Privacy Notice

Privacy Notice for people who use Tablemeet

Version 10 (DRAFT) · Tablemeet by SISI TECH SOLUTIONS was previously called “Event Scheduler”; only the name has changed. This notice explains what happens with your personal data when you log in to Tablemeet. It is written for the Users of our customers (the people who plan meetings with the app).

1. Who is responsible

Your employer (the company that gave you your account) decides why and how the app is used. Under the GDPR it is the controller of the data in the app, and you should contact it first with questions about your data.
SISI TECH SOLUTIONS SRL, Str. C. C. Arion 11, Et. Parter, Ap. 1, 011081 Bucharest, Sector 1, Romania, contact contact@sisitechsolutions.com, provides the app and processes the data on your employer's behalf as its processor (see the Data Processing Agreement). For the login service and our own records (acceptance of the legal documents, support emails) we act as a controller.
Applicable law: the EU General Data Protection Regulation (GDPR) and Romanian Law no. 190/2018.

2. What data the app stores about you

Your name, email address and role, and whether your account is active.
Your login: password (stored as a hash by our login service), the authenticator devices you set up for two-factor authentication (name of the device and the time it was added; the secret key is held by the login service), and the time of your last login.
Calendar invites sent to customers on your behalf: who received them and when, and the meeting's time and place (never the content of your notes).
What you do in the app: the meetings you book or change, the bullet points, finance notes and discussion notes you write, the people you add as contacts, and an activity log of changes (who did what and when; never the content of your notes).
Notifications about changes to the meetings you attend (who did what to which meeting, and when: for example a booking, a move, a cancellation or new discussion notes; never the content of bullet points, finance or discussion notes) and your notification settings. Notifications are kept for 90 days, then deleted automatically. Unless you switch them off in Notification settings, new bookings, moves and cancellations of your meetings are also emailed to you, at most one email every 10 minutes (company, date, time, place and a link; never note text).
Who is online: while you have the app open, the colleagues of your own company (and SISI TECH SOLUTIONS' platform administrators) can see that you are online right now. Nothing about it is stored: no "last seen", no history.
If you create a calendar feed link, a hashed form of that link and the number of times it was used in the last hour (to limit misuse).
Your acceptance of the legal documents: which version you accepted, when, and for company acceptances your name and job title. No IP address is recorded.
We do not store national identification numbers, payment card numbers or special categories of data about you.

3. Why and on what legal basis

To provide the app to your employer and to you (performance of the contract with your employer; our legitimate interest in running the service).
To keep accounts secure: two-factor authentication, access rules, the activity log (legal obligation to secure personal data and legitimate interest).
To answer support requests (legitimate interest).
To keep evidence that the legal documents were accepted (legitimate interest; legal obligation).

4. Where the data is stored and who receives it

The database, the login service and the file storage are provided by Supabase and located in London, United Kingdom. The UK is covered by the European Commission's adequacy decision, so this transfer is allowed under the GDPR.
The web application is hosted by Netlify. Emails (invites, password resets and notification emails) are sent through Resend from its EU region (Ireland); Resend receives your email address and the email's content. When you send a calendar invite to a customer from Tablemeet, it is sent the same way on your behalf: your name and email address are shown to the customer as the organiser, so that their answer (accept or decline) comes to you.
Your colleagues in the same company see the meetings, contacts and notes in the app according to their roles. Nobody from another customer can see your company's data.
We do not sell personal data and we do not share it with anyone else, unless the law requires it.

5. How long

Your account data: as long as your employer keeps your account, and then until your employer's data is deleted (see the Data Processing Agreement).
Activity log entries and acceptance records that name you: [to be completed] years, as evidence.
Notifications: 90 days, then deleted automatically.
Support emails: [to be completed].

6. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to lodge a complaint with a supervisory authority (in Romania: ANSPDCP, www.dataprotection.ro). For data in the app, please contact your employer's admin first; for the login service or our own records, contact us at contact@sisitechsolutions.com. We answer within one month.

7. Security

Every login needs a password of at least 12 characters. Two-factor authentication (a code from an authenticator app) is available and may be required by your company. Data is encrypted in transit (HTTPS) and at rest by our providers. Access rules are enforced in the database for every request. If a personal data breach affects you, your employer (and, where required, you) will be informed without undue delay.

8. Cookies and local storage

The app stores only what it needs to work. Nothing is used for advertising, analytics or tracking, and no third-party content is embedded in the pages.

Cookies (set by the app itself, on its own domain):

sb-<project>-auth-token (may be split into parts named sb-<project>-auth-token.0, .1, …): your login session, including whether you passed two-factor authentication. Set by the app's server when you log in; kept for up to 400 days but refreshed on each visit and deleted when you log out. Strictly necessary for logging in.
sb-<project>-auth-token-code-verifier: a short-lived security value used only while a password reset link is being processed; deleted right after. Strictly necessary for the password reset you asked for.
es-last-activity: the time of your last activity in the app (clicks, typing, scrolling, page loads), whether you use a computer or a phone, and your user number, so that you are logged out automatically after a period without activity (by default 12 hours on computers and tablets and 7 days on phones), also when the page was closed. Set by the app's server, not readable by scripts in the page; kept for up to 400 days, updated while you use the app and deleted when you log out. Strictly necessary for the security of your login.

Local storage (in your browser, never sent to us):

discussion-draft:<meeting>:<person>: the discussion notes you are typing for a meeting, so that nothing is lost if you go offline or close the page; removed when the note is saved. Strictly necessary for the offline notes you asked for.
bullets-draft:<part>:<meeting>:<person>: the bullet points or finance notes you are typing for a meeting, for the same reason; removed when they are saved.

Session storage, IndexedDB, service workers and offline caches: not used. Notifications arrive over the same secure connection to our database and add nothing to your browser. Open tabs of the app tell each other about your activity directly inside the browser, without storing anything.

Third-party content loaded by the pages: none. Fonts are delivered from our own servers (not from Google); logos are served through the app. The browser talks to our database and login service (supabase.co, London) and, if you click an "Add to calendar" web link, to the calendar site you chose.

9. Changes to this notice

Each version is numbered and dated and stays available in the app. You are asked to confirm that you have read a new version when it changes materially.

10. Contact

SISI TECH SOLUTIONS SRL, Str. C. C. Arion 11, Et. Parter, Ap. 1, 011081 Bucharest, Sector 1, Romania. Email: contact@sisitechsolutions.com. Phone: [to be completed]. Data protection contact: [to be completed].