Compliance & Privacy Governance

Privacy Policy

Last Updated: November 11, 2026 • Effective Immediately

SlateFlare Systems ("SlateFlare", "we", "our", or "us") provides a software-as-a-service conversational lead qualification platform and embeddable widget technology. This Privacy Policy details our operational commitments, data handling practices, and legal compliance regarding the processing of data collected through our public website (slateflare.com) and the SlateFlare conversational widget embedded on client domains.

Direct Data Sovereignty Notice: SlateFlare does not operate a permanent central database for customer lead records. Website visitor inquiries captured through the SlateFlare widget are processed statelessly at the edge and routed directly into the business owner's private Google Sheet via secure webhook protocols.

1. Roles and Scope of Service

In providing our lead generation technology, SlateFlare operates in two distinct legal capacities:

Data Controller: For visitors accessing slateflare.com directly, submitting our "Book a Demo" form, or engaging with our direct sales and support channels.
Data Processor: For visitors who interact with a SlateFlare conversational widget embedded on a subscriber's (client's) website. The subscriber is the Data Controller of their own leads; SlateFlare merely transmits this data to the subscriber's designated Google Sheet.

2. Categories of Information Collected

A. Information Submitted by Website Inquirers

When a prospect interacts with an embedded SlateFlare widget on a client site, we collect only the explicit information required to facilitate the inquiry:

Full Name
Phone / Mobile Number
Selected Service or Treatment Type
Custom Project Notes or Timing Requirements
Timestamp of Submission

B. Information Submitted for SlateFlare Demonstrations

When you request a demo on slateflare.com, we collect your full name, work email address, telephone number, business domain, and primary operational goals.

C. Automated & Technical Telemetry

To ensure secure transmission and prevent automated denial-of-service (DoS) attacks, our edge servers temporarily process technical connection telemetry, including IP addresses, browser user-agent tokens, referring URLs, and response latency stamps. This data is not joined with customer inquiry identities.

3. Stateless Edge Routing Architecture

SlateFlare is architected to guarantee privacy through minimal persistence:

An inquiry is submitted in the widget.
The payload transmits encrypted over HTTPS (TLS 1.3) to our nearest edge routing node (Cloudflare Workers).
The routing node maps the verified client identifier (`data-client-id`) to the client's destination endpoint.
The node dispatches the inquiry directly into the client's Google Apps Script Webhook.
Once the destination spreadsheet confirms receipt (HTTP 200/302), the payload is purged from active edge memory. No copy remains on our infrastructure.

4. Third-Party Sub-Processors

To maintain high availability and real-time synchronization, SlateFlare utilizes trusted infrastructure providers:

Cloudflare Inc.: Edge serverless compute, DDoS mitigation, and SSL/TLS termination.
Google LLC (Google Workspace): Destination spreadsheet infrastructure (Google Sheets and Google Apps Script) under the client's administrative control.

5. Cookies and Local Browser Storage

The SlateFlare widget does not set invasive third-party cross-site advertising cookies. We may use brief in-memory variables or browser session storage solely to prevent resetting an ongoing multi-step chat flow if the visitor navigates between pages on the same client website.

6. Data Security Practices

We employ technical and organizational safeguards designed to protect information from unauthorized access, alteration, or disclosure. All transit is strictly enforced using HTTPS. Client webhook URLs are stored as server-side environment configurations and are never exposed in public client-side browser code.

7. User Rights & Data Subject Requests

Depending on your jurisdiction (such as under the Indian Digital Personal Data Protection Act, EU GDPR, or UK Data Protection Act), you have rights regarding your personal data:

Inquiries submitted on Client Websites: Because SlateFlare does not store lead records centrally, requests to access, rectify, or delete an inquiry must be directed to the specific business owner (the Data Controller) whose Google Sheet holds the record.
SlateFlare Direct Inquiries: If you submitted your information directly on slateflare.com, you may request deletion or access by writing to our compliance officer.

8. Policy Modifications

We may update this Privacy Policy periodically to reflect architectural improvements or regulatory requirements. Any modifications will be posted to this page with an updated effective date.

9. Contact & Governance

For inquiries regarding this Privacy Policy or our operational data handling, please contact:

SlateFlare Systems — Data Governance Officer
Email: privacy@slateflare.com