Privacy Policy

1. Data controller

Depending on the processing activity, SOLIGON CAPITAL acts as the data controller for operation of the platform. A professional may be the data controller for customer information managed in the professional workspace; in that situation, MonRDVPro acts as a technical service provider to the extent applicable.

2. Personal data we may process

• Account and identity: first and last name, email address, phone number, profile image, preferences, and sign-in information. Passwords are stored as cryptographic hashes and are never stored in plain text.
• Appointments: selected services, dates, times, locations, relevant addresses, scheduling notes, history, and appointment status.
• Service tracking: subject, reference, status, customer-facing message, the professional’s internal notes, contact details, status timestamps, and delivery records. The public link uses a random token, and internal notes are never displayed to the customer.
• Professional data: business details, contact information, services, prices, hours, team members, and appointment, communication, and billing settings.
• Forms and signatures: answers, selected checkboxes, any drawn signature, timestamps, and technical evidence relating to the completion process. The professional controls the form content and must limit questions to data that is genuinely necessary.
• Payments and billing: amounts, payment status, technical Stripe references, invoices, deposits, gift cards, and accounting information. MonRDVPro does not store complete payment card details.
• Communications: email messages, SMS notifications, sending preferences, customized templates, and technical delivery records.
• Reviews, reports, and blocks: rating, comment, displayed name, professional response, stated source, report reason and details, and the relationship between the blocking and blocked accounts. These data are used to moderate content and stop showing a blocked author’s reviews to the user who blocked them. A Google review displayed on MonRDVPro is added manually by the professional; MonRDVPro does not automatically retrieve Google reviews.
• Technical data: security and error logs, IP address when necessary, browser, session information, and diagnostic data.

3. How we use personal data

Personal data is used to:

• create, administer, and secure accounts;
• help users find professionals and manage appointments;
• manage availability, travel, confirmations, reminders, changes, and cancellations;
• track a service or case and notify the customer, including when it is ready;
• allow professionals to create forms and collect responses and, when enabled, signatures;
• request, display, and moderate reviews when those features are enabled;
• support payments, deposits, refunds, gift cards, loyalty programs, and billing when enabled;
• synchronize appointments to an external calendar when the professional chooses that option;
• provide support, prevent fraud, and protect the security and continuity of the service; and
• comply with applicable legal, tax, and accounting obligations.

4. Legal grounds

Depending on the activity and applicable law, processing may be necessary to perform a contract or take pre-contractual steps, comply with a legal obligation, pursue the legitimate interest of operating and securing the service, or rely on consent when consent is required.

If a professional chooses to collect special or sensitive information through a form, that professional is responsible for identifying an appropriate legal basis, providing any required notice to the customer, and obtaining explicit consent when required by law.

5. Google Calendar and Microsoft Outlook / Microsoft 365

Connecting a calendar is optional and must be initiated by the professional. Google Calendar receives appointments created in MonRDVPro. For Microsoft Outlook / Microsoft 365, the professional may also ask MonRDVPro to use busy periods from the selected calendar to close matching appointment slots. An external event does not change the content of an existing MonRDVPro appointment.

Google user data accessed by MonRDVPro

• the email address of the selected Google Account, used to identify the connected account;
• OAuth access and refresh tokens required to maintain the connection; and
• the list of calendars owned by the professional — identifier, name, primary-calendar status, and access role — so the professional can choose the calendar to connect; and
• the information and identifiers for events created by MonRDVPro in the selected calendar to represent appointments.

MonRDVPro requests the limited calendar.events.owned and calendar.calendarlist.readonly scopes. The first allows MonRDVPro to create, update, and delete events in calendars owned by the professional. The second is used only to display the professional’s calendar list so that they can select the calendar to connect. MonRDVPro does not retrieve or list the professional’s pre-existing personal calendar events.

How Google user data is used

Google user data is used only to display the connected account, show the calendars owned by the professional, remember the calendar they select, and create, update, or delete in that calendar the event corresponding to a MonRDVPro appointment. It is not used for profiling, advertising, marketing to the account holder, or enriching a separate database.

Storage and security

The connected email address, the identifier and name of the selected calendar, technical event identifiers, and tokens needed for synchronization are stored in the MonRDVPro infrastructure. The complete calendar list is not retained. OAuth tokens are encrypted using AES-256-GCM. Access is limited to technical components used to provide synchronization and authorized service maintenance.

Sharing, transfer, and disclosure

Google user data is not sold or rented, is not used for targeted advertising, and is not used to train a generalized artificial intelligence model. It is not disclosed to customers or other professionals. It is processed only by Google to perform the requested Calendar operations and by OVHcloud, as MonRDVPro’s technical hosting provider, to the extent necessary for secure storage and service operation. It is not shared or transferred for any unrelated purpose.

