Privacy Policy

Last Updated: October 27, 2026

1. Introduction

Welcome to rendevo ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform (https://rendevo.app).

We operate in compliance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

Our Role as Data Processor

Important: rendevo is a B2B service that provides AI-powered scheduling tools to businesses. When you use rendevo as a business owner:

• You are the Data Controller: You determine what customer data is collected and how it's used for your business operations
• We are the Data Processor: We process customer data on your behalf according to your instructions through our platform
• Your Customers: Your end customers interact with your business through our platform. They should contact you directly for any data-related requests

This Privacy Policy covers how we handle your data as a rendevo business user. For your customers' data that you process through our platform, you are responsible for your own privacy policy and data protection compliance.

A Data Processing Agreement (DPA) is available upon request for business customers who require a formal agreement governing our processing of personal data on your behalf. Contact privacy@rendevo.app to request a DPA.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, business information (business name, address)
• Profile Information: Preferences, settings, profile photo
• Payment Data: Billing information (processed securely by Stripe - we do not store card details)
• Communications: Messages you send through our platform, customer support feedback

2.2 Automatically Collected Information

• Usage Data: How you use the platform (such as the features you use and when you sign in), and aggregated, anonymous page views of the app (see Section 8)
• Technical Information: IP address, browser type, operating system, device identifier
• Cookies and Similar Technologies: See Section 8 for details

2.3 Information from Third Parties

• Authentication Providers: If you sign in via Google, we receive basic profile information (name, email)
• Integrations: Data from connected services (Google Calendar, WhatsApp, Messenger, Instagram) - only with your explicit permission

3. How We Use Your Information

We use your personal data to:

• Service Delivery: Manage your account, provide appointment scheduling and messaging features
• Transaction Processing: Handle subscription payments, billing (via Stripe)
• Communication: Send account updates, appointment notifications, customer support
• Service Improvement: Analyze usage to improve features and user experience
• Security: Fraud detection, abuse prevention, compliance with legal obligations
• Marketing: With your consent, sending promotional emails (you can opt out at any time)

Legal Basis for Processing (GDPR):

• Consent: You have given clear consent for processing
• Contract Performance: Necessary to provide our services
• Legitimate Interest: For service improvement, security, fraud prevention
• Legal Obligation: When required by law

AI Feedback and Improvement (Opt-In)

If you enable AI feedback consent in your settings:

• Business Owner Improvements: We analyze AI assistant performance data to generate personalized recommendations for your account. This includes success rates, conversation patterns, and areas where your AI assistant needs improvement. All feedback data stays within your account and is never shared externally.
• Contributing to rendevo (Optional): You may separately opt in to contribute anonymized, aggregated usage patterns to help improve rendevo for all users. When enabled, we collect only non-identifying metrics like business type categories, common failure patterns, and confidence scores. We never send customer messages, personal information, business names, or any identifying data.

Both consent options can be enabled or disabled at any time in your AI Assistant settings. Disabling these options will immediately stop data collection for these purposes.

Automated Decision-Making (GDPR Article 22)

Our AI booking assistant helps schedule appointments and respond to customer inquiries. These automated processes assist but do not make decisions that produce legal or similarly significant effects. Business owners maintain full control over their scheduling rules, pricing, and service offerings. You may contact us at privacy@rendevo.app to request human review of any automated process.

4. Data Sharing and Disclosure

We never sell your personal data. We share information only as described here:

4.1 Service Providers

• Payment Processing: Stripe (for payment transactions)
• Hosting and Infrastructure: Supabase (database hosting)
• Email Services: Resend (for transactional emails)
• App and Website Hosting, Visit Statistics: Vercel (hosts the app and our public website, and counts page views without cookies)
• Bot Protection: Cloudflare Turnstile (checks that booking requests come from a person)

4.2 Third-Party Integrations

• Google Calendar: Appointment synchronization (only if enabled by you)
• Meta Platforms: WhatsApp, Messenger, Instagram (only if connected by you)

4.3 Legal Requirements

We may disclose information if required by law, court orders, or to protect our rights, the safety of our users, or the public.

4.4 Business Transfers

If our business is merged, acquired, or assets are sold, your personal data may be transferred to the acquiring entity.

4.5 Third-Party Services We Use

This platform uses the following third-party services to provide its functionality:

• Stripe: Payment processing for subscriptions, billing, and customer payments.

