1. Identity of the data controller
| Field | Value |
|---|---|
| Name | Thomas Saldi |
| Address | Rue Lescours 19E, 4653 Bolland, Belgium |
| GDPR contact email | privacy@meetingfriends.be |
| Country | Belgium |
| Supervisory authority | Data Protection Authority (APD/GBA) — www.dataprotectionauthority.be |
2. Data collected and purposes
We make sure that the data processed is adequate, relevant and limited to what is necessary for the purposes described below (data minimisation principle, Art. 5(1)(c) GDPR).
2.1 Data collected at sign-up
| Data | Purpose & legal basis |
|---|---|
| Email address | Account identification — Performance of the contract (Art. 6(1)(b)) |
| First name / nickname | Display in groups — Performance of the contract (Art. 6(1)(b)) |
| Profile photo (optional) | Personalisation — Consent (Art. 6(1)(a)) |
| Unique identifier (UUID) | Technical operation of the service — Legitimate interest (Art. 6(1)(f)) |
2.2 Calendar data (optional feature)
When you connect a calendar (Google Calendar, Microsoft Outlook or iCloud via CalDAV), MeetingFriends processes the information needed to work out availability. The access depends on the provider and on the feature you choose to use.
| Data | Details |
|---|---|
| Availability calculation | Google Calendar provides free/busy time ranges, through the calendar.freebusy permission. Microsoft Outlook provides the start, the end and the availability status. For an availability search shared with iCloud via CalDAV, events are temporarily received by the server so that the useful time ranges and status can be extracted from them. |
| List of your calendars | For Google Calendar, the calendar.calendarlist.readonly permission gives the list of your calendars: their identifier, their name, your role on each one and the primary calendar. MeetingFriends shows it so that you can choose the calendars that count towards your availability and the one where your events are added; this list gives access to no event. It is kept with your account and deleted with it: disconnecting the calendar removes the access permissions to Google, but not this list. |
| Content of existing events | MeetingFriends neither requests nor uses the title, location, attendees, description or attachments of your existing Google or Outlook events. The iCloud CalDAV protocol may send complete events to the server; the other fields received are neither used nor kept by MeetingFriends. |
| Adding to Google Calendar | After a separate, contextual Google permission (calendar.events.owned), MeetingFriends can create in your primary Google calendar a copy of a MeetingFriends event with its title, description, location when there is one, start, end and an internal link to the event. Depending on your preference, later additions can be automatic; updates and deletions of these copies can then be synchronised. Technically, the permission allows seeing, creating, changing and deleting events in the Google calendars you own. MeetingFriends uses it only to create, update or delete its own copies; the code does not use it to look at your other events. |
| Retention of availability data | The content of existing events is not kept to work out availability. The detailed result of a group search — proposed time slots, members with a conflict and the matching busy time ranges — is kept temporarily so that the same request can be replayed without being recomputed or charged twice. It is erased at the latest 24 hours after the search, or earlier at the start of the first proposed time slot. A minimal technical record may then remain for idempotence and credit tracking, with no event content. |
| Legal basis | Prior explicit consent (Art. 6(1)(a) GDPR) |
| Withdrawal | At any time through the app settings or your Google/Microsoft/Apple account |
Important: Connecting a calendar is optional and the app works without it. The free plan currently allows connecting one calendar account in total. The Premium plan currently allows connecting Google, Apple and Outlook.
Data received from Google APIs: MeetingFriends’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. MeetingFriends uses this information only for the features described above: working out your availability and managing, in your Google calendar, the copies of your MeetingFriends events. It is not used for advertising, sold, or used to train artificial intelligence models. It is shared with third parties only as far as these features require, for security or to comply with the law, and nobody reads it, except with your agreement, for security or to comply with the law.
2.3 Technical data
| Data | Purpose & legal basis |
|---|---|
| Calendar connection credentials | Encrypted OAuth tokens and, for iCloud/CalDAV, the Apple ID and an app-specific password, the latter encrypted at rest — keeping the calendars connected — Performance of the contract (Art. 6(1)(b)) |
| Technical calendar synchronisation identifiers | Creating, updating and deleting the copies of MeetingFriends events added to the Google calendar — Performance of the contract (Art. 6(1)(b)) |
| Diagnostic data and pseudonymous identifiers (Sentry) | Detecting and fixing bugs — Legitimate interest (Art. 6(1)(f)) |
| Session identifier | Security and authentication — Legitimate interest (Art. 6(1)(f)) |
| Website requests and technical logs | IP address, browser information and the technical data needed by Vercel to host, secure and diagnose the website — Legitimate interest (Art. 6(1)(f)) |
| Website audience measurement data (Vercel Web Analytics) | Path of the pages viewed without parameters or fragments, dynamic route, referrer, approximate geographic origin, device type, operating system, browser, event timestamp and version of the measurement script. This data is sent only after consent, to measure and improve the website — Consent (Art. 6(1)(a)) |
| Subscription and transaction data | User identifier, product, store, status and timestamps processed through the App Store, the Play Store and RevenueCat to manage Premium subscriptions — Performance of the contract (Art. 6(1)(b)) |
Sentry: The default sending of personal data is turned off (sendDefaultPii: false) and some secrets are scrubbed before sending. Reports may nevertheless contain technical data and pseudonymous identifiers needed for diagnosis.
iCloud/CalDAV: An Apple app-specific password technically gives access to the iCloud Mail, Contacts and Calendar services and cannot be limited to the calendar alone. MeetingFriends only uses CalDAV access to the calendar and accesses neither Mail nor Contacts. This password can be revoked at any time from your Apple account.
