Privacy Policy

Who is responsible

• For business accounts (owners and team members), PangaSlot decides how the data is used: we are the data controller.
• For customers who book with a business, the business is the data controller. PangaSlot processes that data for the business, to run its bookings. Questions about how a business uses your details should go to that business first; we will help where we can.

What we collect

• Business accounts: name, email, phone number, a password (stored only as a secure hash), your role, and your business profile (name, address, contact details, description, logo and photos).
• Bookings: the customer’s name, phone number and email, the service, provider, date and time, price and status, and any details the booking form asks for.
• Customer accounts, if you create one: name, email, phone number and a hashed password.
• Payments for PangaSlot plans: the amount, the plan, the Mobile Money number used (shown to you masked) and the payment reference. We never see your Mobile Money PIN.
• Google Calendar, only if a business connects it: an access token that lets PangaSlot add, move and remove that business’s booking events.
• Technical data: your IP address, used to limit abuse such as repeated sign-in attempts, and error details in our server logs, used to fix problems.

Why we use it

• To provide the service: show booking pages, take and manage bookings, and send booking confirmations, updates and reminders.
• To run business accounts: sign-in, team access, plans, payments and receipts.
• To keep PangaSlot secure and working: preventing abuse, investigating problems, and keeping records the law requires.
• To contact businesses about their account, their plan and important changes. We do not sell personal data, and we do not use customers’ details to advertise to them.

Who we share it with

Only with service providers who help us run PangaSlot, and only what they need:

• Mailtrap, to deliver emails;
• Paypack, to process Mobile Money payments for PangaSlot plans;
• Google, only for businesses that connect Google Calendar;
• our hosting and file storage providers, who keep the servers, database and images.

The business you book with sees your booking and contact details. We may also share data when the law requires it. Where personal data is stored outside Rwanda, we do so in line with Law No. 058/2021, including any authorisation it requires.

Cookies and storage in your browser

PangaSlot keeps your sign-in session in a cookie and in your browser’s storage, and remembers a few preferences (for example, your progress through business setup). These are needed for the service to work. We do not use advertising or tracking cookies.

If you add a business to your phone, a small offline page and the business’s logo are saved on your device, and your browser remembers if you chose not to add it. We count how often the app is offered, added and opened for each business, as daily totals by type of device. These counts don’t identify you.

How long we keep it

We keep account and booking data while the business uses PangaSlot, so it has its booking history. When a business asks us to close its account, we delete or anonymise its data within 90 days, except records we must keep by law, such as payment records.

Security

Connections to PangaSlot are encrypted, passwords are stored only as secure hashes, and access to data inside PangaSlot is limited by role. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, to object to how it is used, or to receive a copy. Contact us below; if your data belongs to a business’s customer records, we may pass your request to that business. If you are not satisfied with our answer, you can complain to Rwanda’s National Cyber Security Authority (NCSA).

Changes to this policy

We will update this page when our practices change and tell businesses about significant changes.