  • Subscription billing: Stripe receives payment information, business name, and email address for your rendevo subscription.
  • Customer payments (Stripe Connect): When you collect payments from your customers, Stripe processes customer payment details, invoice amounts, and payout information. Customer card details are never stored on our servers.
  • We store stripe_customer_id, stripe_subscription_id, and stripe_account_id (for connected accounts) to manage payments.
  • Payment history is retained for 7 years after account closure for tax compliance.

  Stripe Privacy Policy

• Google Calendar: Calendar synchronization for appointment management. Google receives appointment details (title, time, location) when you enable calendar sync. Google Privacy Policy

• Meta Platforms (WhatsApp, Messenger, Instagram): Message delivery and receiving for AI assistant conversations. Meta receives message content, sender phone numbers, and timestamps when customers contact you via these platforms. Meta Privacy Policy

• Google AI (Gemini): AI-powered conversation processing for our booking assistant. Google AI provides the Gemini model to process customer messages, recognize intents, and generate responses. We share: customer messages, conversation context, and business information (services, hours, team, locations). We do NOT share: payment information, team member passwords, or raw encrypted message ciphertext stored in our database. Under Google's Gemini API Paid Services terms, Google does not use this data to train or improve its AI models. Google retains prompts and responses for a limited period solely for the purpose of detecting violations of its Prohibited Use Policy (abuse monitoring) and for required legal or regulatory disclosures. Content flagged by automated systems may be reviewed by authorized Google personnel for policy enforcement. Data may be processed in any country where Google or its agents maintain facilities, under Google's Data Processing Addendum and, for transfers to the United States, the EU-U.S. Data Privacy Framework. Gemini API Additional Terms | Google Privacy Policy

• Resend: Transactional email delivery for booking confirmations, appointment reminders, password resets, team invitations, and system notifications. Resend receives recipient email addresses, names, and email content necessary to deliver messages. We do not use Resend for marketing emails. Resend Privacy Policy

• Vercel: Hosting for the rendevo app and our public website, and Vercel Web Analytics. Vercel processes the requests your browser sends to our site, including your IP address and browser details, to deliver pages, and records aggregated, cookieless page-view statistics as described in Section 8. Vercel Privacy Policy

• Cloudflare Turnstile: Bot protection on the public booking pages. Turnstile checks that a booking request comes from a person and not an automated script. To run the check, Cloudflare receives technical information from your browser, such as your IP address and browser characteristics. Cloudflare Privacy Policy

We carefully select service providers that maintain high security and privacy standards. Each provider processes data according to their own privacy policies and applicable data protection laws.

5. Your Rights (GDPR Compliance)

If you are located in the European Economic Area (EEA), UK, or any jurisdiction with similar data protection laws, you have the following rights:

Data Subject Rights

• Right to Access: Request a copy of your personal data in a structured, machine-readable format (JSON). Available instantly through your account settings.
• Right to Rectification: Request correction of inaccurate or incomplete data. You can update most information directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data. Available through the account deletion feature in your settings with a 30-day grace period.
• Right to Data Portability: Receive your data in a portable format and have it transmitted to another service. Our data export feature provides complete JSON exports.
• Right to Restriction of Processing: Request temporary restriction of data processing in certain circumstances.
• Right to Object: Object to certain types of data processing, including marketing communications and automated decision-making.
• Right to Withdraw Consent: Withdraw your consent at any time for processing based on consent (e.g., AI feedback, marketing emails). Manage all consents in your Privacy & Consent settings.
• Right to Lodge a Complaint: File a complaint with your local data protection authority if you believe we've violated your rights.

How to Exercise Your Rights

Most rights can be exercised directly through your account:

• Data Export: Personal Settings → Export Your Data
• Account Deletion: Personal Settings → Delete Account
• Consent Management: Personal Settings → Privacy & Consent
• Email Preferences: Email Preferences page

For rights that cannot be exercised through your account, or if you need assistance, please contact our Data Protection Officer at:

• Email: privacy@rendevo.app
• Response Time: We will respond to your request within 30 days
• Verification: We may request additional information to verify your identity before processing your request
• Supervisory Authority: You also have the right to lodge a complaint with the Federal Trade Commission (FTC) in the United States, or your local EU data protection authority if you are located in the EU/EEA

6. Data Security & Encryption

We implement industry-leading security measures to protect your personal information:

• Encryption: Data in transit (HTTPS/TLS) and at rest (database encryption), plus server-side message encryption (AES-256-GCM with user-specific keys)
• Access Controls: Restricted data access to authorized personnel only
• Regular Security Audits: Regular code reviews and security audits
• Secure Password Management: Password hashing (bcrypt)

However, no method of transmission over the internet or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and notify affected individuals without undue delay as required by Article 34.