2.4 Waiting list
Before the public launch of the app, you can join the meetingfriends.app waiting list to be told when it becomes available.
| Information | Details |
|---|---|
| Data collected | Your email address, normalised to lower case and without spaces, and the following technical attributes: date and time of sign-up recorded by the server in ISO UTC format (SIGNUP_AT), language of the form (LOCALE), source set to meetingfriends.app (SOURCE) and version of the policy applicable at sign-up (LEGAL_VERSION). |
| Purpose | Telling you about the launch of the MeetingFriends app. |
| Legal basis | Your consent (Art. 6(1)(a) GDPR), given when you voluntarily send the waiting list form. |
| Processor | Brevo (see section 4), used to store the list and send the information about the launch. |
| Retention period | Until you have been told about the launch, or until you withdraw your consent if that happens earlier. The data is then deleted from the waiting list. |
| Unsubscribing | You can withdraw your consent at any time through the unsubscribe link in every email or by writing to privacy@meetingfriends.be. |
3. Data concerning minors
When processing is based on consent in the context of an online service offered directly to a child, the threshold applicable in Belgium is 13 years:
- People under 13 must obtain the consent of a holder of parental responsibility for processing based on their consent.
- We do not knowingly collect, from a child under 13, data for processing based on their consent without the authorisation of a holder of parental responsibility. If we learn that such processing has taken place without this authorisation, we will delete this data as soon as possible.
- If you are a parent or guardian and find that your child has created an account, contact us at privacy@meetingfriends.be.
4. Recipients of the data and service providers
| Provider or service | Role | Location and potential transfers |
|---|---|---|
| Supabase | Database, authentication, storage | Depending on the configured region of the project and the service’s sub-processors; some processing may take place outside the EEA |
| Render | Backend server hosting | Depending on the configured region of the service; some of the provider’s processing may take place outside the EEA |
| Google (Calendar API) | Availability calculation and synchronisation of MeetingFriends events (if authorised) | Processing may take place outside the EEA |
| Microsoft (Graph API) | Outlook availability calculation (if connected) | Processing may take place outside the EEA |
| Apple (iCloud/CalDAV) | Shared availability calculation (if connected) | Exchanges between the MeetingFriends server and Apple’s servers; some processing may take place outside the EEA |
| Sentry | Error monitoring | Provider based in the United States |
| RevenueCat | Technical management of subscriptions and transactions | Provider based in the United States |
| Brevo (Sendinblue) | Sending the app’s transactional emails and actively managing the website’s waiting list | Data hosted in the European Union |
| Vercel | Website hosting, processing of web requests and, only after consent, aggregated audience measurement through Vercel Web Analytics | Main processing facilities in the United States; transfers governed by the applicable offer and DPA |
| Apple App Store | iOS distribution and payments | Processing may take place outside the EEA |
| Google Play Store | Android distribution and payments | Processing may take place outside the EEA |
Transfers outside the EEA: When processing takes place outside the European Economic Area, we make sure that it relies on an adequacy decision or on appropriate safeguards, such as the European Commission’s standard contractual clauses, in accordance with Chapter V of the GDPR.
5. Retention period
| Category of data | Retention period |
|---|---|
| Account data (email, profile) | Until the account is deleted, subject to backup periods and applicable legal obligations |
| Calendar connection credentials | Until the account is deleted; when you disconnect or when a revocation is detected, the connection is deactivated and no longer used |
| Availability data (calendars) | Event content is not kept. The detailed result of a group search is kept for at most 24 hours, or until the start of the first proposed time slot if that comes earlier, then its details are erased. A minimal technical record may be kept for idempotence and tracking of the credit used. |
| Technical calendar synchronisation identifiers | Until the MeetingFriends event or the account is deleted; a technical deletion record may be kept until then to avoid duplicates |
| Error logs (Sentry) | For the period set in the Sentry configuration, limited to what is needed for diagnosis |
| Email address and waiting list attributes | Until you are told about the launch, or until consent is withdrawn if that happens earlier, then deletion from the waiting list |
| MeetingFriends subscription metadata | Until the account is deleted; the stores and RevenueCat apply their own obligations and retention periods |
| Vercel Web Analytics data | No analytics cookie. The hash used to tell visitors apart is renewed every day and the matching session is deleted after 24 hours. Aggregated statistics remain available according to the reporting window and retention rules of the applicable Vercel plan. |
6. Your rights
Under the GDPR (Articles 15 to 22), you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and withdrawal of consent at any time.
To exercise your rights, contact us at: privacy@meetingfriends.be. We will reply within one month (which may be extended by two months for a complex request). Exercising these rights is free of charge. We may ask you to confirm your identity.
6.1 Right to lodge a complaint
If you believe that the processing of your data breaches the GDPR, you have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA): www.dataprotectionauthority.be — contact@apd-gba.be — +32 2 274 48 00.
7. Data security
- Encryption of data in transit through HTTPS/TLS
- AES-256-GCM application-level encryption for stored calendar secrets
- Secure authentication through Supabase Auth
- Error monitoring through Sentry, with the sending of PII turned off by default and configured filtering of some secrets
7.1 Data breach: in the event of a breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible. A breach will be notified to the APD/GBA as soon as possible and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the rights and freedoms of natural persons (Articles 33 and 34 GDPR).
8. Changes to the policy
In the event of a substantial change, we will inform you by appropriate means before it takes effect where the regulations require it.
9. Contact
privacy@meetingfriends.be — Last updated: 24/10/2026