Privacy Policy

Data controller

[RAGIONE SOCIALE / NOME E INDIRIZZO DEL TITOLARE — DA COMPLETARE]. For any request about your data, write to daniele.stumpo@gmail.com.

What data we process

• Organizer account: email, password (stored in protected form by our authentication provider), organization name.
• Guest data entered by the organizer or by guests themselves through the RSVP form: names, answers to the form questions (defined by the organizer).
• Content uploaded to the gallery and guestbook: photos, videos, audio/video messages, with the uploader's optional name.
• Event contacts and locations entered by the organizer (names, photos, phone, email, addresses).
• Technical data: IP address (in infrastructure logs and for anti-abuse limits), a random device identifier stored in the browser for photo reactions (guests don't need an account).

Why we process it (purposes and legal bases)

• Providing the requested service — creating the event, showing the invitation, collecting RSVPs, hosting the gallery (Art. 6(1)(b) GDPR, performance of a contract).
• Security and abuse prevention — upload limits, per-IP rate limiting, technical logs (Art. 6(1)(f) GDPR, legitimate interest).
• Legal obligations — e.g. tax obligations on purchases (Art. 6(1)(c) GDPR).
• Service communications — transactional emails such as gallery storage alerts; no marketing emails.

The organizer's role

For the data of their guests (names, RSVP answers, photos of attendees) the event organizer acts as an independent data controller: they decide what data their RSVP form collects and whom to invite. We process that data on their behalf as a data processor (Art. 28 GDPR), exclusively to provide the service.

If you are a guest and want content about you removed, you can contact the event organizer (who has moderation and deletion tools) or write to us directly.

Where data is stored

Database and files (photos, videos, audio) are hosted on Supabase in the Frankfurt region (European Union). The application is served by Vercel; anti-abuse limits use Upstash. Some providers are US companies operating under the GDPR safeguards for transfers outside the EU (standard contractual clauses).

Online payments, when available, will be handled by the payment provider Stripe: full card details never reach our servers.

How long we keep data

• Gallery and guestbook content: for the validity of the purchased package (1 year from storage activation). After expiry, following a 30-day grace period, photos, videos and messages are permanently and automatically deleted.
• What you delete manually (invitations, guests, photos…) is first hidden and recoverable for a period, then permanently removed when the package expires.
• Account data: for as long as the account is active. You can request deletion by writing to us.
• Technical logs and anti-abuse data: for short technical periods defined by the infrastructure providers.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (Arts. 15–22 GDPR). Exercise them by writing to daniele.stumpo@gmail.com. You also have the right to lodge a complaint with your supervisory authority.

Minors

The service is aimed at adult organizers. Photos and content depicting minors may only be uploaded by those entitled to do so — typically the parents, or people with their consent. The organizer has moderation tools to remove inappropriate content.

Security

Private galleries are accessible only via token links; files are served through expiring signed URLs. Photos uploaded by guests go through the organizer's moderation before becoming visible. We automatically strip EXIF metadata (including GPS position) from uploaded images.

Changes to this policy

If this policy changes substantially, we will update the date above and, for relevant changes, notify organizers by email or through the application.