Rendezvous Privacy Policy

Effective Date: August 16, 2025

Last Updated: August 15, 2026

Rendezvous App LLC ("Rendezvous," "we," "us," or "our"), located at 30 N Gould St, Ste R, Sheridan, WY 82801, USA, provides a professional networking platform built for aviation crews — pilots, flight attendants, and airline professionals — to connect, coordinate schedules, and meet up on layovers. This Privacy Policy explains what information we collect from users of the Rendezvous mobile application and website, including all webpages and services that link to this Policy (together, the "Services"), how we use, share, and protect it, and the rights and choices you have.

This Policy should be read together with our Terms of Service, of which it forms an integral part. By creating an account or using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

The short version: We collect what we need to run Rendezvous — your profile, your schedule (if you share it), your messages, and limited technical data. We never sell your personal data. We never share your schedule, contact information, or location with advertisers. Data sharing is limited to the service providers that make the app work (described in Annex III), and nothing more.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, such as a name, email address, phone number, identification number, location data, or online identifier.
• "Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
• "User," "you" means any natural person who registers for or uses the Services.
• "Sub-processor" / "Service Provider" means a third party engaged by Rendezvous to process Personal Data on our behalf and under our instructions, as listed in Annex III.
• "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation), including as incorporated into UK law ("UK GDPR").
• "CCPA/CPRA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.

2. Who We Are and Our Role

Rendezvous is a consumer service provided directly to individual users. For the Personal Data described in this Policy, Rendezvous acts as the data controller (or "business" under the CCPA/CPRA): we determine how and why your Personal Data is processed. Our Sub-processors act on our documented instructions.

3. Information We Collect

3.1 Profile & Identity Information

When you register, we collect: first name, last name, and preferred name; email address (your login credential and unique identifier); phone number; an automatically assigned User ID (UUID); employer/airline name, job title, IATA airline code, and base airport(s); aircraft types and commuter status. This builds your profile, helps other verified crew find you, and supports professional verification. Verification may involve documents you choose to submit, such as bid awards or proof of employment.

3.2 Flight Schedule Information

If you choose to use schedule syncing and layover matching, you may upload or enter: flight numbers, departure/arrival airports, dates, and times; pairing numbers, trip IDs, block hours, and Time Away From Base (TAFB); check-in times and related documents (e.g., bid award PDFs or screenshots). We use this solely to match overlapping layovers with your friends and other users, verify flights, and power "know before you go" features. Sharing your schedule is optional; without it, matching features will be limited.

3.3 Account Settings & Authentication

Profile and banner images; privacy preferences; verification status; account creation and last-seen timestamps; login credentials and authentication tokens. If you enable Face ID / Touch ID, the biometric template never leaves your device — we receive only the pass/fail authentication result, never raw biometric data.

3.4 Social & Communication Data

Friend requests, connections, and relationship timestamps; direct messages, group chats, delivery/read status, and media attachments; group memberships and roles; typing indicators, presence, and notification activity.

3.5 Location & Activity Data

Only with your device-level permission: current location (while the app is in use) for meetup verification; location tags you attach to posts; flight location/route information used for validation. We also collect app activity logs, device and session information, IP address, and feature usage to improve performance, secure the Services, and detect misuse. You can revoke location access at any time in your device settings.

3.6 Content & Media

Posts, captions, comments, and likes; photos and videos you upload; users you tag; documents you upload (schedules, bid awards) and their file metadata.

3.7 Payment Information

If you purchase a subscription or other paid feature, payment is processed by the applicable app store (Apple App Store or Google Play) or payment processor. Rendezvous does not receive or store your full payment card details; we receive confirmation of the transaction and subscription status.

3.8 Cookies & Similar Technologies (Website)

Our website may use strictly necessary cookies (for security and core functionality) and, if enabled, basic analytics cookies to understand aggregate site usage. We do not use advertising cookies or cross-site tracking, and we do not respond differently to "Do Not Track" signals because we do not track users across third-party sites.

