Who we are
Rendezvous is operated by Modulos Systems Ltd., a company incorporated in Zagreb, Croatia. We are the data controller for personal data you provide when creating an account, using the platform, or contacting us.
For personal data that event organisers collect from their guests (such as names, email addresses, and dietary preferences submitted through an RSVP form), the organiser is the controller and we act as a data processor on their behalf. This distinction is important: if you have questions about data collected by a specific event, please contact the organiser directly.
Contact for data-protection enquiries: privacy@rendez.us
What we collect
Account & profile information
- Registration details — your name, email address, and any profile information you choose to add.
- Authentication data — we use one-time passcodes (OTP) sent by email or SMS for login; we do not store passwords.
Event content
- Text, images, videos, and other media you upload to create or populate your event pages.
- Event configuration: dates, locations, schedule items, poll questions, guest list (names, email addresses, phone numbers, RSVP responses, dietary requirements).
Guest data (collected on behalf of organisers)
- When you RSVP to an event, the organiser receives your name, contact details (if supplied), RSVP status, and any answers you provide to RSVP questions. This data is held on behalf of the organiser; Rendezvous processes it as a data processor.
Payment metadata
- Payments are made through Stripe, which is the merchant of record for your purchase. Checkout is hosted by Stripe, so we never see or store your full card details. For each purchase we keep the amount, the VAT included in it, its status and Stripe's reference for the payment. We do not store full card numbers, CVV codes, or any other sensitive payment credentials.
Usage & technical data
- We collect minimal technical data necessary to operate the service: browser type, device type, approximate location (country level), and pages visited. We do not use third-party advertising trackers or share usage data with social-media platforms.
- Server access logs (IP addresses, request timestamps) are retained for a short period for security and debugging purposes.
Communications
- Messages you send to our support team, and records of transactional communications we send you (invitations, OTP codes, event updates).
How we use your data
We use the data we collect to:
- Create and manage your account, and authenticate you when you sign in.
- Host your event pages and deliver the platform features described in our Terms of Service.
- Send you transactional communications: OTP codes, payment receipts, event-related notifications, and service announcements.
- Process payments and maintain financial records as required by law.
- Detect and prevent fraud, abuse, and security incidents.
- Improve the platform — we analyse aggregated, anonymised usage patterns to understand how features are used and where we can improve.
- Comply with legal obligations (e.g. retaining invoices and financial records).
We do not sell your personal data to third parties. We do not use your data for third-party advertising or profiling.
Legal bases (GDPR Art. 6)
For users in the EU and EEA, we process your personal data under the following legal bases:
- Contract (Art. 6(1)(b)) — processing your account information, event content, and payment details is necessary to perform our contract with you (the Terms of Service).
- Legitimate interests (Art. 6(1)(f)) — security monitoring, fraud prevention, product improvement, and sending you service-critical notifications (e.g. downtime alerts).
- Legal obligation (Art. 6(1)(c)) — retaining financial records and responding to lawful requests from public authorities.
- Consent (Art. 6(1)(a)) — where we rely on consent (e.g. optional marketing communications), you may withdraw it at any time without affecting the lawfulness of prior processing.
Sharing & processors
We do not sell or rent your personal data. We share data only with the following categories of processor, each under a data-processing agreement:
- Stripe (payments) — processes payment data as the merchant of record for your purchase. Stripe is a PCI DSS-compliant payment processor. See Stripe's Privacy Policy.
- Email & SMS delivery providers — used to deliver OTP codes, invitations, and event notifications. These providers receive only the data necessary to send the message (e.g. email address or phone number).
- OpenAI (content screening and weather estimates) — when these features are enabled, text and images are sent for content screening. Event venue details, coordinates, and dates are used to generate weather estimates.
- Cloud infrastructure & object storage — servers, databases, and file storage are hosted with reputable EU-based or EU-compliant cloud providers. All providers are bound by data-processing agreements that include appropriate technical and organisational safeguards.
We may also disclose data if required by law, court order, or to protect the rights, property, or safety of Rendezvous, our users, or others.
International transfers
We aim to keep your data within the EU/EEA. Where we engage processors based outside the EU/EEA, we rely on one of the following transfer mechanisms:
- An adequacy decision by the European Commission for the destination country.
- Standard Contractual Clauses (SCCs) as approved by the European Commission.
- Other appropriate safeguards as specified in GDPR Chapter V.
If you would like details of the safeguards in place for a specific transfer, contact us at privacy@rendez.us.
Retention
We retain your personal data only for as long as necessary for the purposes described in this policy:
- Account data — held for the duration of your account. Self-service deletion removes your sign-in account from the active database after you confirm with a verification code. Shared event content and legally required records are treated separately, as explained on our Data Deletion page.
- Event content & guest data — held while the event is active. Guest access normally ends three calendar months after the event, unless its online period is extended. The event is then archived and remains available to its owner in the dashboard. Archiving does not delete event content or guest records. Owners can delete an event from its settings or request removal through our privacy contact.
- Financial records — invoices, payment records, and related data are retained for the period required by applicable accounting and tax law. Contact us for the retention period that applies to a particular record.
- Server access logs — retained for up to 30 days for security purposes.
Security
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
- All data in transit is encrypted using TLS.
- Data at rest is encrypted using industry-standard algorithms.
- Access to production systems and personal data is restricted to authorised personnel on a need-to-know basis.
- We use one-time passcodes for authentication — no stored passwords means no password breach risk.
- Regular security reviews and dependency audits.
No system can guarantee absolute security. If you suspect that your account has been compromised, contact us immediately at privacy@rendez.us.
Your rights
Under the GDPR, you have the following rights with respect to your personal data:
- Right of access (Art. 15) — you can request a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — you can ask us to correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — you can ask us to delete your data in certain circumstances. See our Data Deletion page for details.
- Right to data portability (Art. 20) — you can request a machine-readable copy of data you have provided to us.
- Right to object (Art. 21) — you can object to processing based on our legitimate interests.
- Right to restriction of processing (Art. 18) — you can ask us to pause processing in certain circumstances.
- Right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting prior processing.
To exercise any of these rights, email us at privacy@rendez.us. We will respond within 30 days. We may ask you to verify your identity before processing a request.
You also have the right to lodge a complaint with a supervisory authority. In Croatia, the supervisory authority is the Agencija za zaštitu osobnih podataka (AZOP): azop.hr.
Children
Rendezvous is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data without appropriate consent, please contact us at privacy@rendez.us and we will delete that data promptly.
Cookies & analytics
We use only essential cookies — small text files stored in your browser that are strictly necessary for the platform to function. This includes cookies for session management (keeping you logged in) and security tokens.
We do not use advertising cookies, third-party tracking cookies, or social-media pixels. We do not build behavioural profiles for advertising purposes.
For analytics we use Plausible, a privacy-friendly, cookieless tool that we self-host on our own infrastructure. It measures aggregate traffic — page views, referrers, rough location — without cookies, without cross-site tracking, and without building individual advertising profiles. These aggregate analytics are hosted on our own infrastructure.
You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in to the platform.
Data deletion
You can delete your sign-in account from your account settings. Shared event content is not automatically erased. For details of what is removed, what remains, and how to submit a broader erasure request, see our dedicated Data Deletion page.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice on the platform at least 14 days before the changes take effect. The date at the top of this page always reflects the version currently in force.
We encourage you to review this policy periodically. Your continued use of Rendezvous after any changes constitutes your acceptance of the updated policy.