Privacy policy

Last updated: 19 October 2026

This policy explains how Slate handles personal data in three situations: when you book with a studio that uses Slate, when you use Slate as a studio or as a member of its staff, and when you contact us through this website. If you are booking with a studio, read this together with that studio's own privacy policy, because both apply.

1. Who we are

Slate Ops Ltd trades as Slate. Email: bookings@slateops.co.uk.

2. Who is responsible for your data

If you book with a studio, or work for one. The studio is the data controller: it decides why your data is used (to confirm bookings, send reminders, manage its staff and, if you consent, market to you). Slate is the data processor: we run the platform on the studio's behalf and handle your data only on its instructions. Our processing terms with each studio are in the studio terms.

If you visit this website, send us an enquiry, or sign your studio up. Slate is the controller for that data, and this policy is the one that applies.

3. What we collect

  • Identity and contact: name, email, phone.
  • Booking details: session, date, seats, notes, waiver answers, gift card and discount codes.
  • Memberships and packs: the plan, renewal dates and the sessions used.
  • Payment: processed by Stripe. Card numbers go directly into Stripe's form and never touch our servers. We see only the success confirmation, the amount, and the last 4 digits.
  • Sign-in: the one-time links and codes we email to customers, dashboard logins for studio users, and staff PINs. We store passwords and PINs in hashed form only.
  • Staff and operations data: what a studio records about its own team and premises, such as clock-in and clock-out times, shift notes, incident reports, checklists and stock counts.
  • Website enquiries: the name, email and message you send through our contact form.
  • Technical: IP address, browser, device and pages visited, for fraud prevention and to keep the platform working.
  • Diagnostics: when something goes wrong, limited error data (page, error message, basic device info). See section 6.
  • Marketing consent: if the studio offers an opt-in at checkout and you accept, we record that.

4. Lawful basis (UK GDPR)

  • Contract: to fulfil your booking or membership, run a studio's subscription, take payment, and send confirmations, reminders and receipts.
  • Consent: marketing emails (only if you opt in), and non-essential cookies or analytics (only if the studio enables them and you accept).
  • Legitimate interest: replying to enquiries, fraud prevention, security, error monitoring, basic usage statistics and improving the product, balanced against your privacy rights.
  • Legal obligation: records required by tax and accounting law (typically 7 years).

5. Who we share with

These processors handle data only for the purposes listed, under written terms:

  • Stripe: payment processing (PCI-DSS).
  • Resend: email delivery, both transactional (confirmations, reminders, receipts, sign-in links) and, where you have opted in, marketing emails sent on the studio's behalf.
  • Anthropic: the AI assistant on the Grow plan. When a studio asks it a question, the question and the records needed to answer it are sent to Anthropic's API. Those records can include customer names, email addresses and booking history. Anthropic does not use data sent through its API to train its models.
  • Sentry: error monitoring and limited session replay (see section 6).
  • Supabase: database hosting and file storage.
  • Umami: cookie-free visitor analytics for this website (see section 7).
  • Vercel: application hosting.

The studio you book with receives your booking and contact details so it can run the session. We never sell personal data and we do not share it with advertisers. We may disclose data where the law requires it, or to protect the platform, its studios or their customers from fraud or abuse.

6. Error monitoring and session replay

We use Sentry to capture diagnostic data when something goes wrong. This may include limited session replay, a partial recording of the page where the error happened, captured only when an error occurs. We mask form inputs and sensitive fields so names, emails, payment details, and anything you type are not captured. If you'd prefer to opt out of session replay entirely, email us using the details below and we'll exclude you.

7. Analytics and marketing pixels

This website (slateops.co.uk) uses Umami to count visits to its own pages, which pages people read, where they came from (for example a link on LinkedIn) and which buttons they click. Umami sets no cookies, does not follow you to other websites, and does not store your IP address or anything that identifies you. It is not used on studio booking pages or in the Slate dashboard.

This website sets no advertising cookies. If that changes, we will ask for your consent first.

The studio you book with can choose to enable third-party analytics or marketing pixels (Google Analytics, Meta Pixel, TikTok Pixel) on its booking page. Where enabled, they rely on your consent under PECR. The studio is responsible for obtaining that consent, for example with a cookie banner. You can decline, use your browser's privacy settings, or a tracking blocker.

8. Cookies

Strictly necessary cookies (session, sign-in, basket) don't require consent, because the platform can't work without them. Analytics and marketing cookies are only set if the studio enables them and you consent. You can clear cookies any time in your browser settings.

9. How long we keep data

  • Booking and contact data: the duration of your relationship with the studio plus a reasonable period after, typically up to 7 years where required by tax and accounting law.
  • Payment records: 7 years (UK financial record-keeping rules).
  • Staff and operations records: for as long as the studio keeps them in its account. The studio decides.
  • Website enquiries: delivered to our inbox by email and not stored in the platform database. We keep the conversation for up to 12 months after the last message.
  • Studio accounts: for the length of the subscription, then deleted within 90 days of it ending, apart from invoices and other records we must keep by law.
  • Error logs: 30 to 90 days, then automatically deleted.
  • Marketing data: until you withdraw consent or unsubscribe.

10. Your rights

Under UK GDPR you can:

  • Access a copy of the personal data we hold about you.
  • Rectify data that's wrong.
  • Erase your data (subject to legal exceptions like accounting records).
  • Port your data in a structured, common format.
  • Object to processing based on legitimate interest.
  • Withdraw consent for marketing or non-essential cookies at any time (this doesn't affect prior processing).
  • Restrict processing while a query is resolved.

To exercise these rights, email us below. For data held on behalf of a studio (the controller), contact the studio directly, and we will help it respond. We'll normally respond within one month.

11. International transfers

Some processors (Stripe, Vercel, Resend and Anthropic) may process data outside the UK, including in the United States. Where this happens, transfers are protected by UK adequacy regulations where they apply, or by Standard Contractual Clauses combined with the UK International Data Transfer Addendum and appropriate technical safeguards.

12. Security

We use encryption in transit (HTTPS), encryption at rest for the database, access controls, secure hosting, and regular review of our processors' security practices. No system is 100% secure; if we ever become aware of a breach affecting your data we'll tell the studio, you and the relevant authorities as the law requires.

13. Children

Slate is built for adults to book with. Where a studio takes bookings for people under 18, the studio is responsible for getting the right consent and for any age rules at its sessions.

14. Complaints

If you're unhappy with how we've handled your data, please contact us first, as we want to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top always shows the current version. For material changes we'll surface a notice on the platform.

16. Contact us

For privacy questions about the Slate platform, email bookings@slateops.co.uk. For questions about how a specific studio uses your data, contact the studio directly. Their details are on your booking confirmation.