Slot Flow

Data processing terms

DRAFT; needs Tas's legal review. This is not final legal wording. Text marked "Decision needed" is awaiting a decision.

Slot Flow Ltd ยท business-only service for adults aged 18 or over.

Who we are and who the service is for

  • Slot Flow Ltd ("Slot Flow", "we") provides the Slot Flow reputation management platform.
  • Slot Flow Ltd is incorporated in England and Wales (company number 17558498). Registered address: Unit A1243, Siu Office, 4-6 Greatorex Street, London, United Kingdom, E1 5NF.
  • ICO registration number: [to be confirmed].Decision needed
  • Slot Flow is a business-only service. You must be 18 or older and acting on behalf of a business to create an account.
  • Slot Flow is not designed for, marketed to or intended for use by children.

Roles

  • For customer feedback, the agency (or its business customer) is the controller and Slot Flow Ltd is the processor.
  • We process feedback only on documented instructions, for the purpose of running the service.

Security and sub-processors

  • Controls include mandatory two-step verification for agency staff, per-agency isolation in the database, encrypted payment keys, short-lived file links and an append-only audit log.
  • Sub-processors: Supabase (database and sign-in), Cloudflare (hosting, files, email), Amazon Web Services SES (email), OpenRouter (AI summaries without names or contact details), Stripe (payments), Google (reviews).
  • We will give 30 days' notice of a new sub-processor.Decision needed
  • We will notify the agency of a personal data breach without undue delay and within 48 hours of becoming aware.Decision needed

International transfers and deletion

  • Where data leaves the UK, we rely on the UK International Data Transfer Addendum or an adequacy decision.Decision needed
  • Working draft, pending Tas: at the end of the contract we delete customer feedback within 90 days, unless law requires us to keep it.Decision needed