Versija 2026-10 · EN

DRAFT — pending legal review. This document has not yet been reviewed by a qualified EU/GDPR lawyer and may change.

Privacy Policy

Version 2026-10

This policy explains how Label Stock SIA ("we") processes personal data as a controller. Where we process personal data about your clients and staff on your behalf, we act as a processor and the Data Processing Agreement applies instead.

1. Who we are

Controller: Label Stock SIA (registration number 40103977888), Kauņas iela 6, Jūrmala, LV-2011, Latvia. Contact / data-protection queries: slotstock.business@gmail.com

We have not appointed a Data Protection Officer, as we are not required to. We are established in the EU, so no representative under Article 27 GDPR is needed.

2. Data we process as controller

We do not use analytics, advertising, profiling or tracking technologies.

Google sign-in

If you choose "Continue with Google", we receive from Google only your Google account identifier, email address and name, and use them solely to create or sign you in to your SlotStock account. We do not request access to any other Google data or services (such as contacts, calendar or Drive) and we do not share this information with third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3. Client & staff data (we are processor, not controller)

Booking data your clients submit (name, phone, email, party size, free-text notes) and staff records you create are processed by us only on your instructions to run the Service. You are the controller. See the DPA.

4. Sharing & sub-processors

We use the following service providers to run the Service:

• Railway — hosting of the application, database and job queue (region: EU West);
• Resend — delivery of transactional emails (for example password resets and booking confirmations);
• Cloudflare — DNS for our domain (DNS only; it does not receive your account or booking data);
• Google — only if you choose to sign in with Google.

We do not currently use payment processors or AI services; if we introduce one, we will update this policy first. We do not sell personal data.

5. International transfers

The application and database are hosted in the EU (Railway, EU West). Some of our providers (Railway, Resend, Cloudflare and Google) are headquartered in the United States, and personal data may be accessed from or processed in the United States in connection with their services. Such transfers rely on the European Commission's Standard Contractual Clauses incorporated in the providers' data processing terms or, where the provider is certified, the EU–U.S. Data Privacy Framework.

6. Retention

• Owner accounts: kept while the account is active. If an account has had no sign-in for 24 months, we may delete it after notifying you by email.
• Security and server logs: kept for up to 90 days.
• Database backups, where enabled with our hosting provider: kept for up to 35 days and then overwritten, so deleted data can persist in backups until they rotate out.
• Account deletion: deleting your account starts a 30-day grace period, after which your data is permanently erased.
• Records of the legal documents you accepted and of your consents are kept while your account exists and are erased with it.

7. Your rights

Access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time. Use Settings → Privacy & data in the dashboard or contact us. You may also complain to your supervisory authority; in Latvia this is the Data State Inspectorate (Datu valsts inspekcija), https://www.dvi.gov.lv

8. Changes

We may update this policy; material changes are notified in the dashboard.