Slad logo Slad
Find my biggest revenue leak

Privacy Policy

Last updated: August 27, 2026

This Privacy Policy explains how Mask of Janus LLC ("Slad", "we", "us") collects, uses, and protects information you provide when you use getslad.com, any of its business-specific sites (resto, shop, beauty, coach, health and surgeons.getslad.com), the Slad app, or our related services. It applies to all of them.

Who we are

Mask of Janus LLC is a Georgia limited liability company that operates Slad, a software platform for independent local businesses and practices: restaurants and bars, local stores and online shops, salons and barbershops, coaches and consultants, and health, orthopedic and occupational-medicine practices. Slad started with restaurants in Atlanta and now serves operators in these categories across the United States. Contact: yann@maskofjanus.com.

Information we collect

When you submit the audit or sign-up form on getslad.com or one of its business-specific sites, you may provide:

  • Your business Instagram handle
  • Your business website URL
  • Your mobile phone number (only if you choose to receive the audit summary via SMS)

We also automatically collect basic technical information for abuse prevention: IP address, user-agent string, and timestamp. We do not set advertising cookies. We do not sell or share personal information with third-party advertisers.

How we use your information

  • To generate the personalized audit you requested (we scan your business's publicly available web content, photos, reviews, and Google Business Profile).
  • To send you the audit summary via SMS, exactly one message per request, if you provided a phone number.
  • To respond to your inquiries or follow-up questions about the audit.
  • To improve the audit pipeline (aggregated, non-personally-identifiable analytics).

We do not send marketing blasts. We do not enroll you in recurring messaging. We do not share your phone number with third parties for marketing.

SMS consent and opt-out

You provide explicit consent to receive a single SMS audit summary by actively typing your phone number into the form on getslad.com and tapping the "Text me my leak report" button. The consent is informed: the form states plainly what we will do before you tap it. On the restaurant site that disclosure reads "We will pull your menu, audit your reviews and your prices, and text you the leak ranges in about 5 to 10 minutes."; the other business sites carry the equivalent wording for what is audited there.

Every SMS we send includes the instruction "Reply STOP to opt out." Replying STOP immediately removes your number from any future messaging by us through that number. We will not send promotional messages.

How we share information

We use the following service providers to operate Slad. Each only receives the information needed for their function and is bound by their own privacy policies:

  • Twilio (SMS delivery): receives your phone number and the audit message body.
  • Google Cloud / Firebase (hosting, database): processes form submissions and audit data.
  • AWS (Amazon SES) (email): used to send and receive email for Slad mailboxes, booking confirmations, and notifications.

We do not sell personal information. We may disclose information when legally required (subpoena, court order) or to protect our rights, our users, or the public.

Connected accounts and third-party APIs (Google, YouTube, Meta, TikTok)

When you choose to connect a third-party account, Slad uses that platform's official APIs to act on your behalf. Slad's use of information received from these APIs adheres to each platform's developer policies, including the Google API Services User Data Policy, including its Limited Use requirements.

Google and YouTube. Slad's use of YouTube API Services is governed by the YouTube Terms of Service and the Google Privacy Policy. When you connect your Google account, Slad requests only the access needed to publish videos you create in Slad to your own YouTube channel (the youtube.upload scope) and to manage your own Google Business Profile. Slad uses this access solely to provide and improve those user-facing features. We do not transfer this data to others except as needed to provide the service or as required by law, do not use it for advertising, and do not allow humans to read it except with your consent, for security purposes, or as required by law, consistent with the Limited Use requirements.

Exactly what we ask Google for. Slad requests the following Google permissions and no others. Each one is requested only when the feature that needs it applies to your business:

  • openid, email, profile: to sign you in and identify your Slad account.
  • business.manage: to read and update the Google Business Profile you connect, including your business information, hours, photos, posts and the reviews your customers leave, so Slad can keep the listing current and help you answer reviews.
  • youtube.upload: to publish a video you made in Slad to your own YouTube channel.
  • youtube.readonly: used only to read your channel's ID and title, so we can show you which channel a video will publish to. We do not read your videos, your analytics or your subscribers.
  • calendar.events and calendar.readonly: requested only if your business takes appointments (health, orthopedic and occupational-medicine practices, salons and barbershops, and coaches and consultants). Used only to check when you are already busy, so Slad does not offer a slot you cannot keep, and to write a confirmed booking onto your calendar.

