What we hold, and what you can actually do about it.

Slate is booking software operated by Calibrate Holdings LLC. This policy covers the Slate marketing site, the operator console, the public booking pages we host for operators, and the manage links guests use to change a booking.

One address reaches a person for anything on this page: cooper@usecalibrate.io

What is held about you

• Your name, email address and phone number, as you typed them at checkout.
• How you heard about the business, if it asked and you answered. It is free text, so whatever you wrote is what is stored.
• Your booking: the reference, the experience, the date and time, what you selected, the prices at the moment you booked, and the status.
• Payment records, if the business takes payment through Slate: amounts, the method, and identifiers from the payment processor. Never your card number — cards are entered on the processor’s own page and Slate never receives one.
• What you wrote when you cancelled. If you give a reason, it is kept in an audit record that cannot be edited or deleted afterwards. Worth knowing before you type something.
• Gift cards, if one was bought for you: the recipient address, the sender’s name and their message. You may never have touched Slate at all — somebody gave us your address.

What you can do right now, without asking anyone

The manage link you were given at checkout is your route in. Under What is held about you it shows you the name, the email address and the phone number stored for this booking, alongside the reservation itself — and it lets you reschedule or cancel, subject to the cutoff the business set, which is theirs, not ours.

That link is a key. Anyone holding it can see and change the booking, because there is no password on it. We store only a scrambled version, so we cannot recover it for you and cannot show it to anyone. Treat it like a ticket.

Who to ask

Ask the business you booked with first. They hold your booking, they hold the money, and they can act immediately. If you cannot reach them, or the request is about Slate itself, write to us and a person will pick it up — we act with the business, because the data is theirs.

Your own account

• Your email address and password. The password is hashed by our authentication service — Slate never sees it and cannot recover it.
• Your name, your organization, and your role in it.
• A record of each sign-in: the IP address and the browser, kept by our authentication service. Every IP address Slate holds is an operator's, recorded at sign-in — a guest booking never writes one. There is more than one such record: the session itself carries an address, and the authentication service keeps its own security log alongside it.
• An audit trail of significant actions in the console — who did what, when. It cannot be edited or deleted after the fact, which is the point of it.
• Billing identifiers at our payment processor, once billing is switched on. It is not switched on today.

Your staff

A staff record can name someone who has no Slate login at all, because a schedule needs names on it. Those are your employees and your responsibility — we hold the name because you put it there.

If you connect Google Calendar

Slate stores the account you connected and the access tokens for it, and reads your calendar so existing commitments block out booking slots. The permission requested is read-only: there is no code path that could create or change an event in your calendar even if somebody wrote one. Event titles come back into Slate as busy blocks, and an event title can say anything, so it is worth knowing they land here.

Your guests’ data is yours

You decide what to collect and why; we store and process it for you. That means your guests’ requests come to you first, and where you need us to act on one, you ask and we do it. Section 7 of the Terms of Service covers what that puts on you, including the fact that there is no data processing agreement for you to sign yet.

The only cookies Slate sets are the ones that keep an operator signed in. They are set by our authentication library, they are first-party, and they do one job: not making you log in again on every page. There is no analytics cookie, no advertising cookie and no measurement cookie anywhere in the product, because there is no code that could set one.

Two things are kept in your browser’s local storage, and neither leaves it:

• Your light or dark preference, so the page does not flash the wrong theme at you. The value is the word “light” or “dark”.
• Whether an operator dismissed a billing banner. Console only; a guest never has one.

Neither is transmitted to us or to anyone else, and neither identifies a person. Clearing your browser storage removes both, and costs you a theme preference.

This is unusual enough that it is worth stating as a fact rather than implying it: Slate does not track visitors across sites, does not build profiles, runs no advertising or measurement, and shares nothing with an ad network. Not because of a policy decision that could quietly change — because there is no such code in the product.

No Google Analytics, no tag manager, no Facebook pixel, no PostHog, Segment, Mixpanel, Amplitude, Hotjar, LogRocket or session replay. Not even our host’s own analytics package. The typefaces are served from our own domain rather than a font host, specifically so that opening a booking page makes no request to a third party at all.

The subprocessors page lists the 4 ways that was verified, so you do not have to take our word for it.

6 outside companies, and 3 of them have never been handed anything at all. The full list — what each one does, what it can see, where it is, and whether it is live or dormant — is on its own page, dated and checked against the code:

Slate’s subprocessors →

We do not sell personal data, we do not share it for advertising, and we do not use one operator’s data for another. We hand data to a provider when it is needed to run the product for you, or when the law requires it of us.

