Privacy Policy

1. Who we are

SlatOS and SlatTech are made by Tessellink, Corp., an Indiana corporation ("Tessellink", "we", "us"). SlatOS is the software a dog gym uses for booking, payments, clients and messages. SlatTech is the unit that sits on a slatmill and records each run.

You can reach us at info@getslatos.com, or by post at Tessellink, Corp., 1718 Capitol Avenue, Cheyenne, WY 82001.

2. Who this policy covers

This policy covers three groups of people:

• Visitors. People who visit getslatos.com, email us, book a demo or claim a founding spot.
• Gyms. The businesses that use SlatOS and SlatTech, and the people at a gym who have a login (owners and staff).
• A gym's clients. The dog owners who book with a gym that uses SlatOS, and their dogs.

3. Who is responsible for a client's information

When a gym uses SlatOS, the gym decides what information it collects from its clients and what it does with it. The gym is responsible for that information. We handle it on the gym's behalf, to provide the service, and we follow the gym's instructions.

In privacy law terms, the gym is the controller of its clients' information (in Canada, the organization accountable for it) and Tessellink is its service provider and processor. We handle that information only on the gym's instructions, and the SlatOS Subscription Agreement a gym signs sets out how. It may be processed in the United States and in other countries where our service providers operate; the current list is under "Service providers" below.

If you are a client of a gym and you want to see, correct or delete your information, ask your gym first. The gym can make most changes itself, and we will help the gym with anything it cannot do on its own.

4. What information is collected

From visitors to this website:

• What you send through the contact form or by email: your name, email address, gym name if you give it, the topic and your message.
• What you enter when you claim a founding spot: your name, your gym's name, email address and phone number, where the gym is, whether it is mobile or fixed, how many slatmills it has, its internet and texting setup, what it uses today, roughly how many clients it has, when it would like to start, and how you heard about us.
• What you enter when you book a demo. Bookings are made on a Google Calendar booking page, so Google receives your name, email address and the time you pick, and adds the call to our calendar.
• Basic technical information that any web server receives, such as your IP address and browser type. Our hosting provider keeps this in its logs.
• How this website is used, measured by Google Analytics: the pages you open, how you reached the site, the rough location of your IP address, your device and browser type, and whether you book a demo, send the contact form, claim a founding spot, open the Subscription Agreement or follow the Log in link. Nothing you type is included. See "Cookies and analytics".

From gyms:

• The gym's name, logo, colours, tagline, postal address and web address.
• The name, email address and password of each person with a login. Passwords are stored in scrambled (hashed) form by our sign-in provider. We cannot read them.
• The gym's settings: hours, cities served, packages and prices, vaccine rules, waiver documents and message settings.
• A history of changes made to the gym's settings.
• Details of the gym's connected accounts: the ID of its Stripe account, its sending email address and, if it uses texting, the key to its own texting account, which we store encrypted.

From a gym's clients, entered by the client or by the gym:

• Contact details. Name, email address, phone number, home address, city and postal code, and an emergency contact's name and phone number.
• Account details. A password (stored hashed), whether the client agreed to receive texts, whether the client agreed to photos and video, and how the client heard about the gym.
• Dog profiles. Name, breed, sex, weight, birthday, photo, vet clinic, health conditions, allergies, reactivity, bite and aggression history, treat rules, and any alerts or notes the gym adds. A gym's internal notes are never shown to the client.
• Vaccine records. The documents a client uploads, the vaccines listed, expiry dates and the gym's approval.
• Waivers. Which documents a client signed, the name they signed with, when they signed, and the IP address and browser they signed from.
• Bookings. Requests, booked sessions, where and when they happen, who at the gym runs them, cancellations and the reasons given.
• Session data. What SlatTech records for each run: speed second by second, distance, duration, active and rest time, calories, the dog's weight, and the temperature and humidity in the gym. It is saved to the dog's profile along with any note the gym writes.
• Payment records. What was bought, the amount, tax, tips, the payment method (card, cash, Venmo, Zelle or e-transfer), refunds and session balances. Card numbers are entered on Stripe's pages and never reach us.
• Messages. Replies a client sends by text to confirm or opt out, and records of whether an email bounced. We do not keep a copy of each message's content after it is sent; the email and texting providers keep their own records.
• Activity in the app. Badges a dog has earned, leaderboard results, which dogs a client follows and cheers a client sends.

From the SlatTech unit itself: its ID, its software version and when it last checked in.

5. How the information is used

• To run the service for the gym: taking bookings, recording payments, keeping client and dog records, and producing reports.
• To send messages on the gym's behalf: confirmations, reminders, "on my way" texts, session reports, vaccine reminders, and the emails a gym chooses to send.
• To show clients their own dog's reports, progress, badges and leaderboard place.
• To keep the service secure, find and fix problems, and stop abuse. For example, we count requests from an IP address for a short time to limit repeated sign-up attempts.
• To help a gym when it asks us for support.
• To answer you if you contact us, and to arrange a demo or a founding spot if you ask for one.

