Privacy Policy

2.1. Account and identity data#

Data: email address, password (stored only as a bcrypt hash), Google account identifier (if using Google OAuth), registration timestamp, last login timestamp.

Purpose: creating and authenticating your account; providing secure access to the Service. Confirmation and password-reset emails are delivered by Resend, Inc. as a processor (Section 3).

Legal basis: GDPR Art. 6(1)(b) - performance of a contract.

2.2. Wedding profile data#

Data: names of the couple, planned wedding date and venue, estimated guest count, budget, and other planning details you voluntarily provide.

Purpose: powering personalised AI-assisted planning features.

Legal basis: GDPR Art. 6(1)(b) - performance of a contract.

Cultural background and religious note - special category data. You may optionally state the couple's cultural background (which can indicate ethnic origin) and a religious note. These are special categories of data under GDPR Article 9. The only legal basis for processing them is your explicit consent (Art. 9(2)(a) together with Art. 6(1)(a)), which the interface asks for through a separate, unticked checkbox before the fields can be edited. The consent also covers sending these details, together with your names, to OpenAI (United States) when you use the cultural advisor; the transfer basis is described in Section 3 of the Subprocessors page. You can withdraw consent at any time on the Settings page by unticking the box and saving: both fields are erased immediately and the advisor answers in general terms. The fact and time of consent are logged against your account. Without consent the Service is fully usable; only the personalisation of the advisor is unavailable.

2.3. Guest and third-party data#

Data: names of guests you add to the guest list, optionally dietary requirements, seating assignments, and other details you enter.

Purpose: powering the seating chart optimizer and guest management features.

Who plays which role: for this data you are the controller and we are the processor: you decide whose data goes into the system and why. The Article 28 GDPR agreement is set out in the Data Processing Terms.

Legal basis: on your side as controller, typically the consent of the data subject or a legitimate interest in organising the wedding (GDPR Art. 6(1)(a) or (f)). You are responsible for ensuring that you enter guest data with those people's knowledge and in compliance with applicable data protection law.

Sensitive details. The Service does not ask for special category data about guests, but a free-text field or a dietary requirement can still reveal one (an allergy or a condition is health data). Enter such a detail only where you have a valid legal basis and an Article 9 GDPR condition, typically the guest's explicit consent; otherwise record only what planning needs (for example "gluten-free") without the medical reason.

2.4. Vendor data#

Data: names, categories, quotes, contract status and notes for wedding vendors you add. These are typically business data but may include personal data where the vendor is a natural person.

Purpose: powering vendor tracking and AI quote analysis features.

Who plays which role, and on what basis: the vendor records are part of your wedding planning, so towards you we process them under GDPR Art. 6(1)(b) (performance of our contract with you). Where a record contains personal data of a natural person (for example a contact person's name and phone number), you are the controller of that data, and you need your own legal basis, typically a legitimate interest in organising the wedding (Art. 6(1)(f)); we process it as your processor, under the Data Processing Terms.

2.5. Subscription and payment data#

Data: subscription plan type, subscription status (active, expired, cancelled), order and subscription identifiers issued by the merchant of record, payment date and amount.

Purpose: managing paid subscriptions, unlocking plan features, fulfilling statutory accounting obligations.

Legal basis: GDPR Art. 6(1)(b) - performance of a contract; GDPR Art. 6(1)(c) - compliance with a legal obligation (accounting law).

Actual payment card details are handled exclusively by the merchant of record; we never see or store them.

2.6. AI usage data#

Data: timestamps of AI feature use, feature type (e.g. vendor, budget, seating), and your account identifier.

Purpose: preventing abuse, enforcing plan-based rate limits, ensuring Service quality.

Legal basis: GDPR Art. 6(1)(f) - legitimate interests. A legitimate interest assessment has been carried out; a summary is available on request at hello@yourweddingcopilot.com.

2.7. Technical and log data#

Data: IP address, browser type, operating system, access timestamps and pages visited. This data is automatically collected by Supabase and Vercel infrastructure.

Purpose: system security, troubleshooting, abuse prevention.

Legal basis: GDPR Art. 6(1)(f) - legitimate interests.

Error alerts. On a server-side error the operator receives an immediate alert on a messaging channel (Telegram). The alert contains the error text and the name of the operation; the user and wedding identifiers appear only as an irreversible 8-character digest, never as names, email addresses or tokenised links, and email addresses, quoted values and database key values in the error text are replaced before sending. The alert is designed to minimise personal data, but an error text can occasionally still contain a detail such as a name, so Telegram is listed among the recipients on the Subprocessors and recipients page. The full identifier remains only in Vercel's contracted logs.