4. How We Use Your Information and Legal Bases

We use the information above to:

• Provide, personalize, and improve the Services (GDPR legal basis: performance of a contract, Art. 6(1)(b));
• Sync and verify flight schedules and surface overlapping layovers (contract; and consent for optional features, Art. 6(1)(a));
• Deliver secure authentication and account management (contract; legitimate interests, Art. 6(1)(f));
• Enable messaging, social networking, and in-person meetup verification (contract);
• Maintain community standards, verify professional eligibility, and protect user safety (legitimate interests; legal obligation, Art. 6(1)(c));
• Communicate with you about service updates, new features, security notices, and account issues (contract; legitimate interests);
• Send optional marketing communications — emails (unsubscribe anytime via the link in each email) and, only with your separate express opt-in, marketing text messages per Section 5.2 (consent, Art. 6(1)(a));
• Detect, investigate, and prevent fraud, abuse, and security incidents (legitimate interests; legal obligation);
• Comply with legal obligations and enforce our Terms (legal obligation).

We do not use your Personal Data for third-party advertising, we do not build advertising profiles about you, and we do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.

5. Text Messages (SMS)

We offer two kinds of text messages, each with its own consent:

5.1 Security & Critical Service Texts. If you provide your phone number, you agree that Rendezvous may send you text messages limited to security alerts and critical service updates (for example, a security patch notice or urgent account issue). Message frequency will be minimal.

5.2 Marketing & Community Texts (Optional). Separately, and only if you expressly opt in (for example, by checking the marketing texts box at signup or enabling it in Settings), Rendezvous may send you recurring promotional and community text messages — such as new Deal Room offers, feature launches, and event or meetup announcements. Marketing consent is entirely optional, is not a condition of using the Services or of purchasing anything, and is separate from your consent to security texts. You can withdraw marketing consent at any time in Settings or by replying STOP.

5.3 Terms for All Texts. Message and data rates may apply. Reply STOP to opt out (replying STOP to a marketing message stops marketing texts; we will confirm your opt-out with one final message) and HELP for help. Opting out does not affect your account. Rendezvous will never call you unsolicited or ask for your password; be skeptical of anyone claiming otherwise. Our official support channel is support@gotrendezvous.com. Carriers are not liable for delayed or undelivered messages.

6. How We Share Information

We never sell your Personal Data. We share it only as follows:

6.1 Service Providers (Sub-processors). We share data with the categories of providers listed in Annex III, which process it on our instructions to operate Rendezvous — real-time chat, database and storage, push notifications, document parsing, flight verification, and SMS delivery. All providers are bound by contractual obligations, must maintain modern security standards (including encryption in transit and at rest), and may not use your data for their own purposes, resell it, or use it for advertising. We will update Annex III if provider categories change; material changes will be reflected in an updated Policy.

6.2 Other Users. Your profile, posts, and content are visible to other users according to your privacy settings. Schedule and layover overlap information is surfaced only per the matching features you enable. Messages you send are visible to their recipients and may remain visible to them after you delete your account.

6.3 Legal and Safety. We may disclose information if required by law, regulation, legal process, or enforceable government request; to enforce our Terms; or to protect the rights, property, or safety of Rendezvous, our users, or the public.

6.4 Business Transfers. If Rendezvous is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your Personal Data.

6.5 Third-Party Links. The Services may contain links to third-party sites (for example, a partner's store in the Deal Room). This Policy does not apply to those sites; review their privacy policies.

7. International Data Transfers

Rendezvous is operated from the United States, and your information is processed and stored in the U.S. and in the countries where our Sub-processors operate. Data protection laws in these countries may differ from those of your home jurisdiction. Where we transfer Personal Data of users located in the European Economic Area, the United Kingdom, or Switzerland to countries not deemed adequate, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable) with our Sub-processors, together with supplementary technical measures such as encryption in transit and at rest.

