This Privacy Policy explains how SlotKaro Technologies Private Limited ("SlotKaro", "we", "us" or "our") handles personal data when customers, business partners, staff members and website visitors use our platform. It should be read with the applicable customer terms or partner terms. We process personal data under applicable Indian law, including the Information Technology Act, 2000 and applicable data-protection requirements.
| Category | Examples and purpose |
|---|---|
| Account and authentication | Name, mobile number, optional customer or partner contact email, optional customer gender, account role, mobile/email OTP issue and verification status, login/session records and security-attempt information used to create, verify and protect accounts. Partner email is optional during registration and can be verified or updated separately; email verification is not a condition for registering an outlet. |
| Optional website profile details | The customer website profile also lets a customer provide a date of birth, anniversary, locality and selected map coordinates. These are website profile fields, not required fields in the current customer app. |
| Customer bookings | Selected business, services, staff member, date and time, dining party size where applicable, coupon, selected outlet-offer terms and discount, selected payment mode, booking and payment status, start OTP, cancellations, no-show status, ratings, reviews and support messages. Website booking notes may also be stored when a customer chooses to provide them. |
| Saved places | The businesses a signed-in customer saves, their business identifiers and the time saved are associated with that customer account. This private list is not a booking, is not shown to the saved business, and can be changed by removing a saved place. |
| Booking chat and safety reports | Booking-scoped text messages, sender/account identifiers, message and read-state timestamps, and chat block preferences. If a message is reported, we retain the reported message snapshot, report category, optional explanation and review records for authorised administrator moderation and safety support. |
| Partner and business profile | Owner/contact details, business name, category, business entity, applicable CIN/LLPIN and director details, address, area, map location, opening hours, weekly-off and slot settings, descriptions, services, prices, staff names/specialities, availability, GST Yes/No and GSTIN where supplied, applicable alcohol-service and AERB declarations, payment mode, booking-ring preference, registration drafts and progress, and approval/subscription status. |
| Partner licences and certificates | Business registration, shop or trade licence, medical registration, Diagnostic Centre Licence, AERB Licence, FSSAI Licence, Bar Licence and other category-specific supporting image or PDF files that a partner deliberately selects for upload. SlotKaro uses these files for restricted administrator review, approval, compliance, fraud prevention and support; they are not displayed publicly. |
| Photos and other content | Business, gallery and menu images that a partner deliberately selects or uploads; an optional customer profile photo; plus reviews, messages and other content submitted to the Platform. |
| Location | When permission is granted, the customer app may use the customer's current foreground location to show a current location or relevant nearby businesses. Partner coordinates are used when a partner places a business on the map. Background customer movement tracking and automatic location-based arrival confirmation are not part of the current app flow. Search text and coordinates may be sent to our API or a mapping/geocoding service to return relevant results. |
| Technical and security data | IP address, request date/time, browser or app information, requested pages/API routes, security events, error information and similar server-log data used to operate, troubleshoot and protect the Platform. |
| Push-notification and installation identifiers | When the SlotKaro customer app or SlotKaro Partner uses Firebase Cloud Messaging for transactional booking and service alerts, Firebase generates a per-installation Firebase Installation ID and an FCM token. SlotKaro associates the encrypted token with the signed-in customer or partner account only to address service notifications to that app installation. Firebase may also process app version and limited device/app metadata needed to provide and maintain the messaging service. |
| Payment and transaction records | For an online customer booking or partner subscription, order identifier, amount, currency, payment status/reference, and relevant booking or subscription/accounting records. Payment-instrument details entered on a payment provider's page are handled by that provider and are not intentionally stored by SlotKaro. |
| Partner wallet and earnings ledger | Read-only records of completed-booking amounts, eligible paid online-payment credits, consumed SlotKaro coupon or offer credits and cash-at-venue entries used for Partner reporting and reconciliation. The current ledger is not a stored-value wallet, cashout, payout, bank-transfer or withdrawal facility. |
For a clinic booking, the selected service or a note supplied through the website could reveal or imply health-related information. SlotKaro does not ask customers to upload medical records through the current apps; please do not include unnecessary medical or identity information in free-text fields.
