Rendez-youPrivacy Policy (GDPR)
Which personal data Rendez-you processes, why, with whom it is shared, how long it is kept and how to exercise your rights.
1. Data controller
SMART FUND SRL, private limited company under Belgian law
Rue de l'Yser 406, 4430 Ans, Belgium · Company number 1014.756.392 · VAT BE 1014.756.392
Phone: +32 465 33 73 54 · E-mail: contact@salesplusplus.io
The organisation a customer books with is also responsible for the data it receives about its customers (name, contact details, appointment) and uses for its own activity.
2. Data we process and why
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | First name, last name, e-mail address, profile picture (Google sign-in), mobile number verified by SMS, password (only as a hash, never in clear), language, notification channels | Create and secure the account, identify you, tell you about your appointments | Performance of the contract |
| Customer without an account | Anonymous session identifier; depending on the organisation's choice: phone verified by SMS code, or the first name, last name, phone and (optional) e-mail you type | Chat without an account, identify you to the organisation when confirming, send you the appointment's follow-up | Performance of the contract |
| Conversations | Messages written to the assistant and its answers | Understand and answer your request; reliability of the service | Performance of the contract |
| Appointments | Organisation, service, team member, date and time, status, optional message to the organisation (300 characters at most), history of confirmed actions | Book, confirm, change, cancel and remind appointments | Performance of the contract |
| Organisation | Name, address, logo, services, prices, hours, team first names and hours, blocked slots, settings (confirmation, identification), websites allowed to show its chat button | Publish the organisation's page and compute its free slots | Performance of the contract |
| Appointments added by the organisation | Customer's name and contact details typed by the organisation | Keep the organisation's calendar (no message is sent to the customer) | Legitimate interest of the organisation |
| Google Calendar (organisations, optional) | Access token, busy periods (start and end only), list of calendars, events created by Rendez-you | Offer only free slots and write the booked appointments | Consent, which can be withdrawn at any time |
| Calendar subscription link (organisations, optional) | The link's address (encrypted), upcoming busy periods (start and end only, never the events' titles or content) | Offer only free slots | Consent, which can be withdrawn at any time |
| Notifications | E-mails and SMS sent, date, delivery status | Confirm appointments and codes, prove sending | Performance of the contract |
| Contact form | Name, e-mail, phone and organisation (optional), topic, message | Answer your request | Legitimate interest (answering people who write to us) |
| Anti-robot protection | IP address and technical browser signals, checked by Cloudflare Turnstile when an SMS code is sent, an account is created or a message is written | Prevent automated sending and sign-ups | Legitimate interest (security) |
| Technical | IP address, browser type, session identifiers, access and error logs | Secure the service, prevent abuse, fix failures | Legitimate interest (security) |
Where the data comes from
- You, when you use Rendez-you or write to us.
- Google, if you sign in with Google (name, e-mail, profile picture — nothing else) and, for an organisation that connects it, Google Calendar.
- The organisation, for the appointments it confirms, changes, cancels or adds itself.
- Meta (WhatsApp), when you write to a Rendez-you WhatsApp number.
3. Artificial intelligence
Your messages are analysed by a language model to understand your request and write the answer. The model runs on graphics processors rented by SMART FUND SRL: it is not a third-party AI service, and your messages are never used to train a model. Dates, times and availability are computed by the software. No decision with legal effects is taken about you automatically: the organisation stays in control of its appointments.
4. Google user data
Rendez-you's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:
- Google Calendar data is only used to compute the organisation's free slots and manage the appointments booked through Rendez-you. Rendez-you does not read the title, description or guests of events it did not create.
- Google data is never sold, never used for advertising or to train AI models, and never read by a human, except with your explicit consent for support, for security, or where the law requires it.
- Google access tokens are stored encrypted. You can revoke access in your space or at myaccount.google.com/permissions.
5. Chat button on an organisation's website
When an organisation places the Rendez-you chat button on its website, the conversation is shown in a window served by Rendez-you, only on the websites the organisation declared. The organisation's website does not receive the content of the conversation. The organisation informs its visitors of this service in its own policy.
6. WhatsApp
On WhatsApp, Rendez-you uses the WhatsApp Business Platform (Cloud API) operated by Meta Platforms Ireland Ltd, under the WhatsApp Business Policy. Rendez-you only writes to you about appointments you requested, never advertising. You can stop at any time by blocking the number or asking for your data to be deleted.
7. Recipients
We do not sell or rent your data and do not use it for advertising. The site contains no advertising trackers or third-party analytics. Data is only shared with:
| Recipient | Role | Location |
|---|---|---|
| The organisation you book with | Receives your name, contact details and the appointment to serve you | Its own premises |
| Hetzner Online GmbH | Hosting of the servers and database | Finland (EU) |
| Runpod, Inc. | Rental of the language model's graphics processors (message text only) | EU or United States |
| Sendinblue SAS (Brevo) | Sending e-mails and SMS, including contact form messages | France (EU) |
| Cloudflare, Inc. | Domain names and anti-robot protection (Turnstile) | Worldwide |
| Google Ireland Ltd / Google LLC | Sign-in, Google Calendar, calendar invitations | EU / United States |
| Meta Platforms Ireland Ltd | WhatsApp Business Platform | EU / United States |
Each provider acts under a data processing agreement. Where data is transferred outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
8. Retention
- Conversations, notifications and technical logs: 1 month, then deleted automatically.
- Conversations and sessions of customers without an account: 30 days.
- Verification codes: a few minutes (only their hash is kept, then erased).
- Account: as long as it exists; deleted within 30 days of your request.
- Appointments: kept in the organisation's calendar while it uses Rendez-you, like any appointment register; deleted with the organisation.
- Calendar access: until it is disconnected or the account is deleted; only upcoming busy periods are kept.
- Contact form: the message is not stored on our servers; it is kept in our mailbox as long as needed to answer and follow up, at most 3 years after the last exchange.
- Data the law requires us to keep (for example invoices) is kept for the legal period.
9. Security
Connections are encrypted (HTTPS). Passwords are never stored: only a hash (scrypt) is, and an account is locked temporarily after several wrong attempts. Access tokens (Google, WhatsApp) and calendar links are encrypted in the database. Each person only sees their own data, which the database itself enforces. An appointment's tracking links are signed and only open that appointment.
10. Cookies and local storage
Rendez-you only uses what is strictly necessary, with no banner to accept: a session identifier kept in your browser to keep you signed in; a “ry_app” cookie that only says this browser has a session, to open your space directly; a “ry_lang” cookie with your language choice; a short-lived cookie while a Google Calendar is being connected. Cloudflare Turnstile may read technical browser information to check that a person is filling in the form. No advertising or analytics cookies.
11. Your rights
Under the GDPR you can ask for access to your data, its rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest. You can withdraw a consent at any time. Write to contact@salesplusplus.io, use the contact form (topic “Personal data”) or write to SMART FUND SRL, Rue de l'Yser 406, 4430 Ans, Belgium. We answer within one month. To delete your data, see Data deletion. For data an organisation processes for its own activity, contact it as well.
You can lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be).
12. Children
Rendez-you is not intended for people under 16. We do not knowingly collect data about them.
13. Changes
Any change to this policy is published on this page with its date. If it is significant, we tell account holders by e-mail before it applies.