Subprocessors and recipients

Effective: 3 October 2026Version: 1.3

All legal documents
On this page

This page lists, item by item, who receives personal data while the Service operates, in what role, where they store it, and on what legal basis anything leaves the European Economic Area. A generic reference to "third parties" is not enough under Hungarian supervisory practice: every provider must be named with its address and its concrete activity. Purposes and legal bases of processing are set out in the Privacy Policy.

The In short summaries are informational and are there to help you follow the section. The full text always prevails legally.

This document is available in Hungarian and English. In case of any discrepancy, the Hungarian version prevails, except where the English version is more favourable to a Consumer.

1. Why the roles differ

In shortNot every recipient is a processor. Anyone who also decides its own purposes is an independent controller and acts under its own policy.

Recipients fall into three groups, and the difference is substantive:

Processor
May process data only on the documented instructions of the Provider, under an Article 28 GDPR agreement, and never for its own purposes. Supabase, Vercel, OpenAI, PostHog, Google Ireland, Resend, Formspree and GitHub (encrypted backups) fall here.
Independent controller
Also decides its own purposes and acts under its own privacy policy, over which the Provider has no control. The merchant of record, Google LLC at sign-in, and Telegram for the operator's error alerts fall here.
Joint controller
Jointly determines purposes and means with the Provider for the collection and transmission step (Article 26 GDPR). Meta falls here for the advertising pixel.

2. The list of providers

In shortEight processors plus four independent or joint controllers. Primary storage sits in the European Union wherever that is technically possible.
  • Provider
    Supabase, Inc.
    970 Toa Payoh North, Singapore 318992
    supabase.com/privacy
    Role
    Processor
    What it does
    Database and authentication infrastructure: the account, wedding profile, guest list and all uploaded content live here.
    Where data is stored
    European Union, Frankfurt (Germany)
    Transfer basis
    SCCs (2021/914/EU)
  • Provider
    Vercel Inc.
    340 Pine Street, Suite 701, San Francisco, CA 94104, USA
    vercel.com/legal/privacy-policy
    Role
    Processor
    What it does
    Application runtime, content delivery, technical logging and cookieless, aggregated visit analytics (Web Analytics).
    Where data is stored
    European Union, fra1 region
    Transfer basis
    SCCs (2021/914/EU)
  • Provider
    OpenAI Ireland Ltd
    The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
    openai.com/policies/privacy-policy
    Role
    Processor
    What it does
    Language processing behind the AI features (the contracting entity for customers in the EEA; processing is carried out with OpenAI group companies). Only the text you supply for a given request is sent (for the cultural advisor, with your explicit consent, also the couple's cultural and religious background). Under its own API policy OpenAI does not use API customer data for model training; by default it keeps requests for abuse monitoring for up to 30 days, unless longer retention is required by law.
    Where data is stored
    United States
    Transfer basis
    SCCs (2021/914/EU) in OpenAI's data processing addendum
  • Provider
    PostHog, Inc.
    2261 Market Street #4008, San Francisco, CA 94114, USA
    posthog.com/privacy
    Role
    Processor
    What it does
    Product analytics: which features are used and where people get stuck. Runs in identified mode only and does not track anonymous visitors.
    Where data is stored
    European Union, Frankfurt (Germany)
    Transfer basis
    SCCs (2021/914/EU)
  • Provider
    Google Ireland Limited
    Gordon House, Barrow Street, Dublin 4, Ireland
    policies.google.com/privacy
    Role
    Processor
    What it does
    Google Analytics 4 web analytics. Loads only after marketing consent. Pages whose URL carries an invitation or upload token are excluded from measurement.
    Where data is stored
    European Union and United States
    Transfer basis
    SCCs; onward transfer to Google LLC under the EU-US Data Privacy Framework
  • Provider
    Resend, Inc.
    2261 Market Street #5039, San Francisco, CA 94114, USA
    resend.com/legal/privacy-policy
    Role
    Processor
    What it does
    Delivery of transactional email (sign-up confirmation, password reset, account notices). It receives the recipient address and the message body; no newsletters are sent through it.
    Where data is stored
    United States
    Transfer basis
    SCCs (2021/914/EU)
  • Provider
    Formspree, Inc.
    United States
    formspree.io/legal/privacy-policy
    Role
    Processor
    What it does
    Receives the name, email address, subject and message sent through the contact form, forwards them to the Provider by email, and keeps a copy in its dashboard for the period set by its service terms. If you prefer not to use it, you can email the address shown on the Contact page directly.
    Where data is stored
    United States (Amazon Web Services infrastructure)
    Transfer basis
    SCCs (2021/914/EU)
  • Provider
    GitHub, Inc.
    88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA
    docs.github.com/site-policy
    Role
    Processor
    What it does
    Stores the daily encrypted backup of the database and the uploaded files (14 daily copies, 6 monthly archives, no version history). The files are encrypted with AES-256 before upload, and GitHub does not have the key.
    Where data is stored
    United States
    Transfer basis
    SCCs (2021/914/EU) in GitHub's data protection agreement
  • Provider
    Sold through Link, LLC (formerly Lemon Squeezy, LLC)
    222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA
    lemonsqueezy.com/privacy
    Role
    Independent controller
    What it does
    Merchant of record: it concludes the purchase in its own name, issues the invoice and handles card data under PCI-DSS. The Provider only receives subscription status and identifiers.
    Where data is stored
    United States
    Transfer basis
    SCCs (2021/914/EU)
  • Provider
    Google LLC
    1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
    policies.google.com/privacy
    Role
    Independent controller
    What it does
    Google sign-in (OAuth). The Provider stores only the returned identifier and email address. This route is optional: email and password work too.
    Where data is stored
    United States
    Transfer basis
    EU-US Data Privacy Framework (certified recipient)
  • Provider
    Telegram Messenger Inc.
    EU representative: EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium
    telegram.org/privacy
    Role
    Independent controller
    What it does
    Delivers the operator's immediate alerts about server errors. The alert contains the error text and the name of the operation; identifiers appear only as an irreversible 8-character digest, and email addresses are replaced before sending. The alert is designed to minimise personal data, but an error text can occasionally contain a detail such as a name.
    Where data is stored
    European Union (Netherlands) for accounts in the EEA; the company is established outside the EEA
    Transfer basis
    Telegram offers no processing agreement or transfer clauses; we rely on minimisation (Section 3)
  • Provider
    Meta Platforms Ireland Limited
    Merrion Road, Dublin 4, D04 X2K5, Ireland
    facebook.com/privacy/policy
    Role
    Joint controller (Article 26 GDPR)
    What it does
    Advertising pixel measuring Facebook and Instagram campaigns. Joint controllership covers only the collection and transmission of data through the pixel; Meta decides any further processing itself, under its own policy. Loads only after marketing consent; without consent no request reaches Meta at all.
    Where data is stored
    European Union and United States
    Transfer basis
    SCCs; onward transfer to Meta Platforms, Inc. under the EU-US Data Privacy Framework