We do not sell personal data. We will seek any consent required by law before using contact details for promotional marketing, and marketing consent can be withdrawn.
We use SMS one-time passwords to verify mobile numbers and email OTPs for the separate email-verification or verified-email-change flow. A separate short booking-start OTP may be generated so a customer can confirm arrival with the selected business. OTPs must not be shared except for their intended booking or account-verification purpose. Authentication tokens and limited account cache may be stored on the device so the apps can keep a user signed in.
Transactional messages and alerts may be delayed or fail because delivery depends on networks, device settings and service providers. Private customer details are not intended to appear in public-facing notification text.
Current booking chat is text-only and is available only for eligible bookings. New messages require an active booking, and an online payment must not be pending. Completed-booking chat is read-only. Messages are retrieved inside the apps; the current chat service does not send message contents or chat alerts through Firebase Cloud Messaging. Blocking stops chat messages between the participants; it does not cancel their bookings or payments.
Third-party services process data under their own terms and privacy notices as well as any arrangements applicable to our use of their services. Their systems may operate in locations outside your state or country, subject to applicable law.
The selected business entity determines the applicable CaseDocker verification profile: Individual / Proprietor, Firm (Company / LLP) or Udyam. This is separate from the outlet's service category, such as Dining or Diagnostic Centre. To create the hosted workflow, SlotKaro sends the owner's mobile number, the applicable person or business name and the selected verification profile/check requirements. CaseDocker then shows the checks, documents and fields applicable to that profile and the provider's available service. The hosted flow may ask for PAN, Aadhaar, bank-verification or other applicable business-verification information. That information is entered on and processed through CaseDocker's service. SlotKaro's integration records workflow identifiers, the hosted resume link, environment/mode, verification status, and minimal check-type and status information needed to display and administer progress. We do not expose provider credentials to either app.
SlotKaro collects business documents separately for manual review. During registration, a Diagnostic Centre must upload its Diagnostic Centre Licence and answer “Do you have AERB licence?” with Yes or No. A separate AERB Licence upload is required only when Yes is selected; it cannot replace the Diagnostic Centre Licence. A Dining outlet must upload its FSSAI Licence regardless of its answer to the alcohol-service question. Selecting Yes to serving alcohol shows a separate, optional Bar Licence upload; selecting No hides that upload. Dining does not use a general Shop & Establishment or Trade licence upload. Other business-licence uploads remain optional for the other categories, including applicable Shop & Establishment / Trade licences and Clinic documents. These files, any document numbers, review status and rejection reasons are handled separately from CaseDocker identity verification. Changing an alcohol or AERB declaration does not by itself delete previously stored licence evidence.
Business Details holds registration, GST and licence information separately from basic Profile details. Partners answer “Do you have GST?” with Yes or No for either payment mode. Yes requires a valid GSTIN in the Platform form; No does not request a GSTIN and displays an undertaking to keep GST information updated without a separate undertaking checkbox. A No declaration is not a tax exemption or government verification. Pay Online does not by itself make GSTIN mandatory in this form. Approved registration and document information may be read-only to the partner, with corrections handled through authorised SlotKaro review.
CaseDocker may retain information under its own policy and legal obligations. A partner should review the provider notice shown in the hosted flow before submitting identity or financial information. Provider verification does not, by itself, guarantee business approval on SlotKaro.
Each outlet uses one payment mode selected during registration and locked against ordinary partner changes: Cash at Venue or Pay Online to SlotKaro. When an outlet uses Pay Online, SlotKaro uses Cashfree to create and complete the payment. To create and verify the order, we send Cashfree the minimum details needed for that transaction: an internal customer/order reference, booking amount and currency, customer name, mobile number, email if supplied, and a return URL. Cashfree handles payment-instrument entry. SlotKaro does not intentionally store full card, bank-account, or UPI authentication credentials entered on Cashfree's page.
SlotKaro retains the order identifier, amount, provider reference/status and the related booking record. Before marking a booking as paid, our server checks the payment status with Cashfree. Cash at Venue is settled directly at the business; SlotKaro does not process that cash payment.
