Sloity

Legal 法律

Privacy Policy 私隱政策

Last updated: 10 November 2026 (Hong Kong time) 最後更新：2026 年 11 月 10 日（香港時間）

1. Controller

Seito Systems Limited (Hong Kong) operates Sloity Cloud and is the data controller for merchant account data and platform logs described below. Merchants who collect guest booking details through their Sloity pages are typically controllers of that guest data for their own business purposes; we process it as a service provider to host and display bookings for them.

2. What we collect

  • Merchant account: email address, shop/brand name, URL slug, outlet settings, and related admin profile fields.
  • Bookings and guest details: information merchants’ guests enter (for example name, phone, email, party size, notes) and booking status.
  • Authentication: short-lived email OTP codes and related verification metadata.
  • Security: Cloudflare Turnstile tokens / bot-check signals on registration and similar forms.
  • Technical logs: IP address, user agent, timestamps, error and access logs needed to run and secure the Service.
  • Optional BYOK config: if you connect SMS or SMTP with your own keys, we store the configuration you provide (treat keys as secrets; rotate if exposed).
  • Uploads: photos or files you upload for your shop (stored in object storage).

3. Where data is stored

  • Neon Postgres in the Singapore region — primary application database.
  • Cloudflare R2 (APAC-oriented bucket sloity-uploads) — uploaded media.
  • Cloudflare edge — Workers, CDN, DNS, and security (including Turnstile).
  • Resend — delivery of Hosted Free email OTP and transactional mail we send on your behalf for the platform path.

BYOK SMS/SMTP traffic goes to your providers under your accounts; we do not become the controller of those providers’ processing beyond storing your configuration.

4. Who can see it

  • Your merchant staff with access to your shop admin — bookings and shop settings for that shop.
  • Sloity / Operator staff — only as needed for support, abuse investigation, security, and operating the platform.
  • Subprocessors: Cloudflare, Neon, and Resend, each under their own terms, solely to provide infrastructure or delivery.

We do not sell personal data.

5. Why we process data

To create and secure accounts, run booking pages and admin, send OTP and essential service email, prevent abuse, diagnose outages, and comply with law. Legal bases include performing the contract (providing the Service), legitimate interests in security and reliability, and consent where required for optional features or cookies.

6. Retention

  • Account and shop data: for the life of the account, then deleted or anonymised after a deletion request within a reasonable period.
  • OTP codes: short-lived (minutes); not kept as long-term credentials.
  • Technical logs: typically short rolling windows for security and debugging, unless a longer period is needed for an investigation.
  • Backups: may persist briefly after deletion until rotated.

7. Cookies and similar technologies

We use what is needed to run the Service: language preference (e.g. localStorage / lang query), session or security cookies if applicable, and Cloudflare Turnstile on protected forms. We do not invent third-party advertising analytics trackers on the marketing site.

8. Export and deletion

To request a copy of your merchant account data, correction, or deletion/export, email privacy@sloity.com from the address on the account. We will verify the request and respond within a reasonable time. Guest data held only for your shop may also need action from you as the merchant (for example correcting a booking in admin).

9. International transfers

Data may be processed in Singapore, on Cloudflare’s global network, and by Resend where they operate. By using the Service you understand these transfers are part of how the hosted product works.

10. Children

The Service is aimed at businesses, not children. Do not register if you are under 16 (or the higher age required in your place of residence).

11. Changes and contact

We may update this Policy by posting a new version here. Material changes will update the “Last updated” date. Privacy requests: privacy@sloity.com.

Related: Terms of Service.

1. 資料控權人

Seito Systems Limited（香港）營運 Sloity Cloud，並就下文所述商家帳戶資料及平台日誌擔任資料控權人。商戶透過 Sloity 頁面收集的顧客預約資料，一般由商戶就其業務目的擔任控權人；我們作為服務提供者，代其託管及展示預約。

2. 我們收集甚麼

  • 商家帳戶：電郵、店舖／品牌名稱、網址 slug、分店設定及相關後台資料。
  • 預約與顧客資料：顧客填寫的資料（例如姓名、電話、電郵、人數、備註）及預約狀態。
  • 驗證：短期電郵驗證碼（OTP）及相關驗證紀錄。
  • 保安：註冊等表單上的 Cloudflare Turnstile 權杖／機械人檢查訊號。
  • 技術日誌：IP、瀏覽器資訊、時間戳、錯誤與存取日誌，用於營運與保安。
  • 選用 BYOK 設定：若你接駁自備短訊或 SMTP 金鑰，我們會保存你提供的設定（請將金鑰視為機密；洩露時應更換）。
  • 上載：你為店舖上載的相片或檔案（存於物件儲存）。

3. 資料存放位置

  • Neon Postgres（新加坡區）— 主要應用資料庫。
  • Cloudflare R2（偏 APAC 的 sloity-uploads bucket）— 上載媒體。
  • Cloudflare 邊緣網路 — Workers、CDN、DNS 與保安（包括 Turnstile）。
  • Resend — 傳送 Hosted Free 電郵驗證碼及平台路徑的必要交易電郵。

BYOK 短訊／SMTP 流量會送往你的服務商、你的帳戶；除保存你的設定外，我們不會因此成為該等服務商處理的控權人。

4. 誰可以看見

  • 你的商家職員（可登入該店後台）— 該店的預約與設定。
  • Sloity／營運方職員 — 僅在支援、濫用調查、保安及營運平台所需範圍內。
  • 次處理者：Cloudflare、Neon、Resend，各自按其條款，僅為提供基建或傳送服務。

我們不會出售個人資料。

5. 處理目的

用於建立與保護帳戶、營運預約頁與後台、發送 OTP 及必要服務電郵、防濫用、排查故障，以及遵守法律。法律依據包括履行合約（提供服務）、保安與可靠性的合法利益，以及在需要時就選用功能或 cookie 取得同意。

6. 保留期

  • 帳戶與店舖資料：帳戶存續期間保留；收到刪除要求後，於合理期間內刪除或匿名化。
  • OTP：短期（分鐘級），不作長期憑證保存。
  • 技術日誌：一般為短滾動窗口，作保安與除錯；調查需要時或會較長。
  • 備份：刪除後或會短暫存在，直至備份輪替。

7. Cookie 及類似技術

我們使用營運服務所需者：語言偏好（例如 localStorage／lang 參數）、適用的工作階段或保安 cookie，以及受保護表單上的 Cloudflare Turnstile。我們不會在宣傳站自行加入第三方廣告分析追蹤器。

8. 匯出與刪除

若要索取商家帳戶資料副本、更正，或要求刪除／匯出，請用帳戶電郵寄至 privacy@sloity.com。我們會核實身份並於合理時間內回覆。僅屬你店舖的顧客資料，或亦需由你以商戶身份在後台處理（例如更正預約）。

9. 跨境傳輸

資料可能在新加坡、Cloudflare 全球網路，以及 Resend 營運地點處理。使用本服務即表示你明白此等傳輸屬託管產品運作的一部分。

10. 兒童

本服務面向商戶，而非兒童。未滿 16 歲（或你居住地規定的較高年齡）請勿註冊。

11. 變更與聯絡

我們可於本頁發布更新版私隱政策，並更新「最後更新」日期。私隱查詢：privacy@sloity.com。

相關：服務條款。