Businesses that do not take appointments, such as restaurants and stores, are never shown the calendar permission. If you decline any permission, the feature that needs it is switched off and the rest of Slad keeps working.

Meta (Instagram and Facebook) and TikTok. When you connect Instagram, Facebook, or TikTok, Slad uses their official APIs only to publish content you create to your own connected Pages, profiles, and accounts, and to read the basic account information needed to do so.

What we store. For each connected account we store an access token, and where applicable a refresh token, in encrypted form, plus basic identifiers such as your account or page ID and the permissions you granted, so we can publish on your behalf. We do not access, store, aggregate, or modify other users' content, and we never post to any account other than the one you connected.

Revoking access and deleting data. You can disconnect any connected account at any time inside the Slad app, which removes Slad's stored tokens for that account. You can also revoke Slad's access directly with the provider: for Google and YouTube at myaccount.google.com/permissions, for Meta in your Facebook Settings under Business Integrations, and for TikTok in your TikTok settings under Manage app permissions. To request deletion of any data we hold from a connected account, email yann@maskofjanus.com; we will action the request within 30 days.

AI processing, and what we never send to an AI provider

Slad uses AI models to help you run your business. This section sets out what we never send to an AI provider, and the terms that bind the providers we do use.

Your Google Calendar data is never sent to any AI provider, and Slad never reads it. Slad's own systems make no call to the Google Calendar API. When you grant calendar access, that grant is passed to Slad's scheduling service, which runs on our own infrastructure and uses it for exactly two things: reading your busy times so a taken slot is not offered, and writing a confirmed booking onto your calendar. No calendar event, event title, description, attendee or free/busy record is ever placed in a prompt, sent to a model provider, or used to train, fine-tune or improve any model, by us or by anyone else.

Workspace APIs and model training. Google Workspace APIs are not used to develop, improve, or train non-personalized artificial intelligence or machine-learning models. Google Calendar is the only Google Workspace API Slad uses, and the data it returns reaches no model, personalized or otherwise.

On what terms. We use a small number of established commercial AI providers, each on a paid business plan and each acting as our data processor, meaning they may process what we send only on our instruction and for the sole purpose of returning the result we asked for. Their terms bar them from using that content to train or improve their own models, they keep each customer's data isolated, and where a provider offers training on customer content as an option we do not enable it. We do not authorise, and will not authorise, any provider to train a foundational or generalised model on data derived from your connected Google account, in raw, aggregated or anonymised form. We do not fine-tune any model on your data. If we change providers, the same conditions apply to the replacement, and we will tell you on request who is processing your data at any given time.

Where that processing happens. Requests are processed in the United States and, for one provider, in Singapore, so some requests are processed outside the United States under the conditions set out above. A request carries only what is needed to return the result you asked for, and nothing else from your account.

We do not use any AI provider to make a decision that has a legal or similarly significant effect on you, and anything an AI model produces for you is a suggestion for you to accept, edit or discard.

Scheduling, bookings, and business email

Bookings. If an operator uses Slad's booking page and you book a reservation or appointment, we collect what you enter to make the booking: your name, email address, phone number, the date and time you select, and any notes you add. We use it to create and manage the booking, send you a confirmation, and notify the operator. This information is shared with the operator (the business you booked with) so they can serve you. Bookings are handled by Slad's scheduling system and stored on our infrastructure (Google Cloud).

Business email. Operators may receive a Slad mailbox to send and receive business email. We host the mailbox and process message content only to deliver and store it and, where the operator turns the feature on, to help that operator triage and draft replies to their own mail. We do not use mailbox contents for advertising and do not read them except to provide the service, for security, or as required by law.

