Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you create an account and use the Service, we collect:

• Account information: Your name, email address, and password (stored in hashed form).
• Profile information: Any additional details you add to your profile, such as a profile photo.
• Event data: Event names, dates, bride and groom names, and other event details you enter.
• Guest information: Names of guests you add to your guest lists, including their assigned side (e.g., bride or groom) and seating assignments.
• Floor plans and seating arrangements: Table layouts, positions, shapes, and seat configurations you create.
• Invitation card designs: Customization choices including backgrounds, typography, sub-events, and other design settings.
• Payment information: When you purchase a paid plan, payment is processed by Stripe. We store only your Stripe customer ID and the last four digits of your payment method — we never store your full card number or sensitive payment details.

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Session data: Your IP address and user agent string, stored in your session record to maintain your login state.
• Cookies: Essential cookies required to keep you logged in and remember your preferences (such as language and appearance settings). We do not use advertising cookies.
• Analytics data: We use Google Analytics to collect anonymous usage data such as pages visited, time spent on pages, referring websites, browser type, device type, and approximate geographic location (derived from your IP address). Google Analytics uses cookies to distinguish unique users and sessions. Your IP address is anonymized before it is stored. This data is used solely to understand how our Service is used and to improve it.

1.3 Information from Third Parties

If you sign in using Google, we receive your name, email address, and profile photo from Google, as permitted by your Google account settings. We do not access any other data from your Google account.

2. How We Use Your Information

We use your information solely for the following purposes:

• Providing the Service: To create and manage your events, floor plans, guest lists, seating charts, and invitation cards.
• Account management: To authenticate your identity, manage your account, and communicate with you about your account (e.g., email verification, password resets).
• Payment processing: To process purchases of paid plans through our payment provider (Stripe).
• Shared links: To display event information to people you share your event link with.
• Service improvement: To understand how the Service is used and make improvements. We do not use your personal event data for analytics — only aggregate, non-identifying usage patterns.
• Security: To detect and prevent fraud, abuse, and unauthorized access.

3. How We Share Your Information

We may share limited information in the following circumstances:

• Payment processing: We share necessary transaction data with Stripe to process your payments. Stripe's handling of your data is governed by Stripe's Privacy Policy.
• Shared event links: When you generate a share link for your event, anyone with that link can view the shared event details (such as the seating plan and guest names). You control whether sharing is enabled and can revoke access at any time.
• Legal requirements: We may disclose your information if required by law, legal process, or government request, or to protect our rights, safety, or property.
• Analytics: We use Google Analytics to collect anonymous usage data about how visitors interact with the Service. Google may process your IP address (anonymized), browser type, and browsing behavior. See Google's Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Security services: We use Cloudflare Turnstile for bot protection during registration. This service may process your IP address and browser information. See Cloudflare's Privacy Policy.

4. Data Storage and Security

Your data is stored on secure servers. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Passwords are hashed using industry-standard algorithms (bcrypt) — we never store passwords in plain text
• Two-factor authentication (2FA) is available for additional account security
• Session data is encrypted
• HTTPS encryption for all data in transit

While we take reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal data for as long as your account is active and as needed to provide the Service. Specifically:

• Account data: Retained until you delete your account.
• Event data: Retained until you delete the event or your account.
• Payment records: Retained as required by applicable tax and financial regulations.
• Session data: Automatically expired and cleared based on session lifetime settings.

When you delete your account, all associated data (events, guest lists, floor plans, seating arrangements, and invitation card settings) is permanently deleted from our systems.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: You can view all your personal data through your account settings and event pages.
• Correction: You can update your personal information at any time through your account settings.
• Deletion: You can delete individual events or your entire account. Account deletion permanently removes all associated data.
• Data portability: You can export your seating plans and event data as images.
• Withdrawal of consent: Where we process data based on your consent, you may withdraw that consent at any time.

To exercise any of these rights, you can use the relevant features in your account settings or contact us at the email address below.

7. Cookies

We use the following types of cookies:

Essential Cookies

• Session cookie: Keeps you logged in during your browsing session.
• CSRF token: Protects against cross-site request forgery attacks.
• Preference cookies: Stores your language and appearance (light/dark mode) preferences.

Analytics Cookies

• Google Analytics cookies (_ga, _ga_*): Used to distinguish unique users and sessions, collect anonymous usage statistics, and understand how visitors interact with the Service. These cookies expire after up to 2 years. You can opt out by installing the Google Analytics Opt-out Browser Add-on.

We do not use any advertising or third-party tracking cookies beyond the analytics cookies described above.

8. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete that information promptly.

9. International Data Transfers

Our servers are located in Europe. If you access the Service from outside Europe, your information may be transferred to, stored, and processed in Europe. By using the Service, you consent to such transfers. We ensure that any data transfers comply with applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. If we make material changes that affect how we handle your personal data, we will notify you via email or through the Service. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, please contact us at [email protected].