7. International Data Transfers

Your data may be processed in countries outside the European Union (EU) or European Economic Area (EEA). When we transfer data internationally, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Ensuring that service providers comply with the GDPR
• Privacy protection certifications (e.g., EU-U.S. Data Privacy Framework)

8. Cookies and Tracking

rendevo does not use advertising or analytics cookies and does not show a cookie consent banner. We keep only what the Service needs to work, and we count visits without cookies.

What We Store in Your Browser

These are necessary for the Service to work, so they do not require your consent:

• Sign-in session: sb-…-auth-token in your browser's local storage keeps you signed in. It is removed when you sign out.
• Language: i18nextLng in local storage remembers which language the app shows you, so it opens in the same language next time. It starts from your browser's language and then follows the language you pick or the one saved in your account. It is also saved on the public booking pages. Signing out clears your choice, and the app goes back to your browser's language.
• Session data: Temporary data for the current tab (such as your language for this visit and cached account details), kept in session storage and cleared when you close the tab.
• Sidebar preference: A sidebar:state cookie (7 days) remembers whether you collapsed the app's sidebar. It is set only when you open or close the sidebar.
• Display settings: Small settings kept on your device, such as which columns you show in the contacts list and whether you dismissed the prompt to install the app.
• Security check: Booking forms use Cloudflare Turnstile to check that a request comes from a person and not an automated script.

Visit Statistics in the App

To understand how the app is used, we count page views on the sign-in and sign-up pages and on the pages of the signed-in app with Vercel Web Analytics, which does not use cookies. It records aggregated, anonymous page-view statistics (the page visited, the referring site, approximate location, and browser, operating system and device type), identifies visits only by a hash of the request that is discarded after 24 hours, and does not track you across websites. We never send the parts of a web address that can carry codes or tokens, such as password-reset or invitation links. Public booking pages are not counted.

Our Public Website

Our public website pages (the home page, industry pages, help center and these legal pages) set no cookies and show no consent banner. To count visits we use Vercel Web Analytics, which does not use cookies: it records aggregated, anonymous page-view statistics (the page visited, the referring site, approximate location, and browser, operating system and device type), identifies visits only by a hash of the request that is discarded after 24 hours, and does not track you across websites. These pages also keep your language choice in your browser's session storage, which is cleared when you close the tab.

Learn more: Vercel Web Analytics Privacy

Third-Party Service Cookies

When you use certain integrations, third-party services may set their own cookies:

• Stripe: Payment processing cookies when you manage billing or subscriptions
• Google: Authentication cookies when you connect Google Calendar
• Meta Platforms: Authentication cookies when you connect WhatsApp, Messenger, or Instagram

Your Choices

• Browser controls: You can clear or block cookies and site data in your browser settings. Doing so signs you out and resets your language choice, and blocking them entirely will prevent you from using the Service.
• Visit statistics: If you prefer not to be counted, a browser setting or extension that blocks analytics scripts stops it. The Service works the same without them.

9. Customer Data Deletion Requests (For Business End-Users)

Important: Two Types of Data Relationships

Data Controller Relationship

When you use rendevo to manage appointments with your customers:

• You are the Data Controller: You determine what customer data is collected and how it's used for your business operations
• We are the Data Processor: We process your customers' data on your behalf according to your instructions through our platform
• Your Customers: Your end customers interact with your business through our platform. Their GDPR rights must be honored by you as their data controller.

How Your Customers Can Request Data Deletion

Under GDPR Article 17 (Right to Erasure), your customers have the right to request deletion of their personal data. There are two methods:

Method 1: Direct Request to You (Recommended)

Your customers should contact you directly with deletion requests. As the data controller, you are responsible for:

• Verifying the customer's identity
• Processing the deletion request within 30 days
• Using rendevo's contact deletion feature to remove their data
• Confirming deletion to the customer

Method 2: Request via rendevo Support

If your customer contacts us directly at privacy@rendevo.app with a deletion request:

• We will forward the request to you (the data controller) for verification and action
• You have 15 days to verify the customer's identity and confirm deletion authorization
• Upon your confirmation, we will permanently delete the customer's data within 15 days
• Total timeline: Up to 30 days from initial request

What Gets Deleted

When a customer deletion request is processed, we permanently delete:

• Contact information (name, phone number, email)
• All message history and conversations with that customer
• Appointment history and booking details
• Any custom fields or notes associated with that customer
• AI conversation logs involving that customer

