Privacy policy

Who we are

Slotwatch is an independent ticket availability monitoring service operated by [Operator legal name, KvK number and address: fill in before launch]. We are the data controller for the personal data described here. Contact: privacy@slotwatch.example (replace with the production address).

What we collect and why

E-mail address: to send availability alerts, your sign-in link and the payment confirmation. Legal basis: performance of the contract.

Your monitoring request: dates, number of tickets, time preference, language. Legal basis: performance of the contract.

Payment data: handled entirely by Stripe. We store the Stripe identifiers, the amount and the status, never card numbers. Legal basis: contract and legal obligation (bookkeeping).

Consent records: the time you accepted the terms and whether you asked us to start immediately. Legal basis: legal obligation.

Privacy-friendly usage analytics: page views and funnel steps with a daily rotating, salted hash. No IP addresses, no user agents, no cookies, no cross-site tracking. Legal basis: legitimate interest in understanding whether the service works.

Operational logs: technical logs may contain IP addresses for security and abuse prevention for a short period. Legal basis: legitimate interest.

Who receives your data

Stripe (payments), our e-mail delivery provider (transactional e-mail), and our hosting provider in the European Union. Each acts as a processor under a data processing agreement. We never sell personal data and we do not share it with ticket providers; booking happens on their website, under their terms.

How long we keep it

Monitoring requests and alert history: 12 months after expiry, then deleted or anonymised. Availability observations: 90 days (they contain no personal data). Payment records: 7 years in anonymised form, as required by Dutch tax law. Sign-in links: 15 minutes. You can delete your personal data earlier from your dashboard at any time.

Your rights

You can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent. Use the dashboard or e-mail us. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Data is encrypted in transit, access is restricted and logged, sign-in links are single-use and short-lived, and tokens are stored hashed.