Effective date: 1 November 2026
Shlott is owned and operated by Abraham Almosawi, a sole trader trading as Shlott, based in the United Kingdom. In this policy, "Shlott", "we", "us" and "our" mean Abraham Almosawi trading as Shlott.
This policy explains how we collect, use, share and protect personal information when you use any part of the Shlott service, which includes:
Shlott is a booking and group management platform used by clubs, schools, syndicates and other closed groups, such as flying clubs, sailing clubs, riding schools, music schools and driving instructors. Each group is run by one or more group administrators, who decide who joins, what can be booked and what rules apply.
We process personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). Where the EU GDPR or other local laws apply to you, we also aim to meet their requirements.
Contact: Abraham Almosawi, Shlott Online Booking System, Unit 85778, PO Box 6945, London W1A 6US, United Kingdom. Email: [email protected]
ICO registration number: ZC275792
We collect only what we need to run Shlott for you and your groups. Some of it you give us, some is added by your group administrators, and some is collected automatically.
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored only as a secure hash), mobile number, language, time zone, profile photo | You |
| Group membership | Groups you belong to, your role (member, instructor, administrator), membership status, notes added by administrators | You and your group administrators |
| Bookings and activity | Bookings made, changed or cancelled, resources booked (for example an aircraft, boat or room), times, instructor assignments, booking comments, usage records such as hours flown | You, other members and administrators |
| Qualifications and records | Licence or rating types, expiry dates, check-out dates, currency records, where a group chooses to track them | You and your group administrators |
| Communications | Messages and notices sent within a group, support requests, emails to us, feedback | You, other members, administrators |
| Billing and subscriptions | Subscription plan, billing name and address, payment history, and for in-app subscriptions, purchase receipts and subscription status. Card details are handled by Stripe, Apple or Google and are never stored by us | You or the group's billing contact, and Apple, Google or RevenueCat for in-app subscriptions |
| Technical and device data | IP address, browser and device type, operating system, app version, log records of sign-ins and actions. When you send feedback from the app, your device model and operating system version are attached to help us investigate | Collected automatically |
| Usage and cookies | Pages viewed, features used, how you arrived at our website | Collected automatically, with consent where required (see section 6) |
| Advertising data (free version only) | Advertising identifier and approximate location derived from IP address, where you allow it, and information about adverts shown and interactions with them | Collected automatically by our advertising partner (see section 5) |
| Marketing preferences | Whether you have subscribed to or opted out of our newsletters, and how you interact with our emails | You and automatically |
We do not ask for special category data (such as health, ethnicity or religious beliefs). Some groups may hold medical certificate dates or similar records. Group administrators should only record what they need and tell their members about it.
If you give us information about someone else, for example when an administrator invites a new member, you should make sure they are happy for you to do so.
We use personal information only for the purposes below. UK GDPR requires us to have a lawful basis for each one.
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in (including by magic link), and letting you join groups | Contract |
| Making, managing and showing bookings, calendars and ICS feeds | Contract |
| Sending service messages: booking confirmations, reminders by email or SMS, password and sign-in emails, changes to bookings | Contract |
| Taking subscription payments, managing in-app subscriptions and keeping financial records | Contract and legal obligation |
| Providing support and answering your questions | Contract and legitimate interests |
| Keeping Shlott secure, preventing fraud and abuse, and fixing faults | Legitimate interests (and legal obligation where relevant) |
| Understanding how Shlott is used so we can improve it | Legitimate interests, or consent where cookies or similar technologies need it |
| Showing adverts in the free version of Shlott | Consent for personalised adverts; legitimate interests for non-personalised adverts |
| Sending newsletters and product news | Consent, or legitimate interests for existing customers about similar services (you can opt out at any time) |
| Meeting legal, tax and regulatory duties, and handling legal claims | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights and you can object at any time (see section 11). Where we rely on consent, you can withdraw it at any time without affecting what we did before.
We do not sell your personal information. We do not make decisions about you using solely automated processing that have legal or similarly significant effects.
Shlott is responsible (the controller) for your Shlott account, our billing, our marketing, security, and how the platform works.
Each group decides what information it holds about its members and how it uses it, for example membership records, qualifications, booking rules and notes. For that group data, the group (usually the club, school or syndicate) is the controller and Shlott acts as its processor, handling the data on the group's instructions and under our Terms of Use.
This means:
Group administrators must make sure they have a lawful basis for the information they add, and must tell their members how they use it.
The Shlott app connects to the same account as the web app, so everything in this policy applies to it. The points below are specific to the app.
Permissions. The app does not request access to your location, contacts, photos, camera or microphone. On iOS, if you use the free version, the app may ask your permission to track through Apple's App Tracking Transparency prompt (see Advertising below). You can change this choice at any time in your device settings.
If a future version needs another permission, for example to send push notifications, the app will ask you first, you can change your choice in your device settings at any time, and we will update this policy.
We do not collect your precise location, contacts, photos or microphone input.
Advertising. The free version of Shlott shows adverts provided by Google, through Google AdSense on the web and Google AdMob in the mobile app. Google may use your device's advertising identifier and approximate location to show and measure adverts, and its advertising software collects diagnostic and performance information for its own use.
We never share your name, email, bookings or group information with advertisers.