We do not sell personal information. We do not use clients' information for advertising, and we do not use it to build profiles for anyone else.

We do not market to a gym's clients. The only messages a client receives through SlatOS are the ones the client's own gym sends.

We may use aggregated or de-identified information that does not identify a gym, a client, a named dog or a location, for product improvement, statistics and comparisons.

6. Service providers

We use the companies below to provide the service. They are our service providers (in the SlatOS Subscription Agreement, subprocessors). Each receives only what it needs for its job. For each one: what it does for SlatOS, and where it processes information. This is the current list; we update it here before a new provider handles anyone's information.

• Vercel (hosting). Runs this website and the SlatOS app. It handles every request, so it receives IP addresses and browser details, and the information in each page as it is served. The app's servers are in the United States (Washington, D.C.), and Vercel's network delivers pages from locations around the world.
• Supabase (database, sign-in and file storage). Stores all of the gym and client information listed above, including account logins, client and dog records, bookings, waivers, session data and payment records, plus uploaded files: dog photos, vaccine documents and gym logos. Stored in the United States (East US, Ohio).
• Neon (the founding list). Stores what a gym enters when it claims a founding spot on this website, and nothing else. Stored in the United States.
• Stripe (card payments). Each gym connects its own Stripe account. When a client pays by card, Stripe receives the client's name and email address, what is being bought and the amount, and the card details the client enters on Stripe's page. Stripe also receives the gym's name and contact email when the gym connects its account, and bills the gym's subscription to us. Stripe processes information in the United States and in the other countries where it operates.
• Resend (email). Delivers messages sent through this website's contact form and founding form to our inbox and to the person who sent them, and sends emails on the gym's behalf. It receives the recipient's email address and the content of each email, which can include the client's name, the dog's name, booking details and session numbers. Processes information in the United States.
• Google Workspace (our email). Our own email, including info@getslatos.com, runs on Google Workspace. Anything you email us, and our copies of contact form messages and founding requests, are stored there. Google processes information in the United States and in other countries where it has data centres.
• Quo, formerly OpenPhone (texting, for gyms that use it). A gym that uses texting connects its own Quo account and business number. Quo receives the client's phone number and the content of each text, and passes replies back to us. Processes information in the United States.
• WhatsApp, run by Meta (messages, for gyms that use it). A gym that uses WhatsApp instead of texting connects its own WhatsApp Business Account through Meta. Meta receives the client's phone number and the content of each message, and passes replies back to us. Meta processes information in the United States and in the other countries where it operates.
• Google Calendar (demo bookings). The booking page on our demo page is run by Google. It receives what you enter when you book a time. Google processes information in the United States and in other countries where it has data centres.
• Google Maps. To estimate travel time between a gym's stops, the addresses of those stops are sent to Google's Distance Matrix service. Links in the schedule also open an address in Google Maps. Processed by Google as above.
• Google Analytics (visits to this website). Google Analytics, run by Google LLC in the United States, measures visits to getslatos.com: which pages are opened, how people reach the site, and whether a visit leads to a demo booking, a contact form message, a founding request, a look at the Subscription Agreement or a click through to the app's Log in page. It sets cookies in your browser to tell one visit from the next. We never send it your name, email address, phone number, gym name or anything else you type. To opt out in any browser, install Google's opt-out browser add-on from https://tools.google.com/dlpage/gaoptout. A gym can also add its own Google Analytics ID to its own copy of the app; if it does, Google receives usage information about that gym's pages under the gym's own Analytics account. Google processes information in the United States and in other countries where it has data centres.
• Google Fonts. Emails and the app's sign-in page load a typeface from Google's font service. When they load, Google receives the IP address of the device. Processed by Google as above.

We may also share information when the law requires it, for example to answer a court order or a lawful request from a public authority, or when it is needed to protect someone's safety or the security of the service. If Tessellink is sold or merged, the information may pass to the new owner, who must keep to this policy or tell you about any change as described under "Changes to this policy".

7. What other people can see

• Leaderboards. A gym's leaderboard is shown only to that gym's signed-in clients. Each dog can be set to public, anonymous or private. An anonymous dog appears without its name, breed or photo. A private dog does not appear at all.
• Share images. When a client or gym shares a session image, anyone with the link or the image can see the dog's name, photo and that run's numbers. Sharing is always the person's own choice.
• Dog photos. Dog photos are stored at web addresses that are not listed anywhere but can be opened by anyone who has the address.
• Payment links. A payment link opens without a login, so it can be paid from a text message. It shows what is being paid for and the amount.
• Calendar feed. A gym can subscribe to its schedule in a calendar app using a private web address. Anyone the gym gives that address to can see the schedule, including client names and the addresses of home visits.

8. Cookies and analytics

This website (getslatos.com) uses Google Analytics to measure visits: which pages are opened, how people reach the site, and whether a visit leads to a demo booking, a contact form message or a founding request. Google Analytics sets cookies in your browser so it can tell one visit from the next. They hold a random identifier, never your name or anything you type. What Google receives, and where it processes it, is under "Service providers".