2.8. Guest page and guest photo collection#

Guest page. If you create a guest page, the details you put on it (your names, the wedding date, the schedule, the venue and address, the menu, and any notes or cover photo you add) become readable by anyone who has the link, once you publish the page. We serve the page with a noindex instruction, exclude it in our robots.txt and never submit it for indexing; we cannot, however, guarantee that a third party who obtains the link will not republish it. A link is not a password: anyone who has it can open the page. You decide what goes on the page and when to publish it, and you can unpublish it at any time.

Contacts. You may add up to five contact people (name, role and phone number) for guests to call on the day. These details are visible on the published guest page to anyone who has the link. They are the personal data of third parties: you decide whether to add and publish them, and you act as controller in this respect. Before publishing, inform the person and publish their details only with their prior knowledge and agreement; you are responsible for having an appropriate legal basis. The interface warns about this at the moment of entry. The person concerned may request removal from you or from us (Section 5).

Stay and travel. If you enable the relevant section, accommodation and transfer details (name, address, phone number, departure time) appear on the guest page. These are typically supplier details. A guest's own room and transfer assignment is only available through their personal invitation link; the guest page never shows where other guests sleep or which trip they are on.

Personal invitation link. You may share a unique, token-bearing link per guest. The token identifies the guest: whoever receives the link can see that guest's RSVP page and, if any, their own assignment. We therefore recommend that you send the link personally and that guests do not share it publicly. Such addresses are excluded from search engines.

Guest photo collection. If you open a photo collection, your guests can upload photos through a link or QR code, without creating an account.

Data collected from guests: the photographs they choose to upload, the name they optionally provide, a random identifier stored in their browser (used only to enforce the per-guest upload limit; it is stored in hashed form and is not used for tracking), and a hashed IP address for abuse protection.

Purpose: collecting the couple's wedding photographs in one place.

Roles and legal basis: the couple decides that a collection exists, whom to invite, how long it stays open and which photographs are kept, so for the photographs and uploader names the couple is the controller and we are their processor, under the Data Processing Terms. Guests upload voluntarily, and the upload page explains before uploading what happens to the pictures; ensuring a lawful basis (typically the uploader's consent, given by uploading) is the couple's responsibility. The hashed IP address and the upload-limit identifier we process as controller for security and abuse prevention, under Art. 6(1)(f) (legitimate interests).

Storage and access: uploaded photographs are stored in a private storage bucket. They are not publicly accessible: the couple views them through short-lived signed links. If a reveal time is set, the photographs stay hidden until then. The couple can hide or delete any uploaded photograph.

Important - who is responsible: the couple decides who is invited to upload, what is displayed on the guest page, and how long the collection stays open. In respect of these decisions the couple acts as the controller and we act as a processor. Anyone who appears in a photograph can ask the couple, or us at hello@yourweddingcopilot.com, to have it removed. Because the couple is the controller, we forward such a request to them; where a photograph can be hidden or deleted without deciding anything about the couple's purposes, we may also take that technical step ourselves without undue delay and inform the couple (Data Processing Terms, Section 3).

2.9. Further data flows you initiate#

Each of the activities below is started by you, and each moves data into or out of the system that the categories above do not cover.

Contact form

Name, email address, subject, message. Purpose: answering your enquiry. Complaints are accepted by email or post under Section 17 of the Terms; a complaint that arrives through the form is handled as a complaint. Legal basis: Art. 6(1)(f) (legitimate interest); for complaints Art. 6(1)(c) (statutory duty under the Hungarian Consumer Protection Act). The form is delivered by Formspree, Inc.; if you prefer not to use it, write directly to the email address in Section 1.

Inviting a co-planner

The invitee's email address and the access token assigned to it. Purpose: enabling shared planning. Legal basis: Art. 6(1)(b). The invitee gets access on your decision, and you can revoke it at any time.

Responses entered directly by guests

On the RSVP page a guest enters their own reply, companion name, dietary preference and message. We store these on your behalf as controller (Section 2.3); the guest may ask you or us for rectification or erasure. The dietary field asks for a preference, and the RSVP page asks guests not to give the medical reason behind it.

