Privacy policy
Last updated: October 23, 2026
What data ZeroSlot processes, why, with whom, for how long, and how to exercise your rights.
Who we are
ZeroSlot is an online booking service for independent professionals and small teams (hair salons, barbers, tattoo artists, pet groomers, coaches…). It is published by NetDamIX, company number (BCE) 1037.856.943, VAT BE1037856943, Impasse Verheggen 9, B-6182 Courcelles, Belgium. Publisher: Damien Martinquet. Hosting: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus; data hosted in Vilnius, Lithuania (EU).
Questions about your data: privacy@zeroslot.app. Help with the service: support@zeroslot.app.
Two different roles
- Professional accounts (the owner and their team): NetDamIX is the controller.
- Clients of professionals (people who book an appointment): each professional is the controller of their clients' data. NetDamIX acts as a processor under Article 28 GDPR: we process this data only to provide the service to the professional, on their instructions, and never for our own purposes.
Booked with a professional? Contact that professional first. You can also write to privacy@zeroslot.app: we will forward your request and help them answer it.
Data we process
| Whose | Data |
|---|---|
| Professional account | Name, email, password (stored only as a bcrypt hash, never in clear), business name, address and phone, opening hours, services and prices, team members (first name, last name, email), settings. |
| Subscription | Plan and subscription status. Payment is handled by Stripe: ZeroSlot never sees the card number. |
| Professional's clients | First name, last name, phone, email, notes written by the professional, appointments (date, service, status), contact verification, deposit if any (amount and status, never card data). |
| Messages sent to clients | Date, type (code, confirmation, reminder), status and the last two digits of the number. The text of text messages is not kept. |
| Support | Your message, a screenshot if you attach one, and technical details (page, browser, time, recent errors). Client contact details are removed from reports automatically. |
| Technical data | IP address, browser, security logs (sign-ins, sensitive actions) and error reports. |
| Connected calendar (if enabled) | Encrypted access to Google Calendar, Outlook or iCloud, and only busy times (start, end, identifier). Never the title, description, attendees or location of personal events. |
| Facebook and Instagram (if enabled) | See "Facebook and Instagram" below. |
ZeroSlot is not designed for health data: healthcare businesses are not accepted, and professionals agree not to record any in their notes.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage the account, provide the service (calendar, booking page, confirmations, reminders) | Performance of a contract (Art. 6(1)(b)) |
| Process clients' data on behalf of the professional | The professional's instructions (Art. 28); the legal basis is the professional's, usually performing the appointment requested |
| Bill the subscription, keep accounts | Legal obligation (Art. 6(1)(c)) and contract |
| Security, abuse prevention (sending limits, verification codes), backups | Legitimate interest (Art. 6(1)(f)): protecting the service and the data |
| Detect and fix errors, answer support requests | Legitimate interest (Art. 6(1)(f)) |
| Publish freed slots on Facebook and Instagram (Slot Flash) | Contract: at the request of the professional who turns the option on |
No sale of data, no targeted advertising, no automated decision with legal effects. Messages sent to clients are neutral: they give the business, the day and the time, never the service booked.
Service providers and transfers
| Provider | Role | Data location |
|---|---|---|
| Hostinger International Ltd. (Cyprus) | Server and database hosting | Vilnius, Lithuania (EU) |
| Backblaze, Inc. (B2) | Backup storage, encrypted on our server before upload (restic) | EU or United States; unreadable without our key |
| Functional Software, Inc. (Sentry) | Technical error reports, without client contact details | European Union (Germany) |
| Slack Technologies | Internal alerts for the ZeroSlot team, without client data | United States |
| Sweego (France) | Sending emails and text messages (codes, confirmations, reminders, support) | France (EU) |
| Mollie B.V. | Deposits paid by clients, straight to the professional's Mollie account; ZeroSlot only receives the payment status | Netherlands (EU) |
| Stripe Payments Europe, Ltd. | ZeroSlot subscription payments | Ireland (EU), possible transfers to the United States |
| Google, Microsoft, Apple | Calendar sync, only if a team member connects it | Depends on the provider |
| Meta Platforms Ireland Ltd. | Publishing freed slots, only if the professional connects their Page | Ireland (EU), possible transfers to the United States |
Transfers outside the European Union rely on the European Commission's standard contractual clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework.
Retention
| Data | How long |
|---|---|
| Professional account | While the account is active, then deleted within 30 days of a closure request |
| Professional's clients | As long as the professional keeps them. When they delete a client, the contact details are erased and the appointments anonymised. Everything is deleted within 30 days of the professional's account closure |
| Verification codes | Stored as a hash, unusable after 10 minutes |
| Text message log (without text), support tickets | While the account exists |
| Invoices and accounting records | As long as Belgian accounting law requires |
| Error reports (Sentry) | 90 days at most |
| Facebook, Instagram and calendar access | Until disconnected, then deleted |
| Backups | Automatic rotation: one backup per month is kept for at most 12 months. Deleted data leaves the backups as they rotate |
Security
- Encrypted connections (HTTPS) throughout.
- Clients' phone, email and notes encrypted field by field (AES-256-GCM), with keys kept outside the database; search uses keyed hashes (HMAC).
- Passwords stored as bcrypt hashes; calendar and social media access encrypted.
- Backups encrypted on our server before they are sent to Backblaze.
- Error reports and internal alerts filtered so they contain no client contact details.
- Server access limited to the technical team.
If a data breach creates a risk, we notify the Data Protection Authority within 72 hours and the professionals concerned without delay.
Facebook and Instagram (Slot Flash)
Slot Flash is optional: when an appointment is cancelled shortly before its time, ZeroSlot publishes the freed slot on the business's Facebook Page and Instagram professional account, then removes the post as soon as the slot is booked again. Nothing happens until the professional connects their Page.
- What ZeroSlot reads: the Facebook Page ID and name, the ID of the linked Instagram professional account, and the access you grant.
- What ZeroSlot publishes: a post about the freed slot (business name, service, day, time, booking link) and an image in the business's colours. Never any client data: no name, phone or email.
- What ZeroSlot does not do: read your messages, followers, comments or your visitors' data; publish anything other than freed slots.
- Storage: access tokens are encrypted; post IDs are kept so the posts can be removed. Everything is deleted on disconnection.
- Revoking access: at any time, from ZeroSlot (Settings > Slot Flash) or from your Facebook settings. See Data deletion.
Your rights
You may request access to your data, its correction or erasure, restriction of processing, portability (a copy in a common format), and object to processing based on legitimate interest.
Write to privacy@zeroslot.app, preferably from the address linked to the account. We reply within one month (extendable by two months for complex requests, in which case we tell you). We may ask for proof of identity.
Complaints
If you believe your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, dataprotectionauthority.be.
Changes
This policy may change with the service. The date of the last update is shown at the top of the page; professionals are told by email of any significant change.