Data Retention Exceptions

In some cases, we may retain certain data for legal compliance:

• Financial records: If the customer made payments through our system, transaction records may be retained for 7 years for tax compliance
• Legal disputes: Data involved in ongoing legal proceedings may be retained until resolution
• Fraud prevention: Minimal information (e.g., hashed phone number) may be retained to prevent abuse

Your Responsibilities as Data Controller

As a business using rendevo, you must:

• Maintain your own privacy policy informing customers of their rights
• Respond to customer deletion requests within GDPR timelines (30 days)
• Verify customer identities before processing deletion requests
• Use rendevo's contact deletion feature to comply with requests
• Keep records of deletion requests for compliance (we provide automatic audit logs)

Meta Platform Limitations

Need Help?

For questions about customer data deletion procedures:

• Business Owners: Contact hello@rendevo.app
• End Customers: Contact the business you interacted with, or privacy@rendevo.app

10. Specific Integrations & Data Sharing

10.1 Payment Processing (Stripe)

All payment transactions are processed by Stripe, Inc., a PCI-DSS compliant payment provider. Stripe collects:

• Payment card details (never stored on our servers)
• Billing address and contact information
• Transaction history

Data we store from Stripe:

• stripe_customer_id: Links your account to Stripe
• stripe_subscription_id: Manages your subscription status
• Invoice and payment history

Data Retention:

• Active subscription data: Retained while account is active
• Payment history for tax compliance: Retained for 7 years after account closure (legal obligation)
• Card details: NEVER stored on our servers (managed entirely by Stripe)

Stripe Privacy Policy: https://stripe.com/privacy

10.2 Email Services (Resend)

We use Resend for sending transactional emails (account confirmations, appointment notifications, reminders). Resend processes:

• Recipient email address and name
• Email content and metadata

Resend does not use your data for other purposes. Privacy Policy: https://resend.com/legal/privacy-policy

10.3 Hosting and Infrastructure (Supabase)

Our data is hosted on Supabase (PostgreSQL-based). Supabase provides:

• Encrypted database storage
• Regular backups and disaster recovery
• SOC 2 Type II and ISO 27001 compliance

Supabase Privacy Policy: https://supabase.com/privacy

10.4 Google Calendar Integration

When you connect your Google Calendar account, our platform:

• Access: Reads and writes calendar events to synchronize appointments
• Usage: Creates, updates, and deletes calendar events when you manage appointments
• User Control: You can disconnect at any time in Settings → Integrations

Google API Services User Data Policy Compliance:

rendevo's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, rendevo:

• Uses Google Calendar data exclusively for appointment scheduling functionality described in our application
• Does not transfer Google Calendar data to third-party applications or for use outside the original purpose
• Does not use or transfer Google Calendar data for serving ads, including retargeting, personalized, or interest-based advertising
• Does not allow humans to read your data unless: (a) we have obtained your explicit consent for specific messages, (b) it is necessary for security purposes (e.g., investigating abuse), or (c) it is required for compliance with applicable law

10.5 Meta Platform Integration (WhatsApp, Messenger, Instagram)

When you connect your WhatsApp Business, Messenger, or Instagram accounts:

• Access: We receive and send messages on your behalf
• Usage: We store message history and contact information to provide inbox features
• User Control: You can disconnect at any time in Settings → Integrations

Meta Platform Terms and Policy Compliance:

rendevo's use with Meta Platform integrations is subject to the Facebook Terms of Service, Meta Platform Policy, and WhatsApp Business Policy.

rendevo:

• Uses Meta Platform data only for customer communication and appointment management
• Does not use Meta data for advertising, analytics, or third-party tracking
• Respects user privacy preferences set on Meta platforms

10.6 Meta Platform Data Deletion Callbacks

When customers request data deletion from Meta (e.g., deleting their WhatsApp account), Meta sends an automated deletion callback to rendevo. Here's how we handle it:

How It Works:

1. Customer requests data deletion from Meta Platform
2. Meta sends signed deletion callback to rendevo with customer identifier
3. We verify request authenticity using Meta's signature validation
4. We identify all data associated with that customer's phone/platform ID
5. Data is marked for deletion and permanently removed within 30 days

What Gets Deleted:

• All messages and conversation history with that customer from rendevo's database
• Contact information (name, phone, email if associated)
• Appointment history for that customer
• Any encrypted message content stored by rendevo

Data Deletion Limitations:

