Privacy policy

Last updated: 7 August 2026

This policy explains what personal data openslot collects, why, how we protect it, and the rights you have. openslot is a booking platform: business owners create bookable resources and share a link; their customers book time slots.

1. Who we are (data controller)

The controller of your personal data is [punkQ legal entity name], [business ID / Y-tunnus], [registered address], operating the openslot service. You can reach us at support@punkq.com for any privacy question or to exercise your rights.

2. What data we collect

Account holders (owners)

• Email address and display name
• Password, stored only as a salted hash (argon2) — we never store it in plain text
• Account type (private or business) and, for business accounts, a VAT number
• Optional branding and a public contact email you choose to display
• Subscription status and identifiers for paid resources (see Payments below)

People who book (guests)

• The name and email address supplied when booking
• Booking details: the resource, date and time, and answers to any questions the owner added to their booking form

Content

• Photos and descriptions owners upload for their resources

Payments

Paid subscriptions are handled by Lemon Squeezy, which acts as our Merchant of Record. They process your payment, card details and tax/VAT, and issue invoices. openslot never sees or stores your card details — we only store your subscription status and the identifiers Lemon Squeezy returns.

Technical

• Limited security data such as rate-limiting counters to protect the service from abuse

3. How and why we use your data

4. Who we share it with (processors)

We do not sell your data. We share it only with service providers that help us run openslot:

• Microsoft Azure — hosting, database, file storage, and transactional email (Azure Communication Services).
• Lemon Squeezy — payment processing and invoicing as Merchant of Record.

5. Where your data is stored

Data is hosted in [Azure region — e.g. EU / West Europe]. Where a provider processes data outside the EU/EEA, it is covered by appropriate safeguards (such as Standard Contractual Clauses).

6. How long we keep it

We keep account and booking data for as long as your account is active. When you delete your account, we erase your personal data from our systems (see “Your rights” below). Invoices and tax records required by law are retained by Lemon Squeezy as Merchant of Record for the period the law requires.

7. Your rights

Under the GDPR you have the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent. To exercise any of these, use the controls in your account or contact support@punkq.com.

Deleting your account

You can permanently delete your account and personal data at any time from your account settings [self-service deletion — coming soon], or by emailing us. Deletion removes your account, your resources, uploaded photos, and your bookings and answers from our systems. Because email addresses are unique, deleting your account frees your email so you can register again later if you wish.

You also have the right to lodge a complaint with your supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

8. Cookies and local storage

openslot does not use advertising or third-party tracking cookies. We use your browser's local storage only for essential functions: keeping you signed in and remembering your light/dark theme preference.

9. Children

openslot is intended for businesses and is not directed at children.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects the latest version, and material changes will be communicated where appropriate.

11. Contact

Questions about this policy or your data: support@punkq.com.