How we protect your information

The most sensitive things we hold are the access tokens that let Slad act on your behalf at Google, Meta, TikTok and your point of sale, plus the business content those connections return. They are protected as follows.

In transit. Every connection to Slad, and every call Slad makes to Google or another provider, uses TLS. We do not accept unencrypted connections.

At rest. Your data is stored on Google Cloud infrastructure in the United States (region us-central1), which encrypts all data at rest. On top of that platform encryption, Slad separately encrypts every OAuth access and refresh token with AES-256-GCM before it is written to the database, using a key held in Google Cloud Key Management Service that the database itself never sees. A copy of the database, on its own, does not yield a usable token. If no key is available, Slad refuses to store the token rather than storing it unprotected. Application credentials and API keys are held in Google Secret Manager and are never committed to source code.

Who can access it. Access is enforced on the server, not in the browser. Every read and write is checked against your signed-in identity, so one operator's account cannot reach another's data, and the underlying database rules deny direct client access to connected-account records outright. Administrative access to production is limited to a single named administrator at Mask of Janus LLC, is used only to operate the service, investigate a fault or respond to a support request you raised, or where the law requires it, and is logged. We do not read your connected-account content for any other purpose, and we never read it to build advertising or profiles.

Isolation. Data from a connected Google account is used only to deliver the feature you switched on for your own business. It is not pooled with other operators' data, not sold, not shared with advertisers, and not used to build or improve any machine-learning model, ours or a third party's.

If something goes wrong. If we become aware of a breach affecting your personal information, we will notify you at the email address on your account and, where the law requires it, the relevant regulator, without undue delay.

Data retention

We keep each category of information only as long as it is needed for the purpose it was collected for:

  • Connected-account tokens (Google, YouTube, Meta, TikTok): held while the connection is active. Disconnecting the account, or deleting your Slad account, revokes the token at the provider and deletes it here immediately.
  • Google Business Profile content we cache to run your listing, such as reviews awaiting a reply and posts you scheduled: held while the connection is active, deleted when you disconnect or delete your account.
  • Google Calendar: nothing is retained. Slad stores no calendar events. The scheduling service holds the bookings made through Slad and the credential itself, both removed when you disconnect.
  • Bookings and customer contact details submitted through an operator's booking page: retained for the operator while their account is active, subject to their own retention obligations.
  • Audit request records, including a phone number you submitted: up to 24 months, for support and audit-quality purposes.
  • Text sent to an AI provider: we retain the resulting draft in your queue until you act on it. We do not keep a separate archive of prompts, and providers hold request data only under the terms described above.
  • Records we must keep by law, such as invoices and records of orders your customers already placed: for the period the law requires, held separately from your login.

You may request deletion at any time by emailing yann@maskofjanus.com; we will action the request within 30 days. A backup copy is held for 30 days so an accidental deletion can be undone, and is then permanently erased.

Deleting your account

You can delete your Slad account yourself at any time, without emailing or calling us. In the Slad app, or at getslad.com/app, open the Account panel on your dashboard and choose "Delete my account".

When you delete your account: your sign-in stops working immediately; any Slad subscription is cancelled and you are not charged again; the access tokens that connect Slad to your Google Business Profile, point of sale, social accounts and Slad phone number are revoked at those providers and deleted here; and your business profile, storefront or booking page, scheduled posts and queued content are removed.

A backup copy is held for 30 days so that an accidental or unauthorised deletion can be undone, and is then permanently erased by an automated job. Records we are required to keep by law or by our payment processor, for example invoices and records of orders already placed by your customers, are retained for the period the law requires and are held separately from your login.

If you would rather we did it for you, email yann@maskofjanus.com and we will action the request within 30 days.

Your rights

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) including the right to know, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise these rights, contact us at yann@maskofjanus.com.

Children

Slad is a business-to-business service sold to business operators. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we update this Privacy Policy, the "Last updated" date at the top will change. Material changes will be highlighted in a banner on getslad.com.

Contact

Questions, complaints, or data-deletion requests: yann@maskofjanus.com. Mailing address: Mask of Janus LLC, Dacula, Georgia, USA.