Privacy policy

For the data of people who create an account with us (hosts), SaaSolution is the data controller.

When a guest books a time on a host’s booking page, the host decides why and how the guest’s details are used, and we process them on the host’s behalf to run the booking. If you booked with someone and want to see or delete what they hold about you, ask the host first. You can also write to us and we will help.

• Account data: your name, email address and, if you sign up with a password, a salted hash of it (we never store the password itself). If you sign in with Google, Apple or Microsoft, we receive your name and email address from that provider.
• Profile and settings: your public username, time zone, language, availability, meeting types, and optional phone number and country.
• Booking data: the guest’s name, email address, chosen time, time zone and any notes they add, plus the status of the booking.
• Connected services: if you connect a calendar or video service, we store the access credentials it gives us (encrypted) and the calendar data needed to show your availability and to create and update booking events. See “Google user data” below for Google specifically.
• Billing data: your subscription status and the customer and subscription identifiers from our payment provider, Stripe. Card details are entered with Stripe and never reach our servers.
• Your agreement to our documents: when you sign up we record that you accepted the terms and this privacy policy, the time, and the version that applied.
• Developer API data: if you use the API, we record for each request the time, the endpoint, the result and how long it took, but not the content of the request. We store a fingerprint of each API key, never the key itself, your spending limit, and your confirmation that you understand that using the API creates costs. To prevent double bookings, we keep the answer to a booking request for 24 hours.
• Technical data: your IP address, browser type and the time of each request in our server logs, and a session cookie that keeps you signed in. Booking pages may record page-view statistics for the host without cookies, using a short-lived hashed identifier built from network and browser details that changes every day and does not identify you.

• To provide the service: sign you in, show your availability, take and manage bookings, sync your calendar and create video links.
• To send service emails: booking confirmations, reminders, changes and cancellations, account and security messages, and billing notices.
• To take payment for your subscription and keep the records the law requires.
• To keep the service secure, prevent abuse, fix problems and provide support.

We do not sell personal data, we do not show advertising, and we do not use your data to build advertising profiles.

You can connect your Google account so that your booking page only offers times when you are free, and so that confirmed bookings appear in your Google Calendar. Connecting is optional and you can disconnect at any time.

When you connect Google, we ask for your permission to:

• identify the Google account you connected (your email address and basic account identifier);
• see the list of calendars in your account;
• view and edit events on your calendars: read them to show your real availability, and create, update and delete the events that your bookings produce;
• if you choose Google Meet, create Google Meet meetings for your bookings (only meetings our app created).

We store the access and refresh tokens Google gives us, encrypted at rest. To show your availability we keep a copy of events from the calendars you select, including their time, title, description, location, status and attendee details, and we refresh that copy from Google while the connection exists.

We use this data only to provide and improve the scheduling features you asked for inside RSViP Online. We do not use it for advertising, we do not sell it, we do not share it with other parties except the infrastructure providers that run our service under contract, and we do not use it to develop or train artificial-intelligence or machine-learning models. Visitors to your booking page see free and busy times, not the content of your events.

RSViP Online’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you disconnect Google Calendar or Meet in the dashboard, we delete the stored tokens and the copied events, and we revoke our access at Google (when it is your last Google connection with us). If you delete your account, we delete this data and revoke our access too. You can also remove our access yourself at any time at https://myaccount.google.com/permissions.

We use only the cookies the service needs to work: a session cookie that keeps you signed in and protects forms against forgery. We do not use advertising or cross-site tracking cookies, and this website sets no analytics cookies.

• Infrastructure providers that host and run RSViP Online and send its email, under contract and only to provide the service. Our infrastructure can be located in different regions of the world, and we may add regions as we grow.
• Stripe, which processes subscription payments.
• The services you choose to connect (for example Google, Microsoft, Zoom), which receive only the data needed to do what you asked, such as creating a calendar event or a meeting link.
• Authorities, where we are legally required to disclose data.

Because we operate internationally, your data may be processed outside your own country. Where this means a transfer outside the European Economic Area, we rely on safeguards recognised by law, such as the European Commission’s standard contractual clauses.

• Account and booking data: for as long as your account exists.
• Connected calendar and video data: until you disconnect that service or delete your account.
• API request log: 90 days, or until the month has been invoiced if that is later. Stored answers to booking requests: 24 hours. API keys and settings: until you revoke them or delete your account.
• After you delete your account: your data is deleted, including your API keys, request log and API settings. Before that we invoice any API usage not yet billed. Billing and tax records, including usage invoices, are kept without your identity for the period the law requires.
• Backups: kept for up to 30 days and then overwritten, so deleted data disappears from backups within that time.

Connection credentials are encrypted at rest, all traffic to the service uses HTTPS, and access to production systems is limited to people who need it to run the service. No system is perfectly secure, so we also keep software up to date and monitor for problems.

Depending on where you live, you have the right to access your data, correct it, have it deleted, restrict or object to how it is used, receive a copy of it in a portable format, and withdraw consent you gave. You can change most details yourself in the dashboard and delete your account there.

To use any of these rights, or to ask a question about your data, write to privacy@rsviponline.com. We answer within one month. If you think we handled your data unlawfully, you also have the right to complain to your local data protection authority.

RSViP Online is not meant for children under 16 and we do not knowingly collect their data.

We will update this page when our practices change and show the date at the top. If a change is significant, we will also tell account holders by email.

Privacy questions and requests: privacy@rsviponline.com.