No external QR code generator appears on this list: QR codes for share links are produced by the Service on its own endpoint, so tokenised URLs never leave the server. No error tracking service (such as Sentry) is in use either.

3. Transfers outside the EEA

In shortStandard Contractual Clauses are the primary basis; for certified US recipients the Data Privacy Framework applies. A transfer impact assessment is documented for each recipient.

Several recipients above are established in the United States or can access data from there. Primary storage is in the European Union (Supabase and PostHog: Frankfurt; Vercel: EU region), but access from the US is itself a transfer, so a legal basis is stated for each.

  • Standard Contractual Clauses (SCCs). The primary basis is the set of clauses adopted by Commission Implementing Decision (EU) 2021/914, together with the supplementary measures expected by the European Data Protection Board: encryption in transit and at rest, EU storage, and minimisation of the data transferred.
  • EU-US Data Privacy Framework. Where the US recipient is certified for the relevant data (Google LLC, Meta Platforms, Inc.), the Commission adequacy decision (EU) 2023/1795 is relied upon; we check the certification on the official list and review it periodically. Where the recipient has also signed the SCCs, they remain available as a contractual fallback; if the adequacy decision or a certification ceased to apply, we would reassess the transfer and rely on the SCCs or suspend it.
  • Consent for marketing tools. Google Analytics 4 and the Meta pixel are activated only after consent given on the cookie banner. That consent covers the use of cookies and the processing purposes; it is not used as a transfer basis, which is stated in the table for each recipient.
  • Telegram. Telegram offers no processing agreement or transfer clauses. The alerts are therefore designed to minimise personal data: email addresses, tokens, quoted values and database key values are replaced before sending, and identifiers appear only as an irreversible digest; a name can still appear only rarely, in an unusual error text. We keep this channel under review (Privacy Policy 2.7).

A transfer impact assessment is documented for each recipient and is available on request. Its main finding: the Service does not intentionally transfer special category data under Article 9 GDPR, with one exception, the cultural advisor, which, with your explicit and separate consent, also sends the couple's cultural and religious background to OpenAI (Privacy Policy 2.2). That processing is based on explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR, and the transfer is safeguarded by the SCCs and the supplementary measures above. Free-text fields and photographs can still contain such data where a user enters it (Data Processing Terms, Section 1). Otherwise storage is in the European Union wherever technically possible, and access is limited to what running the service requires. If we become aware that a transfer no longer has a valid legal basis, we promptly assess the situation, take remedial measures, suspend the transfer where necessary, and inform affected users where it materially affects them or their data.

4. Changes to this list

In shortWe give at least 15 days notice before adding a new provider, and you can object.

Under Article 28(2) GDPR, if the Provider engages a new processor or replaces an existing one, users are notified at least 15 days before the change takes effect, by in-app message or email, and this page is updated.

You may object within 15 days of the notice, stating reasonable data protection grounds, using the contact details in the notice. We consider the objection in good faith and respond before the change takes effect. Where the objection is well founded and we cannot offer a reasonable alternative, you may terminate free of charge before the effective date and export your data under Section 20 of the Terms.