If paid Partner subscriptions are enabled for a business category and the payment gateway is configured, a partner can choose an available prepaid plan through the website's Cashfree checkout. The current Partner app does not offer subscription checkout. The same principles apply: Cashfree handles payment-instrument entry, while SlotKaro retains only the order, provider reference/status and the resulting subscription/accounting record.
Depending on the data and applicable law, we process personal data with consent, to provide a feature or service the user requested, to perform our agreements, to meet legal obligations, and for permitted security, fraud prevention, support and business-operation purposes. A user can withdraw consent where applicable, but some features may then stop working. Withdrawal does not invalidate processing already carried out lawfully.
For optional outlet-funded offers, we record the proposing and accepting accounts, acceptance time, offer conditions, change requests and Admin actions. Bookings retain their selected terms and calculated discounts for billing, reconciliation and dispute handling. Customers see applicable offer conditions, not the partner's private change-request notes or internal actor IDs.
We retain account and operational data while an account is active and for as long as reasonably needed for the purposes described above. Retention varies by category; we do not use one fixed period for every record.
In the iPhone SlotKaro Partner app with in-app deletion support, open Account > Settings > Request account deletion. Read the scope, confirm your request and keep the reference and completion deadline shown in the app. You can refresh the request status there without calling or emailing support. The request covers the Partner account; a separate Customer account is not included. We process these requests manually within 30 days and send completion confirmation through the registered contact details.
For Customer accounts, Android apps, older Partner app versions or requests made without the app, follow the instructions at slotkaro.com/delete-account.html. Customers can contact support@slotkaro.com and partners can contact partner@slotkaro.com. Identify the registered mobile number and whether the request covers the Customer account, Partner account or both; partners should also identify the business. These support requests are verified through a registered contact channel. You do not need to send another email for an in-app request that already has a receipt.
Submitting a request does not instantly erase the account. After verification, we delete or de-identify the active account and associated data that is no longer required. Data we must retain is restricted to the applicable legal, security, accounting or dispute purpose and is not used to keep the deleted account active.
We use reasonable technical and organizational measures appropriate to the service, including HTTPS in transit, access controls, role-based API checks, protected authentication-token storage in the apps, and security logging. No internet service or storage system can be guaranteed completely secure. Users must protect their devices and never share account OTPs, passwords, payment credentials or verification documents with anyone who contacts them unexpectedly.
Subject to applicable law, a user may ask for access to a summary of personal data, correction or updating, erasure, withdrawal of consent, and grievance redressal. We may verify identity through a registered contact channel before fulfilling a request. Use the account-deletion page above or contact the support address listed in Section 16. If a request cannot be completed in full because a record must be retained, we will explain the applicable reason where required.
Partner accounts are intended for adults authorized to operate the relevant business. Customer accounts are intended for persons legally able to use the service; a person under 18 should use the Platform only with the involvement and valid consent of a parent or legal guardian where required. Contact us if you believe a child's personal data was submitted without appropriate consent.
For optional outlet offers, we record the selected weekday/time rates, separate partner and SlotKaro funding shares, partner acceptance, Super Admin approval, and booking-linked calculations. These records support consent history, discount disputes and completed-booking wallet accounting. Changing a current offer does not erase prior booking records.
The website uses necessary session/security cookies and local storage for login, security and user preferences. The mobile apps store authentication tokens, limited account cache and preferences on the device. Clearing app data, uninstalling an app or deleting browser cookies signs out or removes local copies but does not submit an account-deletion request.
The Platform may open third-party hosted pages, maps, payment or verification services. Their privacy notices apply to information submitted directly to them. Check the destination before entering personal, identity or payment data.
For privacy questions, rights requests or grievances, contact:
We may ask for enough information to locate the account and verify the requester, but we will not ask for an OTP, password, full payment credential, API key or identity-document image in an ordinary email request.
We may update this Policy when products, providers or legal requirements change. The current version will remain posted at this URL with a revised "Last updated" date. Material changes will be communicated where required.