8. Security

We take a layered, industry-standard approach to protecting your data:

• On your device: biometric templates remain in your device's secure enclave/Keychain and are never transmitted; privacy settings and preferences are stored in secure device storage; cached images and documents are protected by device-level security.
• In transit: all data exchanged between your device and our servers is encrypted (HTTPS/TLS); requests are authenticated with signed tokens (JWT) so only authorized sessions can access data.
• At rest: data is stored with our hosting provider using modern encryption, access controls, and redundancy protocols; records are keyed by UUID.
• Operationally: backend access is restricted to authorized personnel under role-based permissions; we monitor for unusual activity patterns; we apply software and infrastructure updates to patch vulnerabilities; personnel with data access are bound by confidentiality obligations; our Sub-processors are required to maintain security standards aligned with this Policy.

No system is 100% secure. You play a role too: use a strong unique password, keep your device locked and updated, don't share credentials, and notify us immediately at support@gotrendezvous.com if you suspect unauthorized access.

9. Data Breach Notification

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to your Personal Data, we will notify affected users and applicable regulators without undue delay, consistent with applicable law, and will provide information reasonably needed to understand the incident and the steps we are taking to investigate, mitigate, and remediate it.

10. Data Retention

• Account information: retained while your account is active; removed or anonymized within a reasonable period after deletion, except where law requires retention.
• Messages & connections: retained while your account is active. Messages you sent may remain visible to recipients after you close your account.
• Schedules & documents: retained until you delete them or close your account; limited metadata may persist for operational and audit purposes.
• Activity & security logs: typically retained 12–24 months for security and fraud prevention, then archived or deleted.
• Backups: deleted data may persist in encrypted backups for a limited retention cycle before being securely overwritten; backups exist for disaster recovery only.
• Legal records: retained longer where required by law.

Further detail appears in Annex I.

11. Your Rights and Choices

All users may: access, correct, or update profile information in the app; delete content they posted; revoke device permissions (location, camera, photos, notifications) in system settings; opt out of texts (reply STOP) and marketing emails (unsubscribe link); and delete their account, which removes or anonymizes Personal Data as described in Section 10.

Users in the EEA, UK, and Switzerland additionally have the right to: access their Personal Data and receive a copy; rectify inaccurate data; erasure ("right to be forgotten"); restrict or object to processing, including any processing based on legitimate interests; data portability; withdraw consent at any time (without affecting prior processing); and lodge a complaint with their local supervisory authority. We do not carry out automated decision-making producing legal or similarly significant effects.

California residents: see Annex IV.

To exercise any right, email support@gotrendezvous.com. We will verify your identity (typically via your account email) and respond within the timeframe required by applicable law (45 days under the CCPA/CPRA, extendable once; one month under the GDPR, extendable by two months for complex requests). You may designate an authorized agent to act on your behalf.

12. Children

The Services are intended for users 18 and older. We do not knowingly collect Personal Data from anyone under 18. If we learn we have, we will delete it promptly. Contact support@gotrendezvous.com if you believe a minor has provided us data.

13. Data Protection Contact

Rendezvous has designated a privacy administrator reachable at admin@gotrendezvous.com for data protection matters. General privacy questions, requests, and complaints may be sent to support@gotrendezvous.com.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, notify you by email or in-app notice before the changes take effect. Continued use after the effective date constitutes acceptance. If you do not agree with a change, stop using the Services and delete your account.