Purchases. You can remove adverts by subscribing in the app. These subscriptions are processed by Apple (App Store) or Google (Google Play) under their own privacy policies, and managed for us by RevenueCat, which receives your Shlott user ID, purchase receipts and subscription status, along with technical details such as your IP address and device type. We never receive your card details. You can manage or cancel your subscription at any time in your Apple or Google account settings. Subscriptions for groups on the website are paid through Stripe, which handles your card details under its own privacy policy.
App store data. Apple and Google may collect information when you download or use apps, under their own policies. If you have agreed to share analytics with app developers in your device settings, Apple or Google may provide us with crash and performance reports, which we use only to fix problems.
Deleting your account. You can delete your Shlott account at any time from the Settings icon in the mobile app, or from the Account page in the web app. Step-by-step instructions, including how to ask us to delete your account without the app, are at www.shlott.com/account-deletion. Deleting your account does not cancel an in-app subscription, so please cancel it in your Apple or Google account settings to stop future payments. See section 9 for what happens next.
The website and web app use a small number of cookies. Strictly necessary cookies are always on; everything else is off until you agree through our cookie banner.
You can change your choice at any time using the cookie settings link in the website footer, or block cookies in your browser. Full details are in our Cookie Policy.
The mobile app does not use browser cookies. It stores your sign-in token securely on your device and uses the advertising technologies described in section 5.
We share personal information only with the people and organisations below, and only as much as each needs.
| Provider | What they do | Main location |
|---|---|---|
| Microsoft (Azure) | Hosting, databases, file storage, caching, content delivery | Ireland and Netherlands (EU) |
| Amazon Web Services (Amazon SES) | Sending service and notification emails | Ireland (EU) |
| Brevo | Newsletters and marketing emails | EU |
| Twilio | SMS booking reminders | USA |
| Stripe | Subscription payments on the website | USA and EU |
| RevenueCat | Managing in-app subscriptions | USA |
| Google (AdSense and AdMob) | Adverts in the free version of Shlott | USA |
| Google (Analytics) | Website analytics, with consent | USA |
| Apple App Store and Google Play | App distribution and in-app subscription payments | USA |
| Microsoft 365 | Our email and support correspondence | UK and EU |
We will keep this list up to date. We do not sell or rent personal information to anyone.
Our main systems are hosted in the European Union (Ireland and the Netherlands), which the UK recognises as providing adequate protection for personal data.
Some providers, such as Twilio, Stripe, RevenueCat, Apple and Google, may process data in the USA or elsewhere. When personal information leaves the UK or EEA, we rely on one of these safeguards:
Shlott has users around the world. If you use Shlott from outside the UK, your information will be transferred to and processed in the UK and EU as described here. You can ask us for more detail on the safeguards we use.
We keep personal information only as long as we need it, and never longer than 2 years, except where the law requires us to keep financial records for longer.
| Information | How long we keep it |
|---|---|
| Account details | While your account is active, then deleted or anonymised within 30 days of account deletion |
| Inactive accounts | Deleted after 2 years with no sign-in, after warning you by email |
| Group bookings and records | Up to 2 years after the booking date, or sooner if the group deletes them, closes or is deleted for inactivity. Past bookings may stay in a group's history with your name removed. Groups that need longer records can download their data at any time using the CSV backup feature |
| Inactive groups | Deleted, with their bookings and records, after 12 months with no bookings, after warning the group's administrators by email at least 30 days beforehand. Members' own accounts are not affected. See the Inactive groups section of our Terms of Use |
| Support correspondence | Up to 2 years after the issue is closed |
| Security and server logs | Up to 90 days, unless needed to investigate an incident |
| Database backups | Overwritten on a rolling basis, and never kept longer than 2 years |
| Marketing preferences | Until you unsubscribe; we keep a minimal record of opt-outs so we do not contact you again |
| Billing and payment records | 6 years after the end of the financial year they relate to, as UK tax law requires |
Deleting your account. You can delete your account at any time in the app or on the website (see section 5), or by emailing us. Deletion removes your account and personal details. If you are the only administrator of a group, you will be asked to pass the role on or close the group first. Information we must keep by law, such as invoices, is kept for the period above and then deleted. If you have an in-app subscription, cancel it in your Apple or Google account settings, as deleting your Shlott account does not stop it.
We use technical and organisational measures appropriate to the risk, including:
No system is completely secure. If a breach affects your personal information and is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires. Please keep your password and email account secure, and tell us straight away if you think your account has been misused.
Under UK data protection law you have the right to:
To use any of these rights, email [email protected]. We may need to confirm your identity first. We will reply within one month, or tell you if we need longer for a complex request. For data a group holds about you, we may pass your request to that group's administrators.
If you live outside the UK, you may have similar rights under local law, for example in the EU, Australia or US states such as California. We will honour those requests in the same way.
You can control how your information is used at any time:
Shlott is not intended for children under 13, and children under 13 must not create an account. Some groups, such as music or riding schools, may include younger members. Where a group adds a child under 16, the group is responsible for getting consent from a parent or guardian, and the parent or guardian should normally manage the account. If you believe a child under 13 has given us information without consent, please contact us and we will delete it.
We may update this policy from time to time. The effective date at the top shows when it last changed. If we make significant changes, we will tell you by email or in the app before they take effect.
If you have any questions about this policy or how we handle your information, please contact:
Abraham Almosawi
Shlott Online Booking System
Unit 85778
PO Box 6945
London W1A 6US
United Kingdom
Email: [email protected]
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. If you are in the EU, you can also contact the data protection authority in your country.