Reporting a violation

The content of a report under the Acceptable Use Policy, the reported link, and the reporter's name and contact details if given. Purpose: assessing and documenting the report, informing the parties concerned, and handling a review. Legal basis: Art. 6(1)(c) where the law requires us to handle notices about content we host, otherwise Art. 6(1)(f). We do not pass the reporter's identity to the reported user unless the law requires it. Retention: Section 4.

Contract and quote analysis

The full text of a vendor document you paste or upload is sent to OpenAI for AI analysis (Section 3). The document may contain the vendor's contact person's details; for those you are the controller. The Provider does not retain the document beyond the analysis.

Spreadsheet import (Excel, Google Sheets)

The Service reads the uploaded file or the Google Sheets link you provide and moves its content into the guest list, budget or vendor register. To recognise the columns the AI receives only the headers and up to five masked sample rows (letters and digits substituted), so no real guest data leaves the system. The source file is not kept after import; only the file name, row count and column mapping remain as a log.

2.10. Product usage measurement until the cookie decision (legitimate interest)#

A few named product events (for example: sign-up completed, first vendor added) are measured without consent until you make your choice on the cookie banner. The data processed: the event name and time, the User's internal identifier (UUID) and the page URL stripped of invitation tokens. No email address, name or profile data enters the measurement.

This measurement writes nothing to and reads nothing from your device (no cookie, no local storage), fingerprint-like attributes (screen size, exact versions, timezone) are filtered out, the IP address is discarded by the analytics tool, and storage is in the EU (Frankfurt). Purpose: understanding where users get stuck before their first real use. Legal basis: Article 6(1)(f) GDPR (legitimate interest); the balancing test is available on request.

Choosing Only the necessary on the cookie banner counts as an objection to this measurement (Article 21 GDPR) and stops it immediately and permanently. After consent is given, measurement continues in the consent-based mode described in Section 6. PostHog page view measurement, automatic behaviour capture and any persistent identifier continue to run only with consent; cookieless, aggregated visit counting is described in Section 2.11.

2.11. Cookieless visit counting (legitimate interest)#

We measure page visits with Web Analytics provided by our hosting provider, Vercel Inc., without consent. This measurement writes nothing to and reads nothing from your device (no cookie, no local storage). Data recorded per page view: the time, the page URL stripped of invitation tokens, the referring page, the cleaned URL parameters (for example a campaign identifier), country, region and city level location, the device type, and the name and version of the operating system and browser.

Vercel tells visitors apart by a hash derived from the incoming request, which it discards automatically after 24 hours. We do not link that value to an account or a named person, it cannot be used to follow browsing on other websites, and the data is shown to us in aggregate only. Invitation and upload tokens are removed from URLs before measurement. Purpose: measuring how many visitors arrive and from where (for example which advertisement), because consent-based measurement only sees a small share of visitors. Legal basis: Article 6(1)(f) GDPR (legitimate interest). Vercel acts as a processor, see the list of subprocessors.

Choosing Only the necessary on the cookie banner also counts as an objection to this measurement (Article 21 GDPR) and stops it from the next page view.

5.1. Right of access (Art. 15)#

You may request confirmation of whether we process your personal data and, if so, receive a copy of it along with information about the purposes, legal bases, retention periods and processors involved.

5.2. Right to rectification (Art. 16)#

You may request correction of inaccurate data or completion of incomplete data. You can also update most of your wedding profile data directly in your account settings.

5.3. Right to erasure (Art. 17)#

You may request deletion of your personal data where it is no longer necessary for the original purpose, you withdraw consent, or you object to processing with no overriding legitimate interest. Erasure cannot be fulfilled where retention is legally required.

5.4. Right to restriction of processing (Art. 18)#

You may request that we restrict processing - for example while the accuracy of data is disputed, or while an objection is being assessed. During restriction, data may only be stored, not otherwise used.

5.5. Right to data portability (Art. 20)#

You may receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and transmit it to another controller, where processing is based on consent or contract and carried out by automated means. Separately, Section 20 of the Terms grants a broader contractual right to data extraction and switching. The export is available from the privacy card on the Settings page, as a full JSON file and as a guest-list CSV.

5.6. Right to object (Art. 21)#

You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

5.7. Rights related to automated decision-making (Art. 22)#

The Service uses automated logic only to determine AI access based on your subscription plan. This is necessary for contract performance. You may request human review of such decisions, express your views and contest the outcome at any time. AI output is a suggestion, not a decision: the Service attaches no automatic legal consequence to it.