Retention, deletion, and revocation

Google connection data is retained while the professional maintains the connection or while it is needed to provide the service. When the professional disconnects Google Calendar from MonRDVPro, the tokens and local connection data are deleted from the active connection. Events already created in Google Calendar may remain in that calendar but will no longer be synchronized. The professional may also revoke access through the security settings of the Google Account.

Microsoft Outlook / Microsoft 365

Microsoft access is provided through Microsoft Graph to create, update, or delete synchronized events and, when the professional enables availability blocking, to read only the technical identifier, start, end, and free/busy status from the selected calendar. Titles and descriptions of external events are neither requested nor stored by MonRDVPro. This data is used only to prevent booking during a busy period. Microsoft tokens are encrypted; the local connection and imported busy blocks are deleted when the account is disconnected.

6. Recipients and service providers

Personal data is available only to the people and providers that need it to deliver the service, depending on the features enabled:

• the relevant professional, to manage appointments, customers, forms, and billing;
• OVHcloud, for technical hosting;
• Microsoft, for email delivery and Microsoft Graph / Outlook;
• Google, for Google Calendar and, when configured, certain mapping or routing services;
• Stripe, for payments, subscriptions, and connected accounts; and
• SMSFactor, for SMS delivery when that feature is enabled.

These recipients receive only the data necessary for their role and act subject to their contractual and legal obligations.

7. Data retention

Personal data is retained for as long as necessary for the purposes described above and is then deleted, anonymized, or archived when required by law. Accounting and billing records may be retained for applicable statutory periods. Account, appointment, form, and review data may be deleted or anonymized when no longer needed, subject to legal obligations and the establishment, exercise, or defense of legal claims.

8. Account and data deletion

A Web request must be confirmed through the link sent to the account email address. Once confirmed, Client access and sign-in tokens are revoked. The request is processed as soon as possible and within 30 days, unless an additional period is permitted by law and explained to the requester.

The Client profile, favorites, reviews, data linking reports to the account, blocking relationships, loyalty benefits, unsigned forms, and data with no retention requirement are deleted. A report already submitted may be retained without any link to the reporter so that the content safety review can be completed. Appointments that have no related legal record are detached from the account and anonymized. Public tracking links are revoked, and related contact details and messages are anonymized. Deleting the account does not automatically cancel future appointments; contact the relevant professional to cancel them.

Limited data is retained when required by law or to protect a legal right: issued invoices and accounting records for 10 years from the end of the relevant financial year; payment references needed for accounting, refunds, and fraud prevention; active gift cards until redemption or expiry; and signed forms or other evidence for as long as necessary to establish, exercise, or defend legal claims. Access is restricted and the retained data is not reused for marketing.

If the same sign-in also provides Pro or Admin access, only the Client space and its specific data are deleted; identity data required for the other space and professional contract is retained. Professionals may also retain, under their own responsibility, client-file records required by law or for legal claims. Requests about those records may be sent directly to the relevant professional.

9. Cookies and local storage

MonRDVPro uses cookies or similar mechanisms that are necessary for operation of the website, including sessions, security, language selection, and sign-in.

With your prior consent, MonRDVPro also uses the Meta Pixel (Meta Platforms) to measure Facebook and Instagram advertising campaigns, attribute visits and professional registrations to ads, and improve campaign delivery. This advertising tracker is loaded only after you agree. You can refuse without losing access to the service and change your choice at any time using the cookie settings control on the website.

10. Your privacy rights

Subject to applicable law, you may have the right to request access to, correction of, deletion of, restriction of, or portability of your personal data, or to object to certain processing. Where processing is based on consent, consent may be withdrawn for future processing.

Residents of certain U.S. states may have additional rights, including rights to know, correct, or delete personal information and to opt out of certain sales, sharing, or targeted advertising. MonRDVPro does not sell personal information or share it for cross-context behavioral advertising.

To exercise a privacy right, contact contact@monrdvpro.com. Identity evidence will be requested only when reasonably necessary to verify the request.

You may also lodge a complaint with a competent data protection authority, including the French Data Protection Authority (CNIL) in France where SOLIGON CAPITAL is established.

11. Security

Technical and organizational measures are used to limit unauthorized access, protect connections, store passwords as hashes, encrypt external calendar tokens, separate professional data, and log sensitive operations. Because no system can guarantee zero risk, safeguards are reviewed as the service and relevant risks evolve.

12. International data transfers

Some providers may process data outside the European Economic Area or outside the user’s country, depending on their technical organization. Where an international transfer is subject to legal safeguards, the transfer must rely on a recognized mechanism such as an adequacy decision or appropriate contractual protections.

13. Changes to this Privacy Policy

This policy may change as features, providers, or applicable obligations change. The date at the top identifies the current version. If the way MonRDVPro uses Google user data changes materially, affected users will be notified and renewed consent will be requested when required.