Legal document
Privacy Policy
Last updated
This notice describes how Wedira processes the personal data of users of the site and the service, pursuant to EU Regulation 2016/679 (“GDPR”).
1. Data controller
The data controller is Wedira, with registered office at [full address], VAT/Tax ID [VAT number]. For any request regarding personal data, you can write to [privacy contact email].
2. Categories of data processed
- Account data: the organizer's email address and login credentials.
- Event data: title, date, location, texts, images and invitation content uploaded by the organizer.
- Guest data: name and any email, phone number, menu preferences, notes and RSVP responses, entered by the organizer or provided by the guest through the response form. If the organizer activates an AI-based feature (see point 3), a subset of this data may be processed as described in point 5.
- Payment data: handled directly by the payment provider (Stripe). Wedira does not store full card details.
- Technical data: browsing data and technical cookies necessary for the site to function (see Cookie Policy).
- Contact/support request data: name, email, request category and message text, entered through the Contact form. If the sender is already a registered user, the request is linked to their account.
3. Purposes and legal bases
- Providing the service (creating invitations, collecting RSVPs, managing guests) — legal basis: performance of a contract.
- Payment processing — performance of a contract and legal obligations.
- Transactional emails (RSVP confirmations, notifications, reminders) — performance of a contract and legitimate interest.
- Security and abuse prevention — legitimate interest.
- Handling contact and support requests — legitimate interest.
- Legal obligations (e.g. tax) — legal obligation.
- AI-based features (automatic translation of invitation content, generating text variants for the couple's story, personalized opening lines for each guest, seating suggestions) — legal basis: performance of a contract. These features are optional and are activated only by the organizer's explicit action; they are never started automatically.
4. The organizer's role
When an organizer enters their guests' data, they act as an independent data controller for that data and undertake to process it in compliance with applicable regulations, having informed the data subjects. Wedira acts as a data processor on their behalf.
5. Providers and data processors
To provide the service, we rely on providers who process data on our behalf:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and content storage |
| Stripe | Payment processing |
| Resend | Sending transactional emails |
| Vercel | Hosting and distribution of the application |
| Anthropic | AI-based processing of invitation content and some guest data, only for events where the organizer activates one of the AI features listed in point 3 |
When activated by the organizer, the AI features send Anthropic only the data strictly necessary for that specific feature: the invitation's free-text content (the couple's story, schedule, FAQ) for automatic translation and text variant generation; the guest's name, relationship with the couple and any personalization note for personalized opening lines; names, relationships between guests and seating arrangement for seating suggestions. Payment data, email addresses and phone numbers are never sent. Anthropic is based in the United States: the transfer takes place on the basis of the safeguards described in point 7.
6. Data retention
Data is retained for as long as necessary for the stated purposes and, for event data, for the publication period included in the chosen plan, unless otherwise required by law. The organizer may request deletion of their account and related events at any time. Contact/support request data is retained for 24 months from the closing of the ticket, after which it is deleted.
7. Transfers outside the EU
Some providers may process data outside the European Union. In such cases, the transfer takes place on the basis of appropriate safeguards (e.g. Standard Contractual Clauses) as provided by the GDPR.
8. Data subject rights
Data subjects may exercise the rights of access, rectification, erasure, restriction, objection and portability, and may lodge a complaint with the competent data protection authority. To exercise these rights, you can write to [privacy contact email].
9. Changes
This notice may be updated over time. The date above indicates the most recent revision.