• Messages already delivered to your business team's devices cannot be remotely deleted
• Messages on Meta's servers are deleted by Meta according to their policies
• Message history in your staff's WhatsApp/Messenger/Instagram apps must be manually deleted
• This deletion only affects data stored by rendevo; Meta manages their own data retention separately

Compliance & Transparency:

• You receive notification when a customer deletion request is processed
• Deletion event is logged in security audit log
• Deletion is permanent and cannot be reversed
• Ensures compliance with Meta's Business Tools Terms and GDPR data subject rights

Data Deletion Requests: If you have used WhatsApp, Messenger, or Instagram to contact a business that uses rendevo and want to delete your data, you can revoke access via your Facebook/Instagram settings or email privacy@rendevo.app. We will process your request within 30 days.

11. Data Retention & Automated Deletion

We retain your personal information only for as long as necessary to provide our services and comply with legal obligations. We have implemented automated data retention policies that permanently delete old data according to the following schedule:

Automatic Deletion Schedule

• Messages & Conversations: Automatically deleted after 30 days to minimize data retention and enhance privacy protection
• Completed Appointments: Automatically deleted after 730 days (2 years)
• Security Audit Logs: Automatically deleted after 90 days
• Export Requests: Automatically deleted after 30 days
• Consent Records: Retained for 730 days (2 years) for compliance
• Inactive Business Accounts: Business accounts inactive for 90 consecutive days may be deleted, with prior email notice to the account owner. This retention limit is grounded in the storage limitation principle of GDPR Article 5(1)(e), which requires personal data to be kept in a form permitting identification of data subjects for no longer than necessary.
• Google AI (Gemini) processing logs: Retained by Google for a limited period for abuse monitoring per Google's Gemini API Additional Terms. Not controlled by rendevo.

Our automated cleanup process runs daily at 2:00 AM UTC and permanently deletes data that exceeds these retention periods. This ensures compliance with GDPR data minimization principles.

AI Feedback Data Retention

Performance Analysis Data: If you enable AI feedback, we retain this data for 90 days to generate performance reports and recommendations. After 90 days, individual feedback records are automatically deleted. Aggregated, anonymized metrics (without personal information) may be retained longer for trend analysis.

Detailed AI Feedback Data Retention:

When you enable AI performance feedback:

• Individual AI performance metrics: Retained for 90 days
• Conversation success/failure logs: Retained for 90 days
• Knowledge gap suggestions: Retained for 90 days
• After 90 days: Individual records are automatically deleted
• Aggregated anonymized metrics (without personal data): May be retained longer for platform improvement and trend analysis
• You can disable AI feedback collection at any time in your AI Assistant settings

Account Deletion

When you request account deletion:

• 30-Day Grace Period: Your account enters a 30-day deletion queue, allowing you to cancel if needed
• Data Export: We automatically generate a complete export of your data before deletion
• Permanent Deletion: After 30 days, all personal data (including encrypted messages, appointments, contacts, and AI feedback) is permanently and irreversibly deleted
• Anonymized Data: If you previously opted in to contribute anonymized data to rendevo improvements, no further contributions will be made. Previously shared anonymized metrics cannot be removed as they no longer contain identifying information.

Legal Compliance: In some cases, we may be required to retain certain data for longer periods to comply with legal obligations, tax requirements, or to resolve disputes. Such data is stored securely and deleted as soon as the legal requirement expires.

12. Children's Privacy

Our service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it immediately.

13. Contact Us & Supervisory Authorities

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@rendevo.app
• Privacy & Data Protection: privacy@rendevo.app
• Legal Entity: Evelicto LLC d/b/a Rendevo
• Address: 971 US Highway 202N, Ste R, Branchburg, NJ 08876, USA

Supervisory Authorities:

• United States (FTC): https://www.ftc.gov/
• EU Data Protection Authorities: Find your local authority

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will notify you of material changes by:

• Sending an email notification to your account email address
• Displaying a prominent notice on our platform
• Updating the "Last Updated" date at the top of this document

Updating the Last Updated date at the top of this document and notifying users via email constitutes a new version of this Privacy Policy, and your continued use of the Service following that notification constitutes your acceptance of that new version.

15. Additional Information for California Residents (CCPA)

We do not sell, rent, or share your personal information for monetary or other valuable consideration as defined under the CCPA. In the preceding 12 months, the categories of personal information we have collected and disclosed for business purposes are described in Sections 2 and 4 of this Privacy Policy.

If you are a California resident, you have the following additional rights:

• Right to Know: Request the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at privacy@rendevo.app