Privacy Policy

1. Who we are

Weddooit ("Weddooit", "we") runs weddooit.com, app.weddooit.com and the couples' wedding sites at <name>.weddooit.com. We're responsible for your personal data as this policy describes. You can reach us at hello@weddooit.com.

2. What data we handle

• Couples: your email address, the language you choose and, if you sign in with Google, the name and profile picture Google shares with us. Everything you add to your wedding site: your names, story, dates, places, photos, gift list, guest list, invitations and table plan.
• Guests: what you send when you reply (name, email if you give it, whether you're coming, how many of you, dietary needs, a message and a song request); the contact details the couple adds to invite you (name, phone, email); when your invitation was sent and opened; your table; and, if you give a gift, your name, message and amount. Card details go straight to Stripe and never reach us.
• Everyone: the technical data needed to run the service securely, such as your IP address and browser type, and the cookies described in our Cookie Policy. For replies we only keep a salted, one-way hash of your IP address, used to stop spam.

3. Dietary needs

Dietary needs can reveal information about health or religion. Only write what you're comfortable sharing. By writing it you consent to the couple receiving it to plan the meal; only they can see it, and you can ask for it to be deleted at any time.

4. Why we use it, and on what legal basis

• To provide Weddooit to couples (account, site, editor, invitations, replies, table plan and gifts): performance of our contract with them (article 6.1.b GDPR).
• To collect guests' replies and gifts and pass them to the couple: the legitimate interest of the couple and the guest in organising the wedding (article 6.1.f GDPR), and your explicit consent for dietary needs (article 9.2.a GDPR).
• To take payments and keep invoices and tax records: legal obligation (article 6.1.c GDPR).
• To keep the service secure and prevent fraud and spam: our legitimate interest (article 6.1.f GDPR).
• To send service emails such as sign-in links and account notices: performance of the contract. We never send marketing emails without your consent.

5. The couple's role

Each couple decides whom to invite and what to ask their guests. For guest data, we act on the couple's instructions to run their site. If you're a guest and have a question about your data, you can ask the couple or write to us, and we'll help.

6. Who can see it

A published wedding site can be seen by anyone who has its address; it's hidden from search engines. Photos uploaded to a site are public at their address. Guests' replies, contact details and gift messages are only visible to the couple. A guest with a personal invitation also sees the names of the people at their own table.

7. Who we share it with

We use these providers to run Weddooit. They only process data on our instructions and under contracts that protect it:

• Supabase: database, file storage and sign-in, with servers in the European Union (Ireland).
• Cloudflare: hosting and network security.
• Stripe: payments, payouts and invoices. For payments Stripe is also an independent controller: https://stripe.com/privacy
• Google: only if you choose to sign in with Google.
• Our email provider: to deliver sign-in links and account notices.

8. What we never do

We don't sell personal data, we don't share it for advertising and we don't use it to profile you. We only disclose data to authorities when the law requires it.

9. Transfers outside the EU

Some providers (Cloudflare, Stripe and Google) may process data outside the European Economic Area. When they do, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

10. How long we keep it

• Wedding sites and everything in them, including guest data: until the couple deletes them, and no later than 12 months after the wedding date.
• Couple accounts: while the account is open. We delete them on request.
• Payment and invoice records: for as long as tax and accounting law requires (generally six years in Spain).
• Technical logs: a few days.

11. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to hello@weddooit.com and we'll answer within one month. If you're not happy with our answer, you can complain to the Spanish Data Protection Agency (AEPD): https://www.aepd.es

12. Signing in with Google

If you sign in with Google, we receive only your name, email address and profile picture, and we use them only to create your Weddooit account and sign you in. We don't use Google user data for advertising, we don't sell it, we don't share it with anyone except the providers listed above to run the service, and we don't use it to train AI models. Weddooit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Weddooit's access at any time at https://myaccount.google.com/permissions

13. Security

We encrypt data in transit, keep each couple's data separate with strict access rules, and use providers with recognised security certifications. No system is perfect: if a breach puts your data at risk, we'll tell you and the authorities as the law requires.

14. Children

Weddooit is for adults: couples must be 18 or older. We don't knowingly collect data from children under 14 without their parents' consent.

15. Changes to this policy

If we make a change that matters, we'll email couples before it applies. The date at the top always shows the current version.