser, which alerts they chose, and the app’s language. The camera is used only to read the QR code on a booking pass; no photo or video is saved or sent to us.

Why we use it

• To make, show, change and cancel bookings, and to let the business check you in.
• To let the business contact you about your booking (reminders, delays, follow-ups). Businesses send these messages themselves, for example on WhatsApp.
• To keep the service secure and working, and to meet legal obligations.

We do not sell personal data, show advertising, or use your data to train AI models.

Who we share it with

• The business you booked with.
• Service providers that run the platform for us: hosting (Vercel) and database (Supabase, hosted in Mumbai). They may only use the data to provide their service to us.
• OpenAI, only to translate text that businesses write about themselves (service names, descriptions). Customer details are never sent for translation.
• Google (Firebase Cloud Messaging) and the push services of web browsers, only to deliver booking alerts to staff phones that turned them on. An alert contains the customer's name, the service and the time.
• Authorities, if the law requires it.

Some providers may process data outside India, as permitted by the DPDP Act.

Cookies

We use only two essential cookies: one keeps business staff signed in, and one remembers the language you picked. No tracking or advertising cookies.

How long we keep it

Booking data is kept while the business uses GrabYourSlot. When a business owner closes the account (Setup → Close business account), the business and all its data are deleted at once; see how to delete an account. We may keep data longer only if a law requires it. Security records (such as sign-in attempts) are kept for a few hours. Backups are kept for up to 30 days.

Children

Parents or guardians may book on behalf of a child (for example at a child specialist). By doing so they confirm they are allowed to share the child’s details for that booking. We do not knowingly let children create accounts.

Your rights

Under the DPDP Act you can ask to:

• get a summary of the personal data we or the business hold about you,
• correct or complete it,
• delete it (unless a law requires it to be kept),
• withdraw consent, and nominate someone to act for you,
• raise a grievance with us, and then with the Data Protection Board of India.

You can also ask the business you booked with directly. Use the form below, or write to our Grievance Officer. We reply within 30 days.

Security

Data is sent over encrypted connections (HTTPS), passwords are stored as hashes, and each business can see only its own data. If a breach affects you, we will tell you and the Data Protection Board as the law requires.

Grievance Officer

[Name of Grievance Officer]
[Legal name of the business], [Registered address, city, state, PIN]
Email: [privacy@your-domain] · Phone: [Contact phone]

Changes

If we change this policy, we will update the date above, and tell business owners about important changes.