Privacy Policy

Last Updated: October 2026 • Effective Date: October 2026

At Apollodorus Group, we are committed to safeguarding the confidentiality, integrity, and security of personal data processed through the Reservare application (apollodorus-group.com), in full compliance with Argentine Personal Data Protection Law No. 25.326 and international privacy standards.

1. Data Controller

2. Categories of Data Collected and Processed

• Account Information: Name, business name, registered email (@gmail.com required for Google Calendar sync), contact phone number, password hashed using bcrypt with salt, and authentication logs.
• WhatsApp Cloud API Integration Data: Meta Phone Number ID, WhatsApp Business Account ID (WABA), API tokens, inbound customer messages, timestamps, and phone numbers.
• Google Calendar Data: OAuth 2.0 access and refresh tokens, dedicated calendar ID, free/busy status, and event metadata. Strict Limited Scope: Reservare only accesses events in the dedicated calendar to evaluate availability and insert/manage bookings; under no circumstances does Reservare read Gmail emails, Google Drive files, or personal documents.
• Staff & Collaborator Data: Name, phone, email, professional specialty, and assigned working intervals for team members.
• Customer Appointment Records: Client name, WhatsApp phone number, booked service, scheduled time, assigned specialist or resource, and appointment status.
• Security & Verification Tokens: Ephemeral cryptographic tokens generated for email validation, cancellation confirmation, and security alerts.

3. Purpose Limitation

Personal data is processed strictly for:

• Authenticating and safeguarding the account, blocking brute-force attacks after 5 failed attempts.
• Operating the WhatsApp bot to schedule bookings, propose nearest available alternatives, and handle cancellations.
• Synchronizing appointments in real time with Google Calendar to prevent double bookings.
• Dispatching security alerts regarding sensitive account modifications.
• Managing subscription billing and facilitating statutory service cancellations pursuant to Law 24.240.

4. No Third-Party Data Selling & External Payment Gateways

Apollodorus Group does not sell, rent, or trade personal data. Booking deposits redirect clients to third-party secure payment platforms (such as Mercado Pago). Reservare never collects or stores credit card numbers, CVVs, or sensitive banking credentials.

5. Information Security and Multi-Tenant Isolation

The platform implements TLS encryption in transit for all HTTP/HTTPS communication, HTTP-only secure session cookies, bcrypt password hashing, and strict database multi-tenant isolation by client ID.

6. Data Subject Rights & Supervisory Authority (Law 25.326)

Data subjects may exercise their rights of access, rectification, update, and erasure free of charge by contacting privacy@apollodorus-group.com.

Notice is given that the Agencia de Acceso a la Información Pública (AAIP), in its capacity as the Supervisory Authority of Law No. 25.326, has the power to hear reports and claims regarding compliance with personal data protection regulations.

7. Data Protection Officer (DPO) & Brazilian LGPD Encarregado

In compliance with Article 37 of the EU General Data Protection Regulation (GDPR) and Article 41 of the Brazilian General Data Protection Law (LGPD - Lei 13.709/2018), Apollodorus Group has designated a Data Protection Officer (DPO / Encarregado). You may contact the DPO at: dpo@apollodorus-group.com or privacy@apollodorus-group.com.

8. Legal Bases for Data Processing

Personal data processing is carried out pursuant to the following legal bases:

• Contract Performance (GDPR Art. 6.1.b / LGPD Art. 7.V): Necessary to fulfill booking services, scheduling, and calendar synchronization.
• Legal Compliance (GDPR Art. 6.1.c / LGPD Art. 7.II): To fulfill statutory tax, consumer protection (Law 24.240 Botón de Baja), and administrative obligations.
• Legitimate Interests (GDPR Art. 6.1.f / LGPD Art. 7.IX): For fraud prevention, security lockout against brute-force attacks, and maintaining audit trails.
• Consent (GDPR Art. 6.1.a / LGPD Art. 7.I): For optional external integrations (WhatsApp Business Cloud API and Google Calendar OAuth 2.0).

9. International Data Transfers & Standard Contractual Clauses (SCCs)

To provide automated WhatsApp communications and calendar synchronization, essential data is transferred to infrastructure providers in the United States: Meta Platforms Inc. (WhatsApp Cloud API) and Google LLC (Google Calendar API). These cross-border transfers are safeguarded by Standard Contractual Clauses (SCCs) adopted by the European Commission and equivalent international transfer mechanisms under the LGPD and Argentine Law 25.326.

10. Data Retention and Erasure

Account data is retained while the business account remains active. Security audit logs are maintained for up to twelve (12) months for compliance and threat detection. Upon confirmed account cancellation or erasure request, customer personal data is securely purged from production databases within thirty (30) days, except where statutory retention obligations apply.

11. Cookies and Local Storage Policy (EU ePrivacy Directive 2002/58/EC & GDPR)

Reservare strictly uses technical session cookies and essential browser local storage solely required for account security (HTTP-only, SameSite authenticated tokens), anti-CSRF request validation, and user interface preferences (dark/light theme and language selection). Reservare does NOT employ third-party advertising cookies, behavioural tracking pixels, or data profiling mechanisms.