Where it lives

Everything Slate stores — operator accounts and guest bookings alike — sits in a database in the United States, in the AWS us-east-1 region in Northern Virginia. That is measured from the live project, not assumed.

The code that runs each request executes in Washington, D.C. That is measured too, and here is how, because a page that asks you to check its facts should tell you where to look: our host stamps the region it ran in on every response, in the x-vercel-id header, and on 14 August 2026 a request to a booking page and a request to the support page both came back stamped iad1 — the same geography as the database.

How long: indefinitely, with one exception

There is no retention schedule in Slate. Bookings, customer records, payments and audit entries are kept until somebody asks us to delete them. Nothing expires on a timer, nothing is anonymised after a period, and closing or abandoning an account deletes nothing whatsoever.

The one exception is a rate-limiting table that briefly holds an email address to stop repeated booking attempts. It is cleared after two hours by a job that runs every five minutes. That is the only automatic deletion of personal data in the entire product.

Deletion: real, complete, and done by a person

There is no delete button — not for a guest, not for an operator, not anywhere in the console. Deletion is a manual database operation, and we would rather describe it accurately than dress it up:

• Deleting a whole organization removes it and everything belonging to it, including the append-only records nothing else can touch — the audit log, the message log, signatures. It is the widest erasure the product has, and it is what we do when an owner asks us to erase their business. It does not reach the owner’s own login; see below.
• Deleting a single booking is narrower than it sounds. It removes the booking and what hangs off it, but the customer record — name, email, phone — belongs to the organization rather than to the booking, and it stays. So does the log of any message addressed to that person. If somebody wants their details gone rather than just their reservation, say so, because those are two different operations.
• Some records cannot be edited or partially removed at all. The audit log, the message log and signature records are append-only by design — that is what makes them worth having. They can go with the whole organization, and not otherwise.

We will complete a deletion within 30 days of establishing that the request is genuine and came from someone entitled to make it — an owner for an organization, or the business for one of its guests.

Depending on where you live you may have rights to see, correct, delete, export, or object to the use of your personal data. We are not going to list statutes we have not had checked. What we can tell you exactly is which of these Slate can perform today and how:

To make any of these requests, write to privacy@usecalibrate.ioto confirm — or, if you would rather use the address this product prints everywhere else and that we know is read every day, cooper@usecalibrate.io. Either reaches a person answering from an ordinary mail account; neither runs through Slate, which is why they work when Slate’s own messaging does not. Tell us enough to find you: the booking reference, or the business name and the address you booked with.

If you are unhappy with how we handled it, you can complain to your local data protection authority. We would rather you told us first.

• An anonymous visitor has no access to any table. The public booking page and the manage page reach the database only through a short list of named functions, each of which decides for itself what it will return. There is no general read path to fall through.
• Tenancy is enforced in the database, not in the application, so one organization cannot read another’s rows even if a page asked it to.
• Manage links are stored scrambled. We keep a one-way hash of the token, never the link itself, and it can be revoked.
• Error reports are scrubbed before they are written. Email addresses, booking references, tokens, keys, card-length digit runs and phone numbers are stripped, and the page path is rebuilt from the route pattern so a tenant name or a token never rides along in a URL.

Some of these exist as empty space in the database, waiting for a feature that has not been built. An empty column collects nothing, and a privacy policy that describes intentions rather than behaviour is worthless, so:

• Waivers and signatures. Slate’s marketing page mentions waivers. The feature is not built: there is no way to sign one, and no signature — or signature IP address — has ever been recorded. If it ships, this page changes before it does.
• Named attendee lists. Nothing in the product creates one. A check-in list can be read, but nothing writes names into it.
• Acceptance of terms at checkout. Slate does not record that a guest agreed to anything, and does not record a consent IP address. Any page telling you otherwise would be wrong.
• Marketing profiles, lead scores, cross-site identifiers. None of it. See section 5.

Slate is business software and a booking page for adults arranging trips. It is not directed at children and we do not knowingly collect data from one. A child’s name might reach a booking if an adult typed it in — that is the operator’s collection, and their responsibility. If you believe a child gave us information directly, write to us and we will remove it.

When this policy changes, the new version is published on this page with a new check date at the top. That date is the record.

Slate has no working way to reach you about a change. Our email provider rejects everything, so there is no announcement list we could honestly point you at. Until that is fixed, checking this page is the mechanism, and we would rather say that than imply a channel that does not work.

cooper@usecalibrate.io

For privacy and data-rights requests specifically: privacy@usecalibrate.ioto confirm. Both reach a person. If your question is about a specific booking, name the business and the reference and it will get to the right place faster.