Privacy Policy
Last updated: June 17, 2025
SlotScout ("we", "us", "our") is operated by Arshpreet Singh Sidhu, a Canadian sole proprietor. This policy explains what data we collect, why we collect it, and your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Information We Collect
- Account data — email address and hashed password when you register.
- AIS credentials — your US visa portal (ais.usvisa-info.com) email and password, encrypted with AES-256-GCM before storage and only decrypted inside isolated worker processes at runtime.
- Appointment data — schedule IDs, facility IDs, and date preferences you configure.
- Session and booking logs — activity the bot performs on your behalf, including dates checked and any appointment booked.
- Payment data — credit pack purchases processed by Stripe. We store only the Stripe session ID and credits purchased; no card numbers are stored on our servers.
- Notification preferences — email and Discord webhook URL (optional), Telegram account ID if you link the bot.
- Usage data — server logs (IP address, timestamps) retained for 30 days for security purposes.
2. How We Use Your Information
- To operate the automated appointment-booking service on your behalf.
- To send transactional emails (verification, booking confirmations, session failures).
- To process payments and issue credits.
- To detect and prevent fraud, abuse, or unauthorized access.
- To respond to support inquiries.
We do not sell, rent, or share your personal information with third parties for marketing purposes.
3. Third-Party Service Providers
We share data with the following sub-processors, each bound by their own privacy policies and data-processing agreements:
- Stripe — payment processing (stripe.com/privacy)
- Resend — transactional email delivery (resend.com/privacy)
- Telegram — optional bot notifications (telegram.org/privacy)
4. Data Retention
- Account data is retained while your account is active.
- When you delete your account, we soft-delete your data immediately and permanently purge it within 30 days.
- Session logs older than 90 days are automatically deleted.
- AIS credentials are automatically removed 30 days after your last successful booking.
5. Security
AIS credentials are encrypted with AES-256-GCM using per-field IVs before being written to our database. Session authentication uses short-lived JWT tokens stored in httpOnly cookies — never accessible to JavaScript. Our database and Redis instances are not exposed to the public internet.
6. Your Rights (PIPEDA)
Under PIPEDA you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Withdraw consent and request deletion of your data.
- File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).
To exercise these rights, email us at [email protected]. You may also delete your account directly from the dashboard under Settings → Delete account.
7. Cookies
We use a single httpOnly session cookie to keep you logged in. No third-party tracking or advertising cookies are used.
8. Changes to This Policy
We may update this policy as our service evolves. Material changes will be communicated by email. Continued use of SlotScout after changes constitutes acceptance.