To opt out, install Google's opt-out browser add-on from https://tools.google.com/dlpage/gaoptout, or block cookies for this site in your browser. The site works the same either way.

This website uses no advertising trackers or tracking pixels. Its fonts are served from our own site. The Google Calendar booking page on our demo page is also loaded from Google, and Google may set its own cookies there.

To limit spam, the contact form and the founding form briefly count requests from each IP address. The count is held in memory for a few minutes and is never saved. Our hosting provider keeps ordinary server logs, as described above.

The SlatOS app keeps a sign-in token in your browser so you stay logged in. That is necessary for the app to work. A gym may add its own Google Analytics to its copy of the app, as described above.

If we change how this website measures visits, we will say so here first.

9. Where information is stored

SlatOS data is stored with Supabase in the East US (Ohio) region and processed by Vercel in the Washington, D.C. (US East) region. The founding list is stored with Neon in the United States. Our email is stored with Google in the United States.

Gyms and clients may be in the United States, including Puerto Rico, or in Canada. If you are in Canada, your information is stored and processed in the United States and in the other countries where our service providers operate (listed under "Service providers"). There it is subject to the laws of those countries, and may be accessible to their courts and authorities under those laws.

10. How information is protected

• Each gym's information is kept separate at the database level. Every record is tied to one gym, and the database itself refuses a request for another gym's records.
• Clients can only see their own information and their own dogs. A gym's staff logins cannot see payments, reports or settings.
• Connections to the website and app are encrypted.
• Passwords are stored hashed by our sign-in provider.
• Card details are handled only by Stripe.
• Keys to a gym's texting account are stored encrypted and cannot be read back out through the app.
• Vaccine documents are private files, opened through links that expire.
• SlatTech units each have their own credential, and a unit can only save runs to its own gym.
• A small number of Tessellink staff can see a gym's information in order to set up and support it. That access is limited to named people and changes they make are logged.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the affected gym without undue delay and, where the law requires it, the people affected and the authorities.

Backups are overwritten in the ordinary course.

11. How long information is kept

We keep a gym's information for as long as the gym uses SlatOS. A gym can archive a dog so that its history is kept, or remove a dog. A dog with nothing on record (no bookings, sessions or plans) is deleted; a dog with any history is archived instead, so the gym's records stay complete.

Records of request counts by IP address are deleted after 24 hours.

We may delete a gym's identifiable information from our active systems 60 days after its subscription ends. Backups are overwritten in the ordinary course.

Enquiry and demo emails are kept for 2 years, then deleted. A founding request is kept while we are in touch with that gym about joining; if the gym joins, it becomes part of the gym's information, and if not, it is deleted with our enquiry emails.

We keep the records the law requires us to keep, such as tax and payment records, for as long as the law requires, even after other information has been deleted.

12. Your choices

If you are a gym's client:

• You can see and update your contact details and your dogs' profiles in the app.
• You can choose whether each dog is public, anonymous or private on the leaderboard.
• You can stop marketing emails with the unsubscribe link in any of them.
• You can stop texts by replying STOP.
• To get a copy of your information, correct it or have it deleted, ask your gym. There is no button for this in the app today, so the gym will pass the request to us where needed.

If you are a gym:

• You can view and edit your clients' and dogs' records in the app at any time.
• To export your information or have it deleted, email info@getslatos.com. There is no self-serve export in the app today. We provide an export in a commonly usable format within 14 days of a request, at any time during the subscription and for up to 30 days after it ends.

13. Privacy rights in the United States and Canada

Depending on where you live, the law may give you rights over your personal information, such as the right to see it, correct it, delete it, take a copy of it, or withdraw your consent. We honour the rights that apply to you. Send requests to your gym if you are a client, or to info@getslatos.com. We answer within a reasonable time, and we never treat you differently for asking.

In the United States, some states give their residents these rights by law. Where a state's law applies to you, we honour it. Texts are sent only by gyms that have their clients' consent, from the gym's own number, and a client can stop them at any time by replying STOP.

In Canada, including British Columbia, you have the right to ask what personal information we hold about you, to see it, to have it corrected, and to withdraw your consent to its use, subject to legal limits. We rely on your consent, given to your gym when you sign up, for how your information is used, and we collect only what the service needs. Marketing emails and texts are sent only with the consent that Canada's anti-spam law requires, and every one has a way to unsubscribe. If you are not satisfied with how we have handled a request, you can complain to the Office of the Privacy Commissioner of Canada, or in British Columbia to the Office of the Information and Privacy Commissioner for British Columbia.

The contact for privacy questions is info@getslatos.com.

14. Children

SlatOS is for dog gyms and their adult clients. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe someone under 18 has given us information, contact us and we will delete it.

15. Changes to this policy

If we change this policy we will update the date at the top and tell gyms by email 30 days before the change takes effect.

16. Contact

Questions about this policy or your information: info@getslatos.com, or by post at Tessellink, Corp., 1718 Capitol Avenue, Cheyenne, WY 82001.