15. Contact Us

Rendezvous App LLC

30 N Gould St, Ste R, Sheridan, WY 82801, USA

Privacy requests & support: support@gotrendezvous.com

Data protection contact: admin@gotrendezvous.com

ANNEX I — Retention Detail

Data Category	Retention Period
Core profile data (name, email, UUID, professional details)	Life of account; deleted or anonymized within a reasonable period after account deletion
Chat messages & group conversations	Life of account; copies may remain visible to conversation participants after account closure
Friend connections & relationship data	Life of account
Uploaded schedules, bid awards & documents	Until deleted by you or upon account closure; limited file metadata may persist for operations/audit
Login, session, location-verification & app interaction logs	Approximately 12–24 months, then archived or deleted
Encrypted system backups	Limited backup cycle, then securely overwritten; disaster recovery only
Legal & compliance records	As required by applicable law or lawful requests

ANNEX II — Technical and Organizational Measures

Device-level measures: biometric authentication templates stored exclusively on-device (secure enclave/Keychain, accessible only when the device is unlocked); Rendezvous receives only pass/fail results; local preferences held in secure device storage; cached media protected by device-level security.

Encryption & transmission: HTTPS/TLS encryption for all client-server traffic; JSON Web Token (JWT) session authentication; encryption at rest via our hosting provider's infrastructure.

Access control: role-based access to backend systems limited to authorized personnel; unique identifiers (UUIDs) for accounts and records; confidentiality obligations for all personnel with data access; access rights reviewed and withdrawn when no longer required.

Monitoring & resilience: monitoring for unusual activity and potential misuse; software and infrastructure updates to remediate vulnerabilities; redundant, backed-up storage with restoration capability; Sub-processors contractually required to maintain aligned security standards.

ANNEX III — Categories of Service Providers (Sub-processors)

Service Provider Category	Purpose	Data Involved
Cloud database & storage provider	Primary backend database & storage	Account details, posts, connections, messages, flight documents, media
Real-time messaging infrastructure provider	Real-time chat & presence	User profiles, messages, delivery/read status, online activity
Push notification & app stability services (analytics and advertising services disabled)	Push notifications & crash monitoring	Device identifiers, notification payloads
Document-parsing AI service provider	Parsing/extraction of schedule text from documents you submit	Only documents submitted for parsing
Flight data verification service	Flight number, route & schedule verification	Flight details necessary for validation
Email & text-message delivery platform	Delivery of emails (account and marketing) and text messages per Section 5, including marketing texts sent only to users who opt in	Email address, name, phone number, message content, engagement data
App store payment processors	Payment processing for subscriptions	Transaction confirmations, subscription status (no card details shared with us)

Each provider is bound by contract to process data only on our instructions, maintain modern security standards, and never use your data for its own purposes or for advertising. We will update this Annex if provider categories change. A current list of named providers is available to enterprise partners under a data processing agreement, and to users on legitimate request at support@gotrendezvous.com.

ANNEX IV — California Privacy Rights Addendum (CCPA/CPRA)

Scope. This Addendum supplements the Policy and applies solely to California residents.

Categories of Personal Information collected in the past 12 months:

• Identifiers: name, email address, phone number, UUID, account credentials, IP address.
• Professional or employment-related information: airline, job title, IATA code, base airports, aircraft types, verification documents you submit.
• Internet or other electronic network activity: app usage logs, device and session information.
• Geolocation data: approximate and, with permission, precise location for meetup verification and location tags.
• Audio, electronic, visual information: photos, videos, and media you upload.
• Commercial information: subscription status and transaction confirmations.

We do not collect: protected classifications, raw biometric identifiers (biometric templates never leave your device), or education information. We do not use Personal Information to build inference profiles for advertising.

Purposes. As described in Section 4: providing and improving the Services, schedule matching, security and fraud prevention, communications, and legal compliance.

No Sale or Sharing. We do not sell Personal Information, and we do not "share" Personal Information for cross-context behavioral advertising as defined by the CPRA. We have not done so in the preceding 12 months. We do not use or disclose sensitive Personal Information for purposes requiring a right to limit. Because we do not sell or share, no opt-out is required; should this ever change, we will update this Policy and provide the required opt-out mechanisms first.

Your rights. To know/access, delete, correct, and non-discrimination for exercising rights. Submit requests to support@gotrendezvous.com with the subject "California Privacy Request." We verify requests via your account email; an authorized agent may act for you with written permission. We will respond within 45 days